By Martin Scott

. 5 min read

The EU has moved the AI Act’s biggest compliance dates, but not the ones most small teams run into first. Under the Digital Omnibus on AI, the high-risk rules now start on 2 December 2027 for uses listed in Annex III. AI inside regulated products follows on 2 August 2028. The duties that already apply, plus two new deadlines on 2 December 2026, stay where they were.

This is an analysis: our reading of the amended text, date by date, for teams that build or use AI tools in the EU.

What the Omnibus is

The Omnibus is Regulation (EU) 2026/1744 of 8 July 2026, which amends the AI Act (Regulation (EU) 2024/1689). The European Parliament’s summary of the final act says it was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is directly applicable in every member state, so the new dates apply without any national law to carry them over.

The quickest way to read the changes is the Commission’s consolidated text of Article 113 on the AI Act Service Desk, which marks every amended passage. That is the article that sets when each part of the law applies.

What moved

High-risk rules: 2 December 2027 and 2 August 2028

Article 113(c) covers Chapter III, Sections 1 to 3, the core high-risk requirements. They apply from “2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III”. For the rest, the date is “2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I”. Annex III covers sensitive uses such as employment and law enforcement, according to the AI Act Service Desk FAQ.

Annex I covers AI built into products that already have EU safety rules, such as medical devices.

Under the original plan, the FAQ says, parts of the Act were “set to apply on 2 August 2026 and 2 August 2027.”

The Commission’s proposal tied the new start to the availability of standards. It capped the delay at 16 months for Annex III and 12 months for Annex I. The adopted Article 113 simply writes in the end dates. In our reading that helps a small team more than a moving trigger would, because you can plan against a fixed date.

Fewer products count as high-risk

A new Article 6(1a) narrows what counts as a safety component. It excludes AI systems “solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control”. Article 6(1b) pulls back anything whose failure “would endanger health and safety.” For a team adding a help assistant or a scheduling feature to a regulated product, that carve-out can take the feature out of the high-risk regime entirely.

Older high-risk systems get a pass, with conditions

Amended Article 111(2) deals with high-risk systems already on the market before the relevant date. The Act applies to them “only if, as from that date, those systems are subject to significant changes in their designs.” Systems meant for public authorities must comply “by 2 August 2030” regardless. So a tool you sell to a city council does not get the same shelter as one you sell to a private firm.

What did not move

AI literacy, softened but still in force

The literacy duty has applied since 2 February 2025 under Article 113(a). The Omnibus rewrote it. Article 4(1) now says providers and deployers “shall take measures to support the development of AI literacy of their staff”. It adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

The Parliament summary describes the change as no longer requiring a particular level for each person. It is still a duty to act, so a team using AI tools should be able to show what training or guidance it gave.

Transparency rules since 2 August 2026

Article 50(1) requires that people are “informed that they are interacting with an AI system” unless that is obvious. The Commission’s implementation timeline lists 2 August 2026 as the date transparency rules started to apply. The Omnibus gave this duty no extra time. A customer chatbot on your site is already covered.

The two December 2026 deadlines

Two dates fall on 2 December 2026, three weeks from now. First, Article 111(4) gives providers of generators “placed on the market before 2 August 2026” until “2 December 2026” to comply with the Article 50(2) marking duty. We covered what the marking duty asks of older AI generators in detail last month. The FAQ notes the Commission had proposed “a transition period of 6 months”; the law gives four.

Second, Article 113(a) brings in the new prohibitions in Article 5(1), points (ba) and (bb), from 2 December 2026. The Parliament summary says they cover systems that generate realistic non-consensual intimate material of identifiable people and child sexual abuse material. For providers, the ban applies where that is the intended purpose or “a reasonably foreseeable and reproducible outcome” without adequate safeguards, in the summary’s words.

What changes for small and mid-size companies

The Omnibus adds a second size class, small mid-caps (SMCs), and extends some SME relief to them. The Parliament summary says SMEs, start-ups and SMCs may use simplified technical documentation for high-risk systems. The Commission’s FAQ estimated, at proposal stage, that the SMC extension would reach “an additional 8,250 companies in Europe.” We could not find an updated figure for the adopted text.

Fines are where the size classes matter. Article 99 caps prohibition breaches at EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Breaches of a list of other duties, including Article 50, are capped at EUR 15 million or 3%.

Article 99(6) flips that to “whichever thereof is lower” for SMEs. The new Article 99(6a) gives SMCs the same “whichever is lower” rule, but only for paragraphs 4 and 5. In our reading, a mid-size firm that breaches a prohibition still faces the higher of the two caps.

Oversight also shifts. The Parliament summary says the AI Office, the Commission’s AI regulator, gets exclusive powers in two cases. One is AI systems built on a general-purpose model by the same company, the other is systems inside very large online platforms. A team building on a vendor’s model still answers mainly to its national market surveillance authority.

Outside the EU, deadlines are moving too: New York’s chatbot rules for minors now start in June 2027.

Our reading

The Omnibus bought time for the expensive part of the Act, high-risk compliance, and left the cheap, visible parts in place. For most small teams the live obligations today are literacy, chatbot disclosure and, from 2 December, content marking and the new bans. The relief is real for anyone selling hiring tools or other uses listed in Annex III. For everyone else, the calendar did not change much.

What to do this week

Write a one-page register of every AI tool your team builds or uses. Mark each one with its date: already in force (Article 4 and Article 50(1)), 2 December 2026 (marking for older generators, new bans), 2 December 2027 (Annex III uses) or 2 August 2028 (Annex I products). Then check whether you count as an SME or SMC, because that decides your fine ceiling. If anything lands on 2 December 2026, start on it now.

Sources

Martin Scott

Martin Scott is the editor for business and policy at AI Observer, covering startups and deals, regulation, health and science, and AI agency profiles. He follows the money and the legal text, and separates what a rule says from what people claim it says. His style is analytical and plain-spoken.

Spotted a mistake? Tell us on the corrections page.

Conversation

Every comment is reviewed before it appears, so there can be a short delay.