Every new EU law is drafted, negotiated and costed on its own. The combined burden of EU regulation for SMEs and mid-sized companies, however, is something nobody adds up. That became clear to me in Brussels in October 2026, where I spent two days in background talks with the Wirtschaftsbeirat Bayern, a Bavarian business advisory council. We met with the European Commission, the European Parliament and various interest groups. On the agenda were the AI Act, NIS2, the Cyber Resilience Act and the so-called Omnibus package.
An Answer Without Hesitation
In Parliament, I asked a policy adviser whether anyone actually calculates what a new law costs a business with 50 employees.
Her answer came immediately. Nobody is obliged to use AI, she said. Moreover, everyone involved had known that the Commission had no money for implementation. If in doubt, business owners would simply have to pay.
That sentence stayed with me all evening. Of course, nobody has to use AI. Equally, nobody has to use the telephone. Things just get difficult with your customers.
According to Bitkom, Germany’s digital industry association, 57 percent of German companies with 20 or more employees already use AI, and 61 percent believe that businesses without AI have no future. In most organisations, therefore, the question of whether to use AI was settled long ago.
We Are Affected Too
At DIKT, our small consultancy, AI agents have also been working alongside us for a few weeks now, namely for CRM, quotes and travel expenses. As a result, the same rule applies to us that has applied to every company using AI since February 2025: we must demonstrably ensure that our staff know how to work with it. That is what Article 4 of the AI Act requires.
The alternative would be to do without AI altogether. At least, that is how I understood the adviser’s recommendation.
EU Regulation for SMEs: An “Ecosystem” of Twenty Laws
A representative of Bitkom showed us a slide titled “Regulation as an Ecosystem”. On it were almost twenty boxes: the AI Act, NIS2, the Cyber Resilience Act, the Cybersecurity Act, DORA, the General Data Protection Regulation, eIDAS, Germany’s KRITIS umbrella law for critical infrastructure, the German NIS2 implementation act and several more.
Some of the boxes overlap. DORA, for example, covers half of the KRITIS umbrella law, so it is barely legible. And at the far left edge, the next box is already waiting: NIS3, with a question mark.
Caption: Bitkom slide “Regulation as an Ecosystem”
Ecosystem is a friendly word. After all, in an ecosystem, much regulates itself. Here, on the other hand, nothing regulates itself.
Bitkom also brought another figure. According to the association, 93 percent of German companies affected by the AI Act expect high or very high implementation effort. And that applies to this one law alone, in other words to just one of almost twenty boxes.
Regulation as an Ecosystem
What This Means When Things Go Wrong
Take a German machinery manufacturer with 120 employees that falls under NIS2 and builds networked control systems. One day, it comes under attack.
Under NIS2, it must send an early warning to the BSI, Germany’s Federal Office for Information Security, within 24 hours. If the attackers exploit a vulnerability in the company’s own product, the Cyber Resilience Act has required a second early warning since 11 September 2026, again within 24 hours, via the platform of ENISA, the EU cybersecurity agency. If customer data is also affected, the data protection authority comes into play with a 72-hour deadline. At the same time, customers, staff, the company’s bank and its insurers all want to know what is going on.
In a company of this size, all of this is often written by one and the same person. Frequently, it is the very person who fixed the printer problem in accounting on Monday.
The Solution Arrives Later Than the Deadline
Brussels is well aware of the problem. That is why the Omnibus package provides for a single reporting point: report once, and it is automatically distributed to all authorities. However, this changes nothing about what must be reported and by when. Furthermore, the reporting point is only due to launch 18 months after entry into force, or even after 24 months if necessary. And in the ongoing negotiations, it is shrinking piece by piece.
The deadlines therefore remain at 24 hours. The portal meant to make those 24 hours easier, by contrast, will take up to two years to arrive.
93 Percent Versus 160 Billion: The Real Dilemma
The same association also has a second figure. Cyberattacks have caused at least 160.4 billion euros in damage to the German economy this year.
So 93 percent say: too much effort. 160 billion, on the other hand, says: too little protection. Both figures are correct, and that is exactly where the dilemma lies.
These rules exist for good reasons. In addition, the people we spoke with in Brussels are genuinely working on simplification. However, none of them is the one who has to write the report on Monday morning.
What You Can Do Right Now
Do not wait for someone to add up the total for you. Instead, set aside an hour with the people who would write the reports in an emergency, and settle two questions:
- Which of these rules apply to us, and who has checked? In Germany, the BSI will not tell you whether you fall under NIS2. You have to find that out yourself.
- Who reports what, to whom and by when in an emergency? And who stands in for that person when they are on holiday?
With every new rule that lands on your desk, a third question is also worth asking: who in our organisation will take this on, and above all, what will that person stop doing as a result?
That is the question I brought back from Brussels.
PS: So that nobody thinks Brussels consists only of regulation: mussels and fries were the only Brussels package of the week whose scope nobody complained about.
Dr. Nikolai A. Behr CSP® ist Keynote Speaker, Kommunikationsexperte und Medientrainer für Führung, Vertrauen und empathische Kommunikation in Zeiten von Wandel und KI.