The AI Act After the Omnibus: What Applies Now, What Waits

The EU AI Act went through two things at once this summer: on 27 July the Digital Omnibus on AI entered into force, pushing several deadlines back, and on 2 August the active enforcement phase began, in which the AI Office and national authorities can impose fines. Since then, coverage has blended the two into either “everything postponed” or “everything live”, and both are wrong. This piece separates what has been enforceable since August, what the Omnibus actually deferred, and what a company should derive from that for the next twelve months.

What the Omnibus changed

The Digital Omnibus on AI entered into force as Regulation (EU) 2026/1744 on 27 July 2026, following the trilogue compromise of 7 May and the Parliament’s adoption on 16 July. It moves four dates. The obligations for high-risk systems under Annex III, the standalone use cases such as recruitment, creditworthiness or critical infrastructure, apply only from 2 December 2027. High-risk systems under Annex I, which count as safety components of regulated products, follow on 2 August 2028. National AI regulatory sandboxes must be in place by 2 August 2027. And the machine-readable marking of synthetic content under Article 50(2) applies to systems that were on the market before 2 August 2026 only from 2 December 2026.

What the Omnibus left untouched matters just as much: the prohibited practices, the AI literacy duty, the obligations for general-purpose AI models and the remaining transparency duties in Article 50. Those parts apply, and since August they are enforceable.

What has been enforceable since 2 August

Four blocks of obligations are live today. First, the prohibited practices in Article 5, such as social scoring or manipulative techniques; they have applied since February 2025, and violations can cost up to 35 million euros or 7 percent of worldwide turnover. Second, the obligations for providers of general-purpose AI models, applicable since August 2025 and enforced by the AI Office since August 2026; for most companies they only matter when they place their own models on the market or substantially modify existing ones.

Third, the transparency obligations in Article 50, applicable since 2 August 2026. Whoever lets people interact with an AI system has to disclose it. Whoever produces deepfakes has to label them. Whoever publishes AI-generated text on matters of public interest labels it or has it reviewed editorially by a named person who carries responsibility. How we document that exemption on our own blog, with reviewer and review date per article, is described in our piece on AI text watermarks; it also explains why machine-readable marking is a provider duty and what 2 December means for older models. Violations of the remaining obligations cost up to 15 million euros or 3 percent, false statements to authorities up to 7.5 million euros or 1 percent.

Fourth, the AI literacy duty in Article 4, which since February 2025 requires that staff operating AI systems are adequately trained. It carries no fine of its own, but it feeds into every supervisory review and every liability question.

What this means for the next twelve months

The most common mistake in practice is reading the high-risk deferral as a general pause. The deferral buys time for Annex III systems, it changes nothing about what already applies, and it changes nothing about the fact that an applicant tracking system with AI pre-selection needs full documentation in December 2027. Starting that in 2027 is too late, because data governance, risk management and technical documentation do not materialize in six months.

The sensible order begins with an inventory: which AI systems are in use, in which role, as provider or deployer, and in which risk class? That inventory underpins everything else and takes days, not months. Next comes implementing the transparency duties, because they already apply: disclosure for chatbots, labeling of synthetic media, editorial review of published text. The third step is preparing the high-risk candidates with December 2027 in view, without rush but with a plan. The 72-day roadmap for the labeling obligation from the spring still provides the structure for the transparency part, and anyone wanting to organize AI adoption as a whole finds the frame in our guide to AI strategy for mid-sized companies.

Conclusion

The Omnibus bought the AI Act time, but only for the high-risk part. Prohibitions, transparency and the duties for model providers apply and have been enforceable since August; marking for older systems follows in December. An inventory, implemented transparency duties and a plan for the high-risk candidates by the end of 2027 are what count now. For classifying your own systems and implementing pragmatically, our AI consulting for the mid-market helps, from clarifying roles to documentation.

Frequently Asked Questions

What did the Digital Omnibus change in the AI Act?

Regulation (EU) 2026/1744, in force since 27 July 2026, moves four dates: high-risk obligations under Annex III to 2 December 2027, under Annex I to 2 August 2028, national sandboxes to 2 August 2027, and machine-readable marking for legacy systems to 2 December 2026. Prohibitions, transparency and GPAI obligations remain unchanged.

Which AI Act obligations have applied since 2 August 2026?

The transparency obligations in Article 50: disclosure when people interact with AI, labeling of deepfakes and of AI text on matters of public interest unless it is editorially reviewed. In addition, active enforcement of the already applicable prohibitions and of the general-purpose AI obligations by the AI Office began on that date.

What fines does the AI Act provide for?

Up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 percent for violations of the other obligations, and up to 7.5 million euros or 1 percent for false statements to authorities. The higher amount applies in each case; SMEs benefit from reduced caps.

Do high-risk AI systems have to comply with nothing for now?

The specific high-risk obligations under Annex III apply only from 2 December 2027. Preparation should still start now, because data governance, risk management and technical documentation take months. Independently of that, the transparency and AI literacy duties already apply to these systems today.