AI Readiness for SMEs and Enterprises: The EU AI Act, GDPR and Getting Your Data in Order

A reference guide for the directors who have been asked to "get the business ready for AI" and want to know what that means in practice: which regulations apply and when, what has to be true about your data, and how the work differs between a small firm and a large one. It links out to the deeper pieces on each topic as it goes.

Most businesses do not have an AI problem. They have a readiness problem that shows up the moment they try to use AI.

The pattern is familiar. Staff are already pasting customer emails into ChatGPT. Someone has bought a Copilot licence for the leadership team. A supplier has added an "AI-powered" feature to software you already run. And somewhere on the board agenda there is a line that says AI strategy, owned by nobody in particular.

Meanwhile the rules have arrived. The EU AI Act is partly in force and its high-risk deadline is fixed. GDPR has applied to every system that touches personal data since 2018, and AI systems are no exception. And the single biggest reason AI pilots fail to reach production has nothing to do with regulation or models: the data they need is scattered, duplicated, unowned and badly permissioned.

This guide covers the four things that decide whether a business is ready: the EU AI Act, GDPR, data centralisation and data organisation, and then sets out what readiness looks like for an SME and for an enterprise.

What AI readiness means

AI readiness is a business's ability to adopt AI safely, lawfully and profitably. In practice it means being able to answer five questions with evidence rather than assumption:

1. Regulation. Which of our AI systems, bought or built, fall under the EU AI Act, at which risk tier, and what do GDPR and sector rules require of them?
2. Data. Is the data an AI system would need in one place, current, owned, and permissioned so that people only see what they are entitled to?
3. Security. Can we stop an AI system leaking data, being manipulated through its inputs, or acting outside what it is allowed to do?
4. People and policy. Do staff know which tools they may use, with which data, and have they had the AI-literacy training the Act now expects?
5. Value. Is there a use case with a baseline, a target and a measurement period, so we will know whether it worked?

A business that can answer all five is ready to build. A business that cannot is not blocked; it simply knows what to fix first. That is what an AI readiness assessment produces.

The EU AI Act: what applies now, and what is coming

The EU AI Act, Regulation (EU) 2024/1689, regulates AI systems according to risk. It entered into force on 1 August 2024 and applies in stages. In July 2026 the "Digital Omnibus on AI", Regulation (EU) 2026/1744, moved the high-risk deadlines back and fixed them as dates rather than tying them to standards being ready.

The timeline as it stands:

Does it apply to a UK business?

Yes, where an AI system's output is used in the EU, or where you place AI on the EU market or supply it to EU customers. A UK recruiter placing candidates into EU roles, a lender with EU customers, or a software company selling an AI feature into the EU is commonly in scope. Brexit does not take a UK firm out of the Act if its AI reaches EU users.

Most systems are not high-risk, but you have to show your working

For most businesses, the bulk of AI use is limited or minimal risk: drafting, summarising, internal search, document extraction. Those systems carry light obligations, mainly transparency and literacy. The obligations that cost real engineering time attach to high-risk systems: risk management, technical documentation, data governance, automatic logging, human oversight and post-market monitoring.

The catch is that you cannot know which of your systems are high-risk until you have listed them all and classified each one. That inventory is the first deliverable of any readiness work, and the place most businesses find a surprise: a CV-screening feature in their applicant tracking system, a credit-scoring rule a supplier quietly upgraded to a model, or an interview tool that scores emotion from facial expression, which is not high-risk but banned.

Penalties, and what SMEs get

Fines reach €35 million or 7% of global turnover for prohibited practices, and €15 million or 3% for breaching most other obligations, including the high-risk requirements. For SMEs and start-ups the lower of the two figures applies. SMEs also get simplified technical documentation and priority access to regulatory sandboxes, and the Omnibus extends some of those simplifications to a new category of small mid-cap companies. None of it is an exemption.

If you operate in a regulated sector, our five-part series covers what the Act requires sector by sector: recruitment and HR, finance and insurance, education, healthcare and critical infrastructure. The engineering side of compliance is set out on our EU AI Act readiness page.

GDPR: the AI regulation you are already subject to

The AI Act gets the headlines, but for most businesses GDPR, and the UK GDPR alongside it, is the regulation their AI systems will actually be tested against first. It has applied since 2018, its fines reach €20 million or 4% of global turnover (£17.5 million or 4% under the UK GDPR), and it applies to any AI system that processes personal data, whatever its risk tier under the AI Act.

Where AI and GDPR meet in practice:

• Lawful basis. Using customer or employee data to train, fine-tune, evaluate or feed a retrieval system is processing, and needs a lawful basis. Data collected to deliver a service cannot automatically be repurposed to build a model. The European Data Protection Board's Opinion 28/2024 sets out how legitimate interest can and cannot be relied on for AI models.
• Purpose limitation and data minimisation. An assistant that can read every file on the shared drive is processing far more personal data than the question in front of it needs. Scoping what an AI system can reach is a GDPR control, not only a security one.
• DPIAs. New technology processing personal data at scale, or making decisions about people, usually needs a Data Protection Impact Assessment before it goes live. Under the AI Act, deployers who must carry out a Fundamental Rights Impact Assessment can build it on the DPIA rather than starting again.
• Automated decisions. EU GDPR Article 22 restricts decisions made solely by automated means that have legal or similarly significant effects on people, such as declining a loan or rejecting a job application. In the UK, the Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D from February 2026, relaxing the restriction for most personal data but keeping safeguards: the right to be told, to make representations, and to have a person review the decision. A UK firm serving EU customers still has to meet the stricter EU rule.
• Subject rights. If personal data is inside an AI system's index, logs or training set, a subject access or erasure request reaches it too. That is only manageable if you know where the data went: our guide to GDPR, PII and AI maps the prompts, indexes, logs and vendor systems where copies end up.
• International transfers. Many AI services process data outside the UK and EU. Where the data is processed is a GDPR question as well as a commercial one, and the reason AI sovereignty has moved from a niche concern to a board-level one.

The ICO's guidance on AI and data protection is the UK regulator's own view and is worth giving to whoever owns data protection in your business.

The practical point: if your GDPR house is in order, with a current data map, retention rules that are actually enforced and subject requests that pull from every system, much of AI Act readiness is already done. If it is not, AI will make the gaps bigger and more visible. That work is data protection engineering: building the obligations into systems so they run automatically.

Data centralisation: AI can only be as good as what it can reach

Ask a business why its AI pilot stalled and the honest answer is usually data.

AI systems that are useful inside a business, such as internal assistants, document processing and decision support, all depend on the same thing: retrieving the right, current information from your own records. When that information is scattered, AI inherits the mess:

• Conflicting answers. The customer's address is different in the CRM, the finance system and the spreadsheet the account manager keeps. The assistant picks one, confidently.
• Stale answers. The pricing policy on the shared drive was superseded two years ago, but nobody deleted it, so the model reads it alongside the current one.
• Missing answers. The knowledge that matters lives in email threads and in people's heads, so the AI cannot find it at all.
• Oversharing. The assistant can read a folder that was shared with "everyone" in 2019 and has held salary data ever since. Nobody noticed until a junior colleague asked a question and got a precise answer.

Data centralisation is the work of bringing the information AI needs into a small number of governed sources, each the agreed source of truth for its data. It does not mean one giant database. It means:

• An inventory. Every system that holds business data, what it holds, who owns it and how it connects. For many businesses this is the first time it has been written down.
• A source of truth per data domain. Customers in the CRM, invoices in finance, staff in HR, and integrations so data is entered once and flows rather than being re-keyed.
• Spreadsheets retired where they are doing a system's job. The quoting model, the stock tracker, the compliance register: the processes the business runs on Excel are usually the data AI most needs and can least safely use. Turning them from spreadsheets into systems is often the highest-value readiness work there is.
• Documents consolidated. One governed document store, with duplicates and superseded versions archived, rather than five shared drives, three SharePoint sites and an old file server.

Data organisation: owned, classified, permissioned

Centralising data puts it in the right place. Organising it makes it safe and useful to point AI at.

• Ownership. Every data domain has a named owner who decides who may access it and for how long it is kept. Without owners, nobody can answer the questions a DPIA or an AI Act classification asks.
• Classification. Data is labelled by sensitivity: public, internal, confidential, personal, special category. Classification is what lets you decide which AI workloads can use a cloud API under enterprise terms and which must stay on infrastructure you control.
• Permissions that are true. AI retrieval should honour the access a person already has in the source system, which only works if those permissions have been reviewed. A permissions clean-up is one of the most common, and most valuable, findings of a readiness assessment.
• Retention. Data held past its retention period is a GDPR liability and an AI accuracy problem at the same time. Enforced retention shrinks both.
• Quality and lineage. Knowing where a record came from and when it was last updated is what lets an AI system cite its source, and lets a person check it.
• Personal data minimised before it reaches AI. Where personal data is not needed for the task, removing it before it reaches a model is the simplest control there is. PII Purge, the redaction service we built and run, exists for exactly this.

Done together, centralisation and organisation are what we call data foundations for AI. They are unglamorous, they rarely appear in an AI vendor's demo, and they decide whether the AI you buy or build gives answers anyone can trust.

AI readiness for SMEs

For a business of 10 to 250 people, readiness is mostly about focus. You do not need a governance committee. You need to know what you have, stop the risky things, and pick one use case worth doing properly.

A practical sequence:

1. List every AI tool in use. Including the free ones staff use on their own initiative, and AI features inside software you already pay for. This takes days, not weeks.
2. Write a one-page usage policy. Which tools are approved, what data may go into them, and what must never leave the business. Pair it with short AI-literacy training, which the Act has expected since February 2025.
3. Check for anything prohibited or high-risk. Hiring, credit and insurance decisions are where SMEs most often find themselves in scope, usually through a bought tool.
4. Map the data for one use case. Not the whole business, just the information the first use case needs: where it lives, who owns it, who can see it, and how clean it is.
5. Fix the data before building. Consolidate, clean and permission the sources that use case depends on. This is usually the bulk of the effort and the part that keeps paying back.
6. Build one thing and measure it. With a baseline taken before launch, so the result is a number rather than an impression.

The common SME mistake is to skip to step six. The tool works in the demo, then gives wrong answers on real data, and the business concludes that AI does not work for it. The tool was rarely the problem.

AI readiness for enterprises

For a business of several hundred to several thousand people, the foundations are the same but the problem is scale and coordination. AI is already being adopted in a dozen places at once, often without central visibility.

What readiness adds at enterprise scale:

• An AI system register. Every system, bought or built, across every business unit, with its owner, purpose, data, risk classification under the Act and provider-or-deployer role. Retraining or substantially modifying a vendor's model can make you a provider, with much heavier obligations; the register is where that gets caught.
• Formal governance. A management system for AI, increasingly mapped to ISO 42001, which procurement teams are starting to ask for and which maps well onto the Act's obligations.
• Controls built into the platform. Logging, human oversight and policy enforcement that every AI system inherits, rather than each team building its own. This is the approach behind swarmd.ai, the EU AI Act readiness platform for governing AI agents that we are the core engineering team for.
• AI security. Prompt injection, data exfiltration through model outputs and over-privileged agents are now on penetration-test scopes. AI system security needs an owner.
• A data platform, not a data project. Centralisation becomes an ongoing capability: integration, cataloguing, retention and access review run as a service rather than a one-off clean-up.
• Supplier due diligence. Your customers will send AI sections in their questionnaires; your suppliers' AI becomes your exposure as a deployer. Both need answering from evidence.

The common enterprise mistake is the opposite of the SME one: a governance framework written before anyone has inventoried what AI is actually running, so the policy describes a business that does not exist.

An AI readiness checklist

Whatever your size, you are ready to build when you can tick these:

• Every AI system in use, including bought tools and features, is listed with an owner.
• Each system is classified under the EU AI Act, with the reasoning written down.
• Nothing prohibited is in use, and high-risk systems have a dated plan to December 2027.
• An approved-tools policy exists and staff have had AI-literacy training.
• Personal data used by AI has a lawful basis, and a DPIA exists where one is required.
• Automated decisions about people have human review where the law requires it.
• The data each AI use case needs is in a governed source of truth, with an owner.
• Permissions on that data have been reviewed, and AI retrieval honours them.
• Retention rules are enforced, including for AI logs and indexes.
• Sensitive data is classified, and you know which AI workloads may use it and where they run.
• The first use case has a baseline, a target and a measurement period.

If most of those are unticked, you are in good company. The point of readiness work is not to tick boxes; it is to find the two or three gaps that would cause real damage, and to fix them in the order that unlocks the most value.

Where to start

Start with the inventory. It is cheap, it is fast, and it answers the questions everything else depends on: what AI you are running, what data it touches, and where your exposure is.

If you want help, an AI readiness assessment from Hexploits is a fixed-price piece of discovery: the inventory and classification, a review of the data your priority use cases depend on, the GDPR and AI Act gaps, and a prioritised roadmap your board can act on. We do the engineering and operational side, alongside your legal counsel, and we build what the roadmap calls for if you want us to.

For the deeper reading behind this guide, see what it costs to teach an AI your business, the EU AI Act high-risk series, and our guide to decision APIs for where AI should and should not make the small, repeated calls inside a workflow.

This article describes the regulatory position as of November 2026. It is not legal advice; take your own legal advice on how the law applies to your business.