EU AI Act compliance deadlines: 2026–2027 timeline

The AI Act timeline after the 2026 omnibus

The AI Act (Regulation (EU) 2024/1689) does not apply all at once. Its rules switch on in stages, and in July 2026 the EU moved some of the later dates. The amending act, Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

The rows up to 2 August 2026 already apply to every business in scope. The last two rows are the postponed high-risk dates, which matter only if you build or use AI for one of the sensitive purposes listed in the law.

What the Digital Omnibus on AI changed, and what it did not

The omnibus is a targeted amendment that gives more time for the heaviest part of the AI Act, the rules for high-risk AI systems. Stand-alone high-risk systems listed in Annex III, such as AI that screens job applicants or assesses creditworthiness, must now comply from 2 December 2027 instead of 2 August 2026. High-risk AI built into products covered by EU product legislation (Annex I) moves from 2 August 2027 to 2 August 2028. Both are fixed calendar dates you can plan against.

Several things were not delayed. The bans on prohibited AI practices and the AI literacy duty have applied since 2 February 2025. The rules for general-purpose AI models have applied since 2 August 2025. The transparency duties in Article 50, such as telling people they are talking to a chatbot and marking AI-generated content, apply from 2 August 2026 as originally planned. The only relief there is a transition until 2 December 2026 for marking content produced by AI systems that were already on the market before 2 August 2026.

What a small business that uses AI must do now

Most small businesses do not develop AI. They use it: a website chatbot, an AI phone receptionist, a writing assistant, AI features in CRM, accounting or HR software. For them, the AI Act today means transparency towards customers, AI literacy in the team, and not drifting into prohibited or high-risk uses unnoticed.

For a typical small business, such as a dental practice with a booking chatbot, a hotel with an AI phone line or an online shop using AI to draft product texts, steps 1, 2, 4 and 6 below are the whole job for now. Work through them in order:

• 1. List every AI tool in use: website chatbots, voice and phone assistants, AI features in your CRM, email or HR software, and tools staff use on their own, such as text or image generators. Note who uses each and for what.
• 2. Mark every place where AI talks to customers directly: chat widgets, AI-answered phone lines, automatic replies in messaging apps. Each one needs a clear AI disclosure.
• 3. Check the AI-generated images, audio and video you publish. Real-looking people, places or events that did not happen that way must be disclosed as artificially generated or manipulated.
• 4. Brief your staff. Everyone who works with these tools should know what they do, where they get things wrong and which data must not go into them. That is your AI literacy duty.
• 5. Flag sensitive uses. If an AI tool helps decide who is hired, who gets credit, how a student is assessed or who can access an essential service, treat it as potentially high-risk and plan for 2 December 2027.
• 6. Write it down. A one-page record of tools, disclosures and staff briefings is enough to start, and it is what you will want if a customer, partner or authority asks.

Chatbots and AI receptionists: the Article 50 disclosure

Since 2 August 2026, people must be informed when they are interacting with an AI system. This duty was not touched by the omnibus.

Formally, Article 50 splits duties between providers, who develop an AI system and place it on the market, and deployers, the businesses that use it. But your customers see your website and hear your phone line, not the vendor’s. Make sure the disclosure appears where the conversation happens, whoever configured the tool.

Practitioners recommend making the disclosure prominent and placing it at the start of the interaction, not in the privacy policy or the terms. Workable examples:

• Website chat: a first message such as “Hi, I’m the clinic’s AI assistant. I can help you book or move an appointment. Type ‘staff’ to reach a person.”
• AI phone receptionist: a greeting such as “You’re speaking with the salon’s automated AI assistant” before the first question.
• Messaging apps: the same line in the first automatic reply.

AI literacy: a duty since February 2025

Article 4 requires providers and deployers to ensure that their staff, and other people dealing with AI systems on their behalf, have sufficient AI literacy. It has applied since 2 February 2025 and was not changed by the omnibus.

The duty is generally read as having no fixed curriculum or certificate, so a proportionate approach is possible. For a small business it usually comes down to four things:

• a short briefing for each person who uses AI tools: what the tool does, where it makes mistakes, when a person must check the output;
• clear rules on data, for example no health data, ID numbers or passwords pasted into public AI tools;
• one named person who keeps the list of AI tools up to date and answers questions;
• a dated note of who was briefed and when, updated whenever you add a tool.

When an AI use becomes high-risk

An AI system is not high-risk because it is “AI” or because it is impressive. It is high-risk when it is used for one of the purposes listed in Annex III of the AI Act, or when it is a safety component of a regulated product under Annex I.

For these uses, the high-risk obligations apply from 2 December 2027. They are far more demanding than Article 50 transparency and involve both the provider and the business using the system. If you use a recruitment or scoring tool, ask the vendor now how they will comply and what they will expect from you.

Example: a 30-person logistics company ranks drivers’ applications with an AI module in its applicant tracking system. That is Annex III territory. Using AI to plan delivery routes is not.

For small businesses that use AI, the Annex III areas most likely to come up are:

• Employment and HR: AI that screens, filters or ranks CVs and applicants, or is used to manage workers, for example to allocate tasks or evaluate performance.
• Credit: AI that assesses the creditworthiness of individuals or produces a credit score.
• Education and training: AI that scores exams, assesses learners or decides on admissions.
• Access to essential private and public services: for example AI used in risk assessment for certain insurance products.

What is usually not high-risk: booking chatbots and AI receptionists

Most everyday small-business uses of AI do not appear in Annex III. A chatbot that answers questions about opening hours and books appointments, or an AI phone receptionist that answers frequent questions and takes messages, does not perform any of the listed high-risk functions. The same goes for drafting texts, translating, summarising emails or suggesting product descriptions.

That does not mean no rules apply. Such tools remain subject to the Article 50 transparency duty, the AI literacy duty and the bans on prohibited practices, and data protection law still covers the personal data they handle.

The classification follows the function, not the product name. If you later give the same assistant tasks such as pre-screening applicants or checking whether a customer qualifies for financing, assess it again; borderline cases belong with an adviser.

Fines, enforcement and support for small businesses

National authorities in each member state enforce the AI Act. Article 99 sets graded maximum fines: the highest tier for prohibited AI practices, lower tiers for other breaches, such as failing to meet obligations or giving authorities incorrect information.

According to several legal commentaries, for SMEs and start-ups Article 99 applies the lower of the fixed amount and the turnover percentage, not the higher. Check the article itself before relying on it.

There is also support: under Article 58, AI regulatory sandboxes, controlled environments for testing AI with the involvement of authorities, are free of charge for SMEs and start-ups, apart from exceptional costs that may be recovered proportionately.

This guide is general information as of October 2026, not legal advice; check your specific situation with a lawyer or the competent national authority.