The AI Act after the Omnibus: what moved, what didn’t.

A quick refresher on how the AI Act works

The AI Act regulates AI by risk. Some uses are banned outright. Some are “high-risk” and carry heavy duties. Some only need transparency, such as telling people they are talking to a machine. Everything else is largely left alone.

The Act also assigns roles. A “provider” is whoever develops an AI system and puts it on the market under its own name. A “deployer” is the business that uses it, such as an employer running a hiring tool. Most duties fall on providers, but deployers have their own list.

Location does not protect you. The Act applies to providers placing AI on the EU market and to AI whose outputs are used in the EU, wherever the company is based. A US or Asian SaaS business with EU customers is in scope.

What moved: the high-risk deadlines

The biggest change is timing for high-risk AI. The Act has two kinds. “Annex III” systems are stand-alone uses listed in the Act, such as AI in recruitment, education, credit scoring and access to essential services. “Annex I” systems are AI built into products already regulated by EU safety law, such as medical devices and machinery.

After the Omnibus, Annex III obligations apply from 2 December 2027, not August 2026. Annex I obligations apply from 2 August 2028. Briefings on the final text report that systems already on the market before December 2027 are generally caught only if they are substantially modified after that date, and that AI used by public authorities has until 2 August 2030.

One smaller change matters for generative AI. Providers of systems placed on the market before 2 August 2026 that generate synthetic content now have until 2 December 2026 to add machine-readable marking to outputs.

• Annex III stand-alone high-risk AI: 2 December 2027
• Annex I product-embedded high-risk AI: 2 August 2028
• Machine-readable marking for generative systems already on the market: 2 December 2026

What didn’t move

Several obligations kept their original dates. The bans on prohibited practices, such as manipulative AI, social scoring and certain uses of emotion recognition at work, have applied since 2 February 2025. Duties for providers of general-purpose AI models, the large models that power many products, have applied since 2 August 2025.

Two more milestones arrived on 2 August 2026. The Commission’s enforcement powers over general-purpose AI model providers began, and the Article 50 transparency duties started to apply. Article 50 is the part of the Act that deals with chatbots, deepfakes and AI-generated text.

In practice, Article 50 means telling people when they are interacting with an AI system unless it is obvious. It means labelling deepfakes. It also means disclosing AI-generated text published to inform the public on matters of public interest, unless it has had human editorial review. If your product does any of these, the questions are live today.

New relief for growing companies

The original Act gave small and medium-sized enterprises (SMEs) some relief, such as simplified paperwork and lower fine caps. The Omnibus extends similar relief to a new category called the “small mid-cap”.

According to published briefings on the final text, a small mid-cap is a company that is not an SME, has fewer than 750 employees, and has either annual turnover of up to €150 million or a balance sheet of up to €129 million. Relief includes simplified technical documentation, more proportionate quality management, priority access to regulatory sandboxes and tailored penalty caps.

This matters for scale-ups. A company that has outgrown SME status but is far from big-tech size now has a lighter path. It still has the same substantive duties, so relief reduces the paperwork, not the obligations.

New bans and a softer literacy duty

The Omnibus adds two prohibitions. AI systems that generate realistic non-consensual intimate imagery of identifiable people, including so-called “nudifier” apps, are banned. So are systems that generate child sexual abuse material. These bans apply from 2 December 2026.

Reported commentary says the bans can reach general-purpose tools where such outputs are reasonably foreseeable and the provider lacks adequate safeguards. If you offer image or video generation, your content filters and abuse policies are now a legal control, not just a trust-and-safety choice.

The AI literacy duty also changed. The original text required providers and deployers to ensure a sufficient level of AI literacy among staff. The amended version is softer: businesses must take measures to support AI literacy, without guaranteeing a particular level for each person. Keeping a record of training and guidance remains sensible.

Who supervises you

Most AI Act enforcement sits with national authorities in each EU country. The Omnibus moves some of it to the AI Office, the Commission body that already oversees general-purpose AI models.

Briefings report that the AI Office now has exclusive supervision of AI systems built on a general-purpose model by the same provider or group, and of AI systems integrated into very large online platforms or search engines designated under the Digital Services Act. For a model provider that also ships its own assistant, this means one central regulator rather than up to twenty-seven.

The penalty ceilings themselves are unchanged. The Act allows fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches. For SMEs, the lower of the two figures applies.

How to use the extra time

A deferral is a runway, not an exemption. High-risk compliance requires a risk management system, data governance for training data, automatic logging, technical documentation, human oversight and accuracy and robustness testing. These are product capabilities, not policies, and they take quarters to build.

Take a recruitment SaaS selling to German employers. Its candidate-ranking feature is almost certainly Annex III high-risk. The provider will need documentation its customers can rely on, logs that show how rankings were produced and a way for recruiters to review and override results. Its customers, as deployers, will ask for all of this in procurement long before December 2027.

In my experience, the hardest part is not the documentation. It is deciding your role. Fine-tune a model, rebrand someone else’s system or change its intended purpose, and you may become a provider with the full set of duties. Settle that question early.

• Late 2026: classify every AI feature and confirm your role in the supply chain
• 2027: build logging, oversight controls and evidence collection into the product
• Before December 2027: complete technical documentation and conformity steps for Annex III systems

How this fits with the rest of the world

The EU is not the only market moving. South Korea’s AI Basic Act took effect in January 2026. Colorado and California now regulate automated decisions in hiring, lending and housing. The UK relies on existing regulators and its revised data protection rules on automated decision-making.

The good news is that the building blocks overlap. An inventory of AI features, risk assessments, logs, human review and clear user notices will serve you under most of these regimes. Build them once, to the EU standard, and adapt the paperwork per market.