EU AI Act for SMEs after the Digital Omnibus

September 15, 2026 · updated October 1, 2026 · 8 min read · by the aimybusiness team

The timeline updated for the Digital Omnibus

The EU AI Act entered into force on 1 August 2024 and applies in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, changed some of the dates. The updated timeline:

From 2 February 2025: AI practices posing unacceptable risk are banned (Art. 5) and the AI literacy obligation for staff (Art. 4) applies.
From 2 August 2025: rules on governance, national authorities, general-purpose AI (GPAI) models and the penalty regime.
From 2 August 2026: general application and the Art. 50 transparency obligations: anyone offering a chatbot must tell people they are talking to an AI, deepfakes must be disclosed and generated content must be marked.
From 2 December 2026: new ban on systems generating non-consensual intimate images or child sexual abuse material; deadline for marking content generated by systems already on the market.
From 2 December 2027 (previously 2 August 2026): obligations for Annex III high-risk systems, such as recruitment, credit scoring, education, access to essential services and biometrics.
From 2 August 2028 (previously 2 August 2027): obligations for high-risk AI embedded in already regulated products (Annex I).

For most SMEs, then, three things matter today: AI literacy, transparency and a clear map of the tools in use. Postponing the high-risk obligations does not remove them: companies using AI to recruit staff or assess customers have more time, not an exemption.

Who is affected, even without developing AI

The regulation distinguishes between those who supply an AI system (providers) and those who use it in their own business (deployers). Most SMEs fall into the second category even when simply using third-party tools: a CV-screening tool with built-in AI, a credit-scoring system, a smart video-surveillance platform. For high-risk systems, from 2 December 2027 being a deployer carries specific obligations: use in line with the provider's instructions, human oversight, log retention, informing affected staff, and checking that the provider has correctly classified the system's risk.

Companies that only use minimal-risk tools, such as a writing assistant or an internal support chatbot, have lighter obligations, mostly focused on transparency towards the people who interact with the system.

Four things to do before the next deadlines

1. List the AI systems in use — a simple register with the system's name, provider, the business process involved and the data processed. It is the basis for any later audit.
2. Classify them by risk level — prohibited, high-risk, limited-risk (transparency obligations) or minimal-risk. Classification determines which obligations actually apply.
3. Train the people who use them — the AI literacy obligation (Art. 4) has been in force since February 2025: it is often the most overlooked requirement, partly because it has no "visible" deadline. We cover it in our dedicated guide.
4. Set internal policies and responsibilities — who approves the use of a new AI tool, who monitors its use, and how an error or a complaint is handled.

Italy's Law 132/2025: what it adds to the EU framework

The EU regulation leaves it to member states to designate supervisory authorities and to define some implementation details. In Italy this was done through Law No. 132 of 23 September 2025, in force since 10 October 2025, which adds general principles (human centrality, proportionate and transparent use of AI) to the EU regulation, specific rules for sensitive sectors such as healthcare, employment and justice, and criminal penalties for certain unlawful uses, including the distribution of AI-generated content without adequate safeguards (deepfakes). Two obligations apply to companies right away: informing employees in writing about AI systems that affect the employment relationship (Art. 11) and, for professionals, informing clients about the AI tools used in their work (Art. 13).

Where to start

An AI Act compliance audit usually takes a few weeks: mapping the systems in use, classifying their risk, a gap analysis against the applicable obligations, and an action plan with realistic priorities. There is no need to halt AI use while waiting to be "100% compliant": most non-conformities are resolved with clear policies and a few technical adjustments, not major investment. For a first snapshot in five minutes, take our free AI Act self-assessment; for the full path, our AI Act Governance service.

Frequently asked questions

Q.1Do penalties for non-compliance already apply today?

The penalty regime has applied since 2 August 2025: for prohibited practices fines reach EUR 35 million or 7% of worldwide turnover (for SMEs the lower amount applies). Penalties for the transparency obligations apply from 2 August 2026; those for high-risk systems will follow the new Digital Omnibus dates.

Q.2What did the Digital Omnibus change for SMEs?

It postponed the high-risk obligations (Annex III to 2 December 2027, Annex I to 2 August 2028), turned AI literacy into an obligation to take measures without guaranteeing a specific level, extended some simplifications to small mid-caps and added a ban on systems generating non-consensual intimate images. The transparency obligations stayed at 2 August 2026.

Q.3Does this apply if we only use generic tools like ChatGPT or Copilot?

Yes. Generic generative AI tools fall within the regulation's scope as minimal or limited-risk systems: the main obligations are transparency towards anyone interacting with the output, and literacy for staff who use them for work.

Q.4Are written policies enough to be compliant?

They are a necessary starting point, not a sufficient one. They need to be backed by an actually maintained register of systems, staff training, and, for high-risk systems, a documented assessment.

Sources

This article is for general information only and is not legal advice. For an assessment specific to your company, our team runs a dedicated audit.

Written with the support of artificial intelligence and reviewed by the aimybusiness team, which holds editorial responsibility.

The EU AI Act: obligations for SMEs after the Digital Omnibus