Through the so-called Digital Omnibus — which the European Parliament agreed to in June 2026 and the Council gave its final approval to on 29 June 2026 — independent high-risk systems from Annex III are postponed until 2 December 2027, and AI embedded in regulated products listed in Annex I moves to 2 August 2028.
Many entrepreneurs only read the headline "AI ActEuropean law that sets requirements for those who develop or use AI. Determines which risk category your application falls into and what you must document for it. postponed" and concluded they don't need to do anything. That's not correct. Below is what actually applies for an organization of 3 to 250 employees, and what you can arrange this month.
The timeline at a glance
| When | What |
|---|---|
| 2 February 2025 | Ban on certain AI practices. Requirement for AI literacy (Article 4) |
| 2 August 2025 | Rules for general-purpose AI models |
| 2 August 2026 | Transparency obligations (Article 50). Enforcement and power to impose fines |
| 2 December 2026 | Transition period for machine-readable marking of systems already on the market before August 2026 |
| 2 December 2027 | High-risk AI, Annex III (including recruitment, credit scoring, biometrics) |
| 2 August 2028 | High-risk AI built into regulated products, Annex I |
Does this apply to my company too?
Yes, if you use AI. The AI Act doesn’t only apply to tech companies that build AI. It also applies to companies that use AI purchase, offer, or use fall under them in their processes. If you use ChatGPT for customer communications, Copilot for summaries, or an AI tool in recruitment, you're a user under the law.
The distinction that matters is between provider (you develop or place an AI system on the market) and user (you put it into use). As an SME, you’re almost always a user — with significantly lighter obligations, but not zero.
The way it works now
- The appointment is in one colleague's mailbox
- Data is manually retyped from one system to another
- The person who knows is on vacation
- No one can see afterwards why this decision was made
As it is
- The agreement is stored with the client, findable for everyone
- Once entered, information flows through to the rest
- Work continues, even if someone is absent
- Every decision has a source, an owner, and a date
What you can arrange this month
Demonstrate AI literacy
This obligation has applied since February 2025, but has been enforceable since August 2026. The law requires employees who work with AI to understand sufficiently what the system does, where it can go wrong, and when a human is needed.
Practical for a company of twenty people: half a day's training, a participant list, and a brief summary of what was covered. That's it. Keep the evidence.
Set up an AI register
One tab in a spreadsheet is enough. For each AI system: which tool, who the supplier is, what we use it for, what data goes into it, who is responsible internally, and whether there's human oversight.
You’ll be surprised by how much turns up. Usually much more than management expects.
Check your chatbot and AI content
Have a chatbot on your site? It must be clear that it's AI — not hidden in the fine print. Publishing AI-generated images or videos? Then labeling is required. Systems that were already running before August 2026 have a transition period until December 2, 2026.
Agreements on one A4
What is and isn’t allowed in an AI tool: customer data, quotes, personnel files, source code. Who decides on new tools. What to do if AI makes a mistake that affects a customer. One page, signed, in the employee handbook.
Question your suppliers
For every AI tool you subscribe to, ask: where does the model run, what happens to our input, is our data used for training, is there a data processing agreement, and what AI Act role does the provider claim?
The practical test: ask three colleagues which AI tools they’ve used for work this week. If there’s one you didn’t know about, you don’t have a compliance problem but a visibility problem — and that’s the problem you solve first.
Why you shouldn't wait for 2027
First: the delay only affects the high-risk rules. If you use AI for recruitment or credit assessment, you have more time — but the obligations themselves haven't changed, only the date.
Second: a risk classification, a register, and thorough documentation take months, not weeks. If you start in November 2027, you're too late.
Third, and this is the practical reason: the mess you're cleaning up now is the same mess that is already making your AI use unreliable today. Nobody knows which tools are running, nobody knows what goes into them, and nobody checks what comes out. That's not a compliance problem; it's a business operations problem that also happens to be a compliance problem.
What are you really risking?
Fines for violating the transparency obligations can amount to fifteen million euros or three percent of global annual turnover. This is a ceiling aimed at large players; in practice an SME business won't run into it.
The real risk for a company of your size lies elsewhere: a customer or client who asks for an AI policy in their terms of purchase, an insurer who inquires about it, a takeover candidate who requests it. Then you want to be able to show a document instead of a story. due diligenceThe investigation preceding a takeover: what exactly are you buying, and where are the risks. requests it. Then you want to be able to show a document instead of a story.
Want to know where your organization stands on data and AI, including the deadlines that apply to you? The Fresh Look mapped out.
Frequently asked questions
Partially. The high-risk obligations move to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The prohibited practices, the AI literacy requirement, the rules for general-purpose AI and the transparency obligations remain fully in force.
Yes. The law applies not only to companies that develop AI, but also to companies that purchase, offer, or use AI in their processes. As an SME, you’re almost always a user, with lighter obligations than a provider.
The formal registration requirement in the EU database applies to high-risk systems. Every company would be wise to keep its own internal inventory of which AI tools are in use—and it’s the cheapest preparation there is.
You are then a user of an AI system. The heaviest obligations do not apply, but the AI literacy requirement and the transparency obligations do — and the GDPRThe privacy law: which personal data you may process, for what purposes, and how long you retain it. already applied.
The GDPR concerns personal data; the AI Act concerns the system and its risk. They overlap but don't replace each other: you can comply with the GDPR and still violate the AI Act.
Where does your company stand on AI?
De Frisse Blik maps your maturity, your business case in euros and the deadlines that apply to you.
From knowing to doing
This article helps you get oriented. Then review the concrete approach for due diligence business knowledge.