EU AI Act
Code of Practice:
What You Actually Need to Do

On June 10, 2026, the European Commission published the first Code of Practice for labeling AI-generated content. A week earlier, Germany's National Security Council founded the German AI Safety Institute, DE-AISI. Both sound like new regulatory burdens. For SMBs, it's mostly a clarification: Brussels supplies the tool, Berlin reviews the large models — and SMB users can focus on what actually affects them: transparency.

What is the Code of Practice — and what isn't it?

The Code of Practice isn't a new law, but a compliance tool from the European Commission that helps companies implement Article 50 of the EU AI Act.

The EU distinguishes two roles. Providers — companies that build or offer generative AI systems — must mark their outputs in a machine-readable way. Deployers — companies that use generative AI, which is most of the SMB sector — must disclose AI-generated deepfakes and AI-generated text on matters of public interest.

The Code of Practice supplies a common standard for this, including official EU icons for labeling. Signatories get legal certainty across all member states. Those who don't sign have to demonstrate compliance individually. Both are legitimate paths.

Important for SMBs with existing AI systems: the AI Omnibus of May 7, 2026 gives systems already on the EU market before August 2 until December 2, 2026 to implement machine-readable marking. The remaining disclosure obligations apply from August with no transition period.

Who does DE-AISI review — and who doesn't it review?

On June 8, 2026, Germany's National Security Council decided to found the German AI Safety Institute. The first phase runs virtually through the existing structures of the BSI (Federal Office for Information Security) and the Federal Network Agency — no dedicated budget, no location, no staffing plan yet.

The mandate is clear: DE-AISI reviews frontier AI models and produces situation reports for the federal government. Phone agents, booking assistants, and marketing chatbots — the typical AI applications at SMBs — are not covered by this mandate.

Bitkom is calling for funding on the level of the UK's AISI, which has had £360 million available since November 2023 and employs more than 100 technical staff. Experts speak of a starting budget of at least €100 million — the federal government hasn't committed to a figure so far.

DE-AISI is not a new oversight body for your company. It's the body that reviews your AI providers.

What does this concretely mean for trades businesses, financial advisors, and other SMBs?

In the EU's framework, SMBs are almost always deployers — they use AI, they don't build foundation models. Their obligations focus on transparency and documentation.

Starting August 2, 2026, the following concretely applies:

• Chatbot disclosure: Users must be able to tell they're interacting with AI — for example, through an announcement at the start of a phone call with an AI agent.
• Deepfake disclosure: AI-generated image, audio, and video content must be labeled as such.
• Public-interest disclosure: AI-generated text on matters of public interest must be disclosed — unless editorial responsibility has been taken for it.

Whether it's a trades business with an AI phone agent or a financial advisor with automated initial qualification — the deployer obligations are manageable. Amazing Agents builds setups where these transparency obligations are built in from the start.

High-risk applications like biometric identification affect only a small share of SMBs and don't kick in until August 2, 2027.

For a sense of the costs: Bitkom estimates €80,000 to €250,000 in initial compliance costs and €30,000 to €70,000 annually for ongoing documentation, for a company with around 500 employees. Since March 2026, the federal government has been funding up to 50% of these costs through a €500 million program, capped at €250,000 per company.

Three things you can check this week

Compliance doesn't have to be a source of anxiety. The Code of Practice is Brussels's way of saying: here's the toolkit — use it. Three concrete steps:

1. Check your chatbot and phone-agent disclosure: Does your AI system make it transparent at the start of every interaction that the user is speaking with AI? At Amazing Agents, that's automatically built into Ben's opening announcement.
2. Establish a labeling process for AI content: If you create images, videos, or text on public-interest topics with AI — do you have a workflow for labeling it?
3. Request provider documentation: If you use foundation models via an API, ask your provider about their marking and metadata pipeline. That's their obligation under Art. 50(2), but you benefit from it directly.

At Amazing Agents, we help SMBs implement exactly this — without an in-house legal department.

This article offers general guidance and does not constitute binding legal advice.

FAQ — EU AI Act Code of Practice and SMBs

Is the Code of Practice mandatory?

No. The Code of Practice is voluntary. What's mandatory is Article 50 of the EU AI Act, which applies from August 2, 2026. The Code of Practice is the tool the EU recommends for meeting that obligation.

Does DE-AISI audit my company?

No. DE-AISI reviews frontier AI models like GPT, Claude, or Gemini — not the AI applications used by SMBs.

What does AI Act compliance cost SMBs?

Bitkom estimates €80,000–250,000 initial costs and €30,000–70,000 annually for a company with ~500 employees. A federal funding program (€500 million) covers up to 50% of the costs, capped at €250,000 per company.

Do I have to label deepfakes?

Yes. Deployers must disclose AI-generated image, audio, and video content as such — starting August 2, 2026.

What happens if I don't sign the Code of Practice?

Nothing forbidden. You'll then have to demonstrate compliance with Article 50's requirements individually to the responsible market surveillance authority.