What has changed since the first version
When I published this article in May, the big date was 2 August 2026. It no longer is for everything. On 24 July 2026 the EU published Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, in the Official Journal. It entered into force on 27 July, just ahead of that date.
Here are the five changes in short:
- High-risk obligations move to December 2027 and August 2028.
- Transparency is not delayed: it has applied since 2 August 2026, with a short grace period only for marking AI-generated content.
- The AI literacy obligation gets softer.
- The special treatment for SMEs now reaches somewhat larger companies too.
- Two new bans are added.
What hasn't changed: the AI Act still doesn't ban you from using AI in your company. It sorts uses by risk level and asks more or less of you depending on the case. And almost everything an SME does with AI today sits at the low end of that scale.
What already applies today
- Since 2 February 2025: the banned practices (social scoring, manipulation, emotion recognition at work, among others) and AI literacy.
- Since 2 August 2025: the rules for general-purpose AI models, the ones behind ChatGPT, Copilot or Gemini, and the penalty regime. Those rules are for OpenAI, Microsoft, Google and the like to meet, not you.
- Since 2 August 2026: the transparency obligations in Article 50 and the general application of the regulation, including the Commission's AI Office supervising those large models.
For an SME that uses AI, what really applies to you today is transparency and training. The rest either doesn't apply to you or hasn't arrived yet.
What comes next, and when
| Date | What applies |
|---|---|
| 2 Dec 2026 | End of the grace period for marking content generated by systems that were already on the market before August 2026. The two new bans also kick in: AI that creates non-consensual intimate images and child sexual abuse material. |
| 2 Aug 2027 | Every member state must have at least one regulatory sandbox up and running (it used to be August 2026). |
| 2 Dec 2027 | Annex III high-risk: employment, education, credit and essential services, biometrics, critical infrastructure. |
| 2 Aug 2028 | Annex I high-risk: AI that is a safety component of regulated products, such as machinery, toys or medical devices. |
For most SMEs, the next date that matters is December 2027, and only if one of their uses is high risk. But a delay is not a cancellation. If one of your systems screens candidates or assesses customers, getting the documentation, human oversight and logs ready takes months. December 2027 is closer than it looks.
If you only use AI tools
This is the case for almost every SME I know: Copilot in Office, ChatGPT for drafting, the AI feature your ERP or CRM switched on in its last update. In the regulation's terms you are a "deployer": you use a system someone else built. Here is what applies to you:
- Be open with your customers. If you have a chatbot on your website or on WhatsApp, people need to know they are talking to an AI. The formal duty sits with whoever builds it, but you are the one facing the customer, so check the notice is switched on. If you publish AI-generated images, video or audio that look real, you have to say so. The same goes for AI-generated text published to inform the public on matters of public interest without human review. An article you reviewed and signed with your own name doesn't count.
- Train your team. After the Omnibus you no longer have to "ensure" a sufficient level of AI literacy; you have to take measures to support it. That is a lighter burden of proof, but the point is the same: whoever uses the tool needs to know what it does and where it fails.
- Watch for uses that change category. Using ChatGPT to summarise emails is minimal risk. Using it to rank CVs and decide who gets a call is high risk, even though it's the same tool. What counts is the use, not the brand.
And something people often forget: the AI Act does not replace the GDPR. If you put personal data about customers or employees into an AI tool, the data protection rules still apply, just as before.
If you build or deploy high-risk AI
This is where the work gets serious. High risk is mostly AI that makes or shapes decisions about people: hiring and staff evaluation, access to credit or essential services, education. It also covers AI that is part of the safety of a regulated product, which matters to a lot of industrial manufacturers.
If you deploy a high-risk system someone else built, from December 2027 you will have to use it as instructed, put someone with sound judgement in charge of overseeing it, check that the data you feed it is fit for purpose, keep the logs it produces, and tell your staff before you use it in the workplace.
If you build it yourself, put your brand on someone else's system or modify it substantially, you become the provider. That means risk management, governance of the training data, technical documentation, a conformity assessment and registration in the EU database. If you think your system falls within an Annex III area but isn't actually high risk, for example because it only does a preparatory task, you can argue that, but you will still have to register it through a simplified procedure. Here I do recommend legal advice from day one.
SME relief after the Omnibus
The regulation already treated SMEs differently, and the Omnibus extends that to "small mid-caps": companies with up to 750 people and up to 150 million euros in turnover (or 129 million on the balance sheet). If your company has outgrown the SME label, you probably still get some relief.
- Simplified technical documentation and a quality management system scaled to your size.
- Lower caps on fines: the lower of the fixed amount and the turnover percentage applies, and authorities must consider the company's economic viability.
- Priority access to sandboxes, the supervised testing environments. There will be an EU-level one run by the AI Office, and every country will have its own by August 2027. In Spain, AESIA, the national AI supervisor, has also published 16 free practical guides.
To give you a sense of scale, fines reach 35 million euros or 7% of worldwide turnover for banned practices, and 15 million or 3% for breaching high-risk or transparency obligations. For an SME the lower figure applies, but it's still not a number to take lightly. The relief is real, but it doesn't come on its own: you have to know about it and ask for it.
The real work is about data
And here comes my part, the one almost nobody tells you. Almost everything the AI Act will ask of you (knowing which data your AI uses, where it comes from, whether it's biased, being able to explain a decision, keeping a record) is, at heart, data governance. If you are clear on which data feeds each system, with what quality and what definition, complying is mostly a matter of writing it down.
The trouble starts when your data is scattered across fifteen spreadsheets and nobody knows where each number comes from. Then the problem isn't the law. It's that you don't control your own information, and the law has simply put that in front of you.
The AI Act doesn't force you to understand your data. It forces you to prove you understand it. And that can only be faked until someone asks.
Your practical checklist
- Take stock of your AI uses. Include what comes in through the back door: the salesperson using ChatGPT on their own, the copilot your CRM turned on without telling you. One sheet with the tool, what it's used for, who uses it and what data it gets.
- Classify the risk of each use. One question is enough to start: does it make or influence decisions about people, or is it part of a product's safety? If the answer is yes, flag it and get advice in good time.
- Train your team. One hands-on session on the tools used in your company and a one-page internal guide. Keep a record of who has done it.
- Check transparency with customers. A visible notice on the chatbot, a label on generated content that looks real, and a line in your privacy policy about which AI you use.
- Get the data behind each system in order. Where it comes from, who maintains it and how it's defined. It's the base for everything above, and it pays off with or without a law.
The bottom line
The Omnibus has given you more time for high risk, not an excuse to stop. What already applies to almost every SME is small and reasonable: say so when AI is involved, and make sure your team knows what it's using. The SME that uses this window to know which AI it has and with what data won't just comply in 2027. It will make better decisions than its competitors starting now.
Updated October 2026. This article is for information only and is not legal advice: check your specific case with a lawyer.
Sources
- Regulation (EU) 2026/1744, Digital Omnibus on AI (EUR-Lex)
- Regulation (EU) 2024/1689, the Artificial Intelligence Act (EUR-Lex)
- European Commission: regulatory framework for AI
- AESIA: guides for complying with the AI Act (Spanish)
- Cuatrecasas: Digital Omnibus on AI, key changes to the AI Act
- Cooley: Digital AI Omnibus delays key deadlines, introduces new rules
- White & Case: EU AI Omnibus enters into force
- Abreu Advogados: the key amendments to the AI Act