The Digital Omnibus delayed the hardest part of the EU AI Act, not the part most companies deal with. The strict rules for high-risk systems now start late in 2027, and in 2028 for AI built into regulated products. AI literacy, the bans, the rules for general-purpose AI models and the new labelling duties all apply in 2026, and regulators began enforcing them this year.
That gap matters because plenty of businesses read headlines about a pause and parked the subject. One of the two MEPs who steered the amendment through Parliament described it as "pressing the pause button on the AI Act" (European Parliament). The pause covers a narrow band of uses such as CV screening and credit scoring. A marketing team publishing AI video, a startup shipping a support bot, or a small firm whose staff use ChatGPT all day has duties today, and that holds wherever the company is based if it sells into or operates in the EU.
This guide covers what's in force, what the Omnibus changed, how to work out your role under the Act, and what to do in the next 90 days. It's a plain-English reading of the regulation and the European Commission's guidance, not legal advice. If anything you build or buy touches hiring, credit, education or public services, get a lawyer to look at your specific case.
What already applies, and since when
The AI Act entered into force in 2024 and has been switching on in stages ever since (European Commission). Three sets of rules were live before this year. The bans on practices such as social scoring, emotion recognition in workplaces and schools, and untargeted scraping of faces for recognition databases have applied since early 2025. So has the AI literacy duty in Article 4. Obligations for providers of general-purpose AI (GPAI) models followed later in 2025.
Read that timeline as two waves. The first, running through 2026, reaches almost every company that uses AI. The second, from late 2027, hits the much smaller group that builds or deploys high-risk systems.
This is the year the law got teeth. Most of the Act became applicable in 2026, including the transparency duties in Article 50, and the Commission's AI Office started enforcing alongside national authorities (European Commission). The AI Office supervises GPAI model providers. Since the Omnibus it's also exclusively responsible for most AI systems a lab builds on its own model, and for AI inside the very largest online platforms (EUR-Lex). Everything else, AI literacy and the bans included, sits with national market surveillance authorities, which began supervising Article 4 this year (Commission AI literacy Q&A).
What the Digital Omnibus changed
The Commission proposed the Digital Omnibus on AI late last year as part of a wider push to trim EU digital law. Parliament and Council reached a deal earlier this year, Parliament approved it by 423 votes to 57 with 174 abstentions, and Regulation (EU) 2026/1744 entered into force this year (European Parliament Legislative Train). It amends the AI Act rather than replacing it. The risk tiers, the roles and the fine ceilings all survive.
Six changes matter for a typical business:
- High-risk rules for stand-alone uses listed in Annex III, such as hiring, credit scoring and education, now apply from late 2027 instead of this year. High-risk AI built into regulated products like lifts or toys follows in 2028.
- Article 4 keeps the AI literacy duty but drops the old demand for a "sufficient level". Companies must "take measures to support the development of AI literacy", and the new text says this doesn't mean guaranteeing "any specific level of AI literacy of any individual".
- Generative AI systems already on sale before the transparency rules applied get four extra months, to late 2026, to add machine-readable marking to their output.
- A new ban covers so-called nudifier apps, which create intimate images of identifiable people without their consent, and AI-generated child abuse material. It applies from late 2026.
- Small mid-cap companies, the firms that have outgrown the SME definition, now share some SME relief: a simplified technical documentation form and lower fine caps for most breaches.
- Providers and deployers may process sensitive personal data, under strict conditions, to find and fix bias, and registration for Annex III systems a provider judges not to be high-risk survives in a lighter form.
What it left alone is just as useful to know. The Omnibus doesn't amend the deployer duties in Article 26, the core transparency duties in Article 50 or the fine ceilings for large companies (EUR-Lex). The high-risk delay also comes with a stated reason. The regulation's own recitals blame the late arrival of technical standards and the slow setup of national authorities.
The two lead MEPs framed the result differently. Arba Kokalari talked about the pause button and cutting red tape. Michael McNamara said the aim was "establishing legal certainty by extending certain timelines while preserving the AI Act's architecture" (European Parliament). For planning, McNamara's version is the one to work from.
Find your risk tier before anything else
The AI Act regulates uses, not brands. The same model can sit in three tiers depending on what you do with it, so list your uses before you list your vendors.
Most business AI lands at the bottom. The Commission says the Act introduces no rules for minimal-risk AI, and that "the vast majority of AI systems currently used in the EU fall into this category" (European Commission). Drafting emails in Claude, summarising meeting notes in Microsoft Copilot or writing code with GitHub Copilot won't make you a high-risk deployer. AI literacy still applies, because Article 4 covers every AI system regardless of tier.
High-risk is where the Omnibus delay bites. The Commission's examples include CV-sorting software, credit scoring, and AI used in education, migration and the courts. If you use a tool that filters job applicants, and many of the products on our AI recruiting tools board do some version of that, you're deploying a high-risk system. That's the case to plan for now, even though the rules start late in 2027. Our roundup of AI recruiting tools is a reasonable place to see how vendors in that category describe their screening features.
The transparency tier is about disclosure rather than danger: chatbots, deepfakes and AI-written text published to inform the public. A minimal-risk system can still carry a labelling duty.
The banned tier is short and mostly irrelevant to ordinary businesses, with one trap. Emotion recognition in the workplace is prohibited, apart from narrow medical and safety uses, and it has been since 2025. A tool that infers how your employees feel from their voice or face on calls is a problem today, not in 2027.
Provider or deployer: your role sets the duties
Most of your obligations follow from one question. Did you build or brand the AI system, or are you using one someone else built? The Commission's own example pairs a developer of a CV-screening tool (the provider) with a bank that uses it (the deployer). The Act reaches companies outside the EU too, since it covers anyone who places an AI system on the EU market or uses one in the EU (Commission AI Act FAQ).
For a deployer of a high-risk system, Article 26 is the list to know. You use the system according to the provider's instructions and give human oversight to people with "the necessary competence, training and authority". You monitor it, report problems to the provider and keep its logs for at least six months. Employers must also tell workers' representatives and affected staff before using it on them (AI Act). Providers carry the heavier load: risk management, technical documentation, conformity assessment and registration.
The role flip in the middle of that diagram catches people out. Under Article 25, you become the provider of a high-risk system if you put your own name or trademark on it, make a substantial modification, or change the intended purpose of an ordinary system so that it becomes high-risk. White-labelling a vendor's screening tool under your brand is the classic way to inherit provider duties without noticing.
If you build on someone else's model
A third role sits on top of the other two. If your product calls a model from OpenAI, Anthropic, Google Gemini or Mistral AI through an API, you're the provider of an AI system but not the provider of the model. The Commission's guidelines say a downstream company only becomes a model provider when its modification or fine-tuning uses more than a third of the original model's training compute (Commission GPAI guidelines Q&A). Model duties stay with the lab: technical documentation, information for downstream developers, a copyright policy and a public summary of training content.
That gives you something to ask for. The Commission can fine GPAI model providers from 2026 onward, and OpenAI, Anthropic, Google, Microsoft and Mistral AI have all signed the voluntary GPAI code of practice (European Commission). Ask your model vendor for its downstream documentation and where it publishes its training-content summary. If a provider won't share what you need, the Commission now runs a complaints channel for downstream providers.
Not sure where you sit? The tree below gets you there in three questions or fewer.
If you got more than one answer, say you deploy a recruiting tool and also ship a support bot, the duties stack. Run the tree once per use, not once per company.
Labelling AI content: the rule that landed this year
Article 50 is the part of the Act most likely to change what your customers see, and it has applied since this year. It splits the work between providers and deployers.
Providers must design chatbots and other interactive systems so people know they're dealing with an AI, unless that's obvious to a reasonably well-informed person. If you run a customer-facing bot from our AI support chatbots board, check that the disclosure appears at the first interaction. Providers of generative tools must also mark output "in a machine-readable format and detectable as artificially generated or manipulated" (AI Act). That's a job for the companies behind tools like Midjourney, ElevenLabs or Synthesia, not their customers. Systems already on sale before the rules applied have until late 2026.
Deployers carry the visible part. If you publish a deepfake image, audio clip or video, you must disclose that it's artificially generated or manipulated, though clearly artistic, satirical or fictional work only needs a disclosure that doesn't spoil it. AI-generated text published to inform the public on matters of public interest needs a label too, unless a person reviewed it and someone holds editorial responsibility for it (European Commission). Anyone using emotion recognition or biometric categorisation must tell the people exposed to it.
For a marketing team the practical rule is narrower than it sounds. Ad copy and blog drafts that an editor reviews are unlikely to fall under the text rule. A synthetic video of a real spokesperson saying words they never said falls squarely under the deepfake rule. Decide in advance which assets count, label those, and keep a record of who reviewed the rest.
The Commission backed the rule with guidelines on Article 50 and a voluntary code of practice on AI-generated content, which more than 180 organisations had signed by the time enforcement started (European Commission).
Fines and how enforcement will actually feel
The ceilings are high on paper. Breaching a ban can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other breaches, and GPAI model providers' failures, top out at €15 million or 3%. Giving regulators misleading information can cost €7.5 million or 1% (Commission AI Act FAQ).
Two details shrink those numbers for smaller firms. SMEs and start-ups pay whichever figure is lower, not higher. The Omnibus extends that lower-of rule to small mid-caps for ordinary breaches and misleading information, but not for the bans, and tells member states to weigh firms' "economic viability" when setting penalties (EUR-Lex).
AI literacy is enforced nationally, and the Commission says any sanction must be "proportionate, based on the individual case" (Commission AI literacy Q&A). For a small firm, the likelier risk is not a standalone literacy fine. It's that a thin record makes any other incident (a leaked customer file, a biased decision, a misleading AI answer to a customer) harder to defend.
Enforcement will also be uneven for a while. The national tracker at artificialintelligenceact.eu rated only nine member states "clear" on designating both their market surveillance and notifying authorities in its latest overview, while others were still drafting or passing laws (artificialintelligenceact.eu). Italy was first with a national implementing law. Expect your exposure to depend partly on where your EU customers and staff are.
A role-based checklist and a 90-day plan
The position for a typical SME is simple. Do the literacy and transparency work now, because it's live and cheap. Do high-risk work only if a use on your list is high-risk, and in that case start the paperwork now, because late 2027 is closer than any procurement and documentation cycle.
| Your role | Do now, in 2026 | Do before late 2027 |
|---|---|---|
| Deployer (you use AI tools) | Tool inventory, staff risk briefing, training record, labels for deepfakes and public-interest text, check for banned uses | For high-risk uses: named overseers, six-month log retention, worker notices, conformity evidence from vendors |
| Provider (you build or brand AI) | Team AI literacy, chatbot disclosure, machine-readable marking, a written note on any Annex III use you judge not high-risk | For high-risk systems: risk management, technical documentation (simplified form for SMEs and small mid-caps), conformity assessment, registration |
| Builder on a lab's model | Collect the model provider's documentation and training-content summary, check whether any fine-tuning nears a third of the original training compute | Carry the model information into your own provider documentation |
| GPAI model provider | Documentation, copyright policy, training-content summary, the GPAI code as a route to show compliance | Models on the market before 2025's rules must comply by 2027 |
The 90 days below assume a company with no AI compliance work done yet. Compress it if you're further along.
- Days 1 to 15: build the inventory. One spreadsheet with the tool, its owner, what it's used for, who it affects, and whether you built, branded or bought it. Include free accounts and browser extensions, since that's where shadow AI hides.
- Days 16 to 30: classify each use by risk tier and role, then stop anything that touches a banned practice.
- Days 31 to 50: run a short risk briefing for all staff and contractors, with deeper sessions for anyone who acts on AI output. The Commission's own example says employees using ChatGPT for ad copy or translation "should be informed about the specific risks, for example hallucination". Record names and dates.
- Days 51 to 70: put transparency in place. That means chatbot disclosures, a labelling rule for deepfakes and public-interest text, and a question to each generative vendor about how it marks output.
- Days 71 to 90: write a one-page AI usage policy, name an owner, and if any use is high-risk, open the documentation file and send those vendors a conformity questionnaire.
A spreadsheet is enough for most firms under 50 people. Larger teams juggling dozens of tools may want a governance platform such as Credo AI, OneTrust AI Governance or Monitaur, and our compliance and risk management board lists more. The Commission's free AI Act compliance checker is worth ten minutes before you buy anything. If your inventory turns up tools you wouldn't trust with customer data, our privacy framework for AI tools covers that side.
To see where your AI literacy work stands today, tick what you could already show a regulator.
A low score usually has the same fix, which is the record. The Commission doesn't require certificates, a set course or an AI officer, but it does expect you to show what you did, and an internal log of trainings is the evidence it names (Commission AI literacy Q&A).
What's still uncertain
The high-risk dates are now fixed in law, but the technical standards providers will use to show conformity were the reason for the delay in the first place. The Commission's proposal would have tied the start date to those standards being ready. The final text set hard dates instead (European Parliament Legislative Train). If standards slip again, providers face the same squeeze with no automatic extension.
The AI literacy change is contested. An analysis published by the IAPP argues that tying the duty to Commission examples and Board recommendations that haven't been written yet may make compliance harder to judge, not easier (IAPP). The same piece notes that high-risk deployers still need overseers with real competence under Article 26. The Commission's view is that the duty is simpler now, and the amended Article 4 obliges it to publish practical compliance examples. Both readings point the same way for a business: document your own definition of enough.
More guidance is still on its way. The amended Act requires the Commission to publish guidelines on how the AI Act fits with sectoral product law by a deadline in 2027, and to provide a simplified documentation form for SMEs and small mid-caps. The new ban also needs testing in practice: it reaches general image tools only when abuse is a foreseeable result and safeguards are inadequate, and where that line falls is for regulators and courts to settle. If you work in a regulated field, our guide to AI for legal work covers how firms handle that kind of uncertainty day to day.
Frequently asked questions
Does the EU AI Act apply to companies outside the EU?
Yes. It covers anyone who places an AI system or GPAI model on the EU market, or uses one in the EU, wherever they're based. A US software company selling an AI hiring tool to employers in Germany is a provider under the Act.
Was the EU AI Act delayed in 2026?
Only partly. The Omnibus moved high-risk rules to late 2027 for Annex III uses and 2028 for AI in regulated products. The bans, AI literacy, GPAI rules and transparency duties were not delayed, apart from a short marking grace period for older generative systems.
Do we need an AI literacy certificate or an AI officer?
No. The Commission says neither is required and there's no mandatory training format. What you need is proportionate measures for your staff and contractors, and a record showing what you did.
Is using ChatGPT at work high-risk?
Not for drafting, research or translation. Risk depends on the use, so the same assistant becomes part of a high-risk process if you use it to rank job candidates or decide on credit. If you're weighing options, our ChatGPT alternatives guide compares the main assistants.
When can regulators fine the big model makers?
The Commission can fine GPAI model providers from 2026. Models already on the market before the GPAI rules took effect in 2025 have until 2027 to fully comply, according to the Commission's GPAI guidelines.
