EU AI Act After the Digital Omnibus: What Changed and What to Do Now

If you build, buy or use AI that touches people in the European Union, the EU AI Act affects you, wherever your company is based. The law has been rolling out in steps since 2024, and a recent change moved some dates. That has left many teams unsure what applies today and what can wait.

This article explains the current picture in plain words, based on the European Commission’s own page, and offers a practical plan. It is general information and not legal advice, so check the details with a qualified adviser for your case.

What the Commission says about the EU AI Act

The European Commission’s page on the AI Act regulatory framework sets out the main points.

Four risk levels

• Unacceptable risk: banned practices, nine in total, including social scoring and untargeted scraping of images to build facial recognition databases.
• High risk: strict duties before market entry, including risk management, dataset quality, logging, records, human oversight and robustness.
• Transparency risk: disclosure duties, such as telling people they are interacting with a machine and labelling deepfakes and certain public-interest text.
• Minimal or no risk: no rules under the Act. The page gives AI-enabled video games and spam filters as examples.

Dates

• 1 August 2024: the Act entered into force.
• 2 February 2025: the first bans and AI literacy duties applied.
• 2 August 2025: governance rules and duties for general-purpose AI applied.
• 2 August 2026: the Act became in force, with exceptions, and enforcement by the AI Office and national authorities began. Transparency rules take effect in August 2026.
• December 2026: a further ban on AI that generates non-consensual intimate content or child sexual abuse material takes effect.
• 2 December 2027: high-risk rules for Annex III use cases.
• 2 August 2028: high-risk rules for AI embedded in regulated products under Annex I.

The AI Omnibus. The Commission says the Omnibus was proposed on 19 November 2025, politically agreed on 7 May 2026 and entered into force on 27 July 2026. It moved the high-risk deadlines to the two dates above. It added a ban on AI that makes nude fakes or child abuse images. It gave the AI Office more power over AI systems built on general-purpose models. It extended simpler rules to small mid-cap companies, and it expanded regulatory sandboxes.

General-purpose AI. Rules that took effect in August 2025 cover transparency, copyright and, for models with systemic risk, assessing and mitigating those risks. The Commission published scope guidelines, a voluntary Code of Practice and a template for public summaries of training data in July 2025.

Rules and guidance keep changing. Check the Commission’s page and the Official Journal for the current text.

What the delay does and does not change

• It does not remove the Act. Bans, AI literacy duties, general-purpose AI rules, governance and transparency rules are already running or starting.
• It buys time for high-risk systems. Providers and deployers of high-risk systems have until late 2027 or 2028 to meet the detailed requirements, depending on the category.
• It adds new duties. The extra bans are in force or coming, and enforcement powers over general-purpose AI have grown.
• It leaves a planning risk. Standards and guidance may still change. Build flexible controls now.

Where the Act meets good practice

The NIST AI Risk Management Framework is a voluntary US framework that helps firms manage AI risk through design, use and evaluation. It sits outside EU law, and its habits of governing, mapping, measuring and managing risk line up well with the Act’s themes of risk management, records and oversight. Using such a framework gives you a head start and a common language with customers.

A seven-step plan

1. Inventory your AI

List every AI system you build, buy or use, including features inside software you license. Record purpose, users, data, provider and owner. See AI agent governance.

2. Check for banned practices

Compare each use against the banned list. If anything is close, get legal advice at once.

3. Sort by risk

Decide whether each system is high risk, transparency risk or minimal risk. High-risk categories include certain uses in areas such as employment, education, essential services and law enforcement, so read the Annex III list carefully.

4. Check your role

Are you a provider, deployer, importer or distributor? Duties differ by role, and one company can hold several roles.

5. Close transparency gaps now

If you run chatbots, generate synthetic media or deploy emotion or biometric systems, work out what disclosure is needed. Add clear notices and labels.

6. Build high-risk controls early

Even with later dates, start on records, data quality, logging, human oversight, testing and monitoring. See testing AI features and AI model monitoring.

7. Train people

The Act includes AI literacy duties. Teach employees who use or oversee AI what it can and cannot do. See responsible AI policy.

A worked example: a recruitment software company

This example is illustrative, and it is not legal advice.

A software company sells a tool that ranks job applicants for employers in several countries, including EU member states.

• Inventory: the ranking model, a chatbot for candidates and an internal analytics tool.
• Classification: the ranking model is likely to fall into a high-risk category because it supports employment decisions. The candidate chatbot has transparency duties. The analytics tool is minimal risk.
• Role: the company is a provider of the ranking tool, and its customers are deployers.
• Now: it adds a clear notice to the chatbot, runs an AI literacy session, and starts a records file for the ranking model.
• During 2027: it completes risk management, data quality checks, logging, human oversight features and testing, so it is ready before the December 2027 date.
• Ongoing: it monitors outcomes for bias and drift, and reports to leadership each quarter.

Small business and enterprise views

• Sole trader or small business: list the AI tools you use, check whether any decide things about people, add notices to chatbots and keep a one-page note of how you use AI.
• Mid-size company: appoint an owner, build the inventory and sorting by risk, and add review steps for any high-risk use.
• Enterprise: run an AI governance programme with a register, risk checks, supplier clauses, technical records, monitoring and board reporting.

Beyond the EU

IBM’s 2026 trends list AI sovereignty and resilience, and agent identity governance, as priorities for businesses. Other regions are also acting, with different approaches, and customers often ask for evidence of responsible AI whatever the law says. Build one set of controls that you can map to several regimes. See digital transformation in banking for how regulated sectors approach this.

Common mistakes

• Assuming the delay means no action is needed.
• Not counting AI inside software you buy.
• Treating the Act as only a legal issue.
• Ignoring transparency duties that apply sooner.
• Starting records late.
• Forgetting roles: provider, deployer and others.

A starting plan

1. Build your AI inventory this month.
2. Sort each system, and flag anything near the banned list.
3. Fix transparency gaps first.
4. Start high-risk records and testing in the first quarter.
5. Review the EU AI Act position every quarter, since guidance keeps changing.

How SoftSapien supports AI governance

SoftSapien’s consultants help firms prepare for the EU AI Act: building AI inventories, mapping risk levels and roles, designing governance, records, testing and monitoring and training teams. See our business transformation and AI development services.

To plan your AI compliance, use the contact page to chat with our team, send a message or schedule a free consultation call.