Regulation (EU) 2024/1689 has been in force since August 2024, and the Digital Omnibus - Regulation (EU) 2026/1744, in force since 27 July 2026 - moved the two deadlines most companies were planning around. The high-risk rules did not disappear. They moved to December 2027 and August 2028.
What the Omnibus actually changedThe Digital Omnibus was agreed politically on 6 May 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Three things matter for planning.
Annex III high-risk systems moved from 2 August 2026 to 2 December 2027. These are the stand-alone use cases most companies encounter: recruitment and worker management, credit scoring, education and vocational training, access to essential public and private services, and critical infrastructure. Sixteen extra months - not a reprieve.
Annex I high-risk systems moved from 2 August 2027 to 2 August 2028. These are AI systems that are safety components of products already regulated under EU product law - medical devices, machinery, lifts, in-vitro diagnostics.
Article 50 transparency was not deferred. From 2 August 2026 you must tell people when they are interacting with an AI system, label deepfakes, and mark synthetic audio, image, video and text in machine-readable form. Systems already on the market before that date get until 2 December 2026 for the watermarking requirement in Article 50(2). Everything placed on the market afterwards has to comply immediately.
What was never postponedThe Article 5 prohibitions have applied since 2 February 2025 - social scoring, untargeted facial-image scraping, emotion recognition at work and in education, manipulative techniques exploiting vulnerability. The Omnibus added prohibitions on AI-generated child sexual abuse material and non-consensual intimate imagery, with a transition period to 2 December 2026.
The Article 4 AI literacy duty has also applied since February 2025, and it applies to every provider and deployer regardless of risk class. The Omnibus softened the wording: you now have to take measures to support the development of AI literacy among the people who operate and use your AI systems, rather than guarantee a specific level. The obligation to act did not go away - only the standard of outcome.
GPAI model obligations under Articles 51 to 56 have applied since 2 August 2025, and the AI Office gained expanded investigative powers on 27 July 2026.
Four risk classes, one classification questionThe Act sorts systems into unacceptable risk (banned), high risk (the full conformity regime - risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, conformity assessment, CE marking, registration), limited risk (transparency duties under Article 50) and minimal risk (no specific obligations). Most systems in a normal company land in the last two classes.
The expensive mistake is assuming that. Classification is a documented decision, not an impression. An off-the-shelf CV-screening tool makes you a deployer of an Annex III high-risk system - and deployers of Annex III systems in the public sector, and in banking and insurance, must run a fundamental rights impact assessment before first use.
Provider or deployerThe obligations differ sharply. A provider develops an AI system or has one developed and places it on the market under its own name. A deployer uses one under its own authority. Deployers carry a lighter but real set of duties: use the system according to the instructions, assign competent human oversight, keep logs, monitor operation and inform the provider of serious incidents.
Watch the switch. Article 25 turns a deployer into a provider if you put your own name or trademark on a high-risk system, make a substantial modification to it, or change its intended purpose so that it becomes high-risk. Fine-tuning a purchased model for a hiring decision is exactly that kind of change.
PenaltiesUp to EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3 percent for most other breaches, including GPAI obligations; up to EUR 7.5 million or 1 percent for supplying incorrect or misleading information to authorities. For SMEs the applicable figure is the lower of the fixed amount and the percentage.
Where to start before December 2027Build the inventory first. You cannot classify what you have not listed, and almost every organisation underestimates how much AI is already in use through embedded features of existing software. Then classify each entry, record why, and check the provider or deployer question for each. Article 4 literacy training is due now, not in 2027, and it is also the cheapest item on the list.
RelatedISO/IEC 42001 - the AI management system standardOur DORA frameworkNIS2 regulatory overview 
