EU AI Act after the Digital Omnibus: dates, duties and a small-team checklist
What applies, what changed with Regulation (EU) 2026/1744, and what a team of five to fifty people should have in place by December 2, 2026, when the Article 50(2) marking deadline for existing generative systems and two new prohibitions apply.
Last verified: October 23, 2026, against EUR-Lex and European Commission pages. This page is general information, not legal advice. Confirm how the Act applies to your systems with qualified counsel.
Quick answer, as of October 23, 2026
The AI Act has applied generally since August 2, 2026, including the Article 50 transparency rules. The Digital Omnibus (in force since July 27, 2026) softened Article 4: you must support AI literacy, not guarantee a level of it. Two later dates matter for most small teams: December 2, 2026, when the marking deadline for generative systems already on the market and two new prohibitions apply, and December 2, 2027, when the Annex III high-risk obligations apply.
Article 4 AI literacy: before and after the Omnibus
| Version | What providers and deployers must do | In practice |
|---|---|---|
| Original (applied from February 2, 2025) | "Take measures to ensure, to their best extent, a sufficient level of AI literacy" of staff. | Read by many as a training-outcome duty. |
| As replaced by Regulation (EU) 2026/1744 (from July 27, 2026) | "Take measures to support the development of AI literacy" of staff. This "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". | An effort duty. The Commission and Member States support SMEs, and the Commission publishes practical examples. |
Article 50 transparency: who has to do what
Article 50 applies from August 2, 2026. The Commission published a Code of Practice on AI-generated content on June 10, 2026 and Article 50 guidelines on July 20, 2026. Under the amended Article 50(7), the Commission encourages codes of practice and can adopt an implementing act if a code proves inadequate.
| Who | Duty | Where |
|---|---|---|
| Providers of AI systems that interact with people | Design the system so people are told they are interacting with AI, unless that is obvious. | Article 50(1) |
| Providers of generative AI systems | Mark outputs (text, image, audio, video) in a machine-readable way so they can be detected as AI-generated. Systems already on the market before August 2, 2026 have until December 2, 2026. | Article 50(2) |
| Deployers of emotion recognition or biometric categorisation | Inform the people exposed to the system. | Article 50(3) |
| Deployers publishing deepfakes or AI-generated public-interest text | Disclose that the content was artificially generated or manipulated. Check the exceptions in Article 50(4) and the Commission guidelines before relying on one. | Article 50(4) |
EU AI Act timeline
Every date below is the date an obligation applies or an act took effect. Re-checked on October 23, 2026.
February 2, 2025
Chapters I and II apply: the prohibited practices and the original Article 4 AI literacy duty ("ensure, to their best extent, a sufficient level of AI literacy").
SourceAugust 2, 2025
General-purpose AI (GPAI) model obligations apply. The Digital Omnibus on AI did not change this date.
SourceJune 10, 2026
The Commission published the final Code of Practice on AI-generated content (marking and labelling). By the end of July 2026 it had about 190 signatories, and the Commission and the AI Board judged it an adequate voluntary compliance tool.
SourceJuly 20, 2026
The Commission published guidelines on the Article 50 transparency obligations for providers and deployers.
SourceJuly 27, 2026
Regulation (EU) 2026/1744, the Digital Omnibus on AI (adopted July 8, published July 24), entered into force. It replaced Article 4: providers and deployers must now take measures to support the development of AI literacy, without guaranteeing any specific level.
SourceAugust 2, 2026
General date of application of the AI Act. Article 50 transparency obligations apply.
SourceDecember 2, 2026
Deadline for providers of generative AI systems placed on the market before August 2, 2026 to comply with Article 50(2) machine-readable marking (new Article 111(4)). New prohibitions apply from this date: non-consensual sexual deepfakes of identifiable persons (Article 5(1)(ba)) and generation of child sexual abuse material (Article 5(1)(bb)).
SourceDecember 2, 2027
High-risk obligations for Annex III systems (Chapter III, Sections 1 to 3) apply. The Omnibus moved this from August 2, 2026.
SourceSmall-team checklist
For teams that use AI tools and maybe ship one AI feature, not for high-risk system providers. The Omnibus also adds "small mid-cap enterprises" next to SMEs for proportionality and support, so check whether that category fits you.
1.List every AI tool in use
Include AI features inside SaaS you already pay for (office suites, CRM, support desk). Note who uses each tool and with what data.
2.Support AI literacy (Article 4)
Since July 27, 2026 the duty is to take measures that support AI literacy, not to guarantee a level. A one-page guide per tool (what data may go in, how to check outputs, who to ask) plus a dated note of who received it is a proportionate start.
3.Check every chatbot that talks to customers
If you build one or put it on your site under your name, make sure people are told they are talking to AI unless it is obvious (Article 50(1)).
4.Label deepfakes and public-interest AI text you publish
If your team publishes AI-generated or manipulated images, audio or video of real people or places, or AI-generated text that informs the public on matters of public interest, disclose it (Article 50(4)).
5.If you ship a generative AI product, plan marking
Outputs need machine-readable marking (Article 50(2)). Products already on the market before August 2, 2026 must comply by December 2, 2026. The Commission's Code of Practice on AI-generated content is the reference most signatories use.
6.Rule out prohibited uses
Confirm no workflow touches a prohibited practice, including the two added by the Omnibus from December 2, 2026: non-consensual sexual deepfakes of identifiable persons and child sexual abuse material.
7.Screen for high-risk use cases
Hiring, credit, education, critical infrastructure and similar Annex III uses get full obligations from December 2, 2027 (Annex I products from August 2, 2028). If any applies, involve counsel now; conformity work takes longer than a quarter.
8.Record your vendors
For each model or AI vendor, keep the model name, data-handling terms and where inference runs. EU residency options differ by vendor and plan.
Understanding the risk classification
The Act sorts systems into four tiers: unacceptable, high, limited (transparency) and minimal risk. Most tools a small team uses sit in limited or minimal risk. Knowing which tier applies to each use case is the first governance decision you make.
Unacceptable risk
Banned outright, for example social scoring and manipulative systems that exploit vulnerabilities. From December 2, 2026 the list also covers non-consensual sexual deepfakes of identifiable persons and generation of child sexual abuse material.
High risk
Allowed with strict obligations, for example AI in hiring, credit scoring, education and critical infrastructure. Annex III obligations apply from December 2, 2027; Annex I (regulated products) from August 2, 2028.
Limited risk (transparency)
Article 50 duties: disclose AI interaction, mark generative outputs, inform people about emotion recognition, and disclose deepfakes and AI-generated public-interest text.
Minimal risk
No specific obligations beyond AI literacy support. Covers most everyday uses such as spam filters and drafting help.
FAQ
Is AI literacy training still mandatory?
Since July 27, 2026, Article 4 requires providers and deployers to take measures that support AI literacy of their staff. It no longer asks them to ensure a sufficient level, and it does not require guaranteeing any specific level for any individual. The duty to take measures remains.
Does the EU AI Act apply to non-EU companies?
It can. The Act covers AI systems placed on the EU market or used in the EU, similar to how GDPR reaches non-EU companies. Check the scope article with counsel if you sell into the EU from outside it.
What is the penalty for non-compliance?
The Act sets fine ceilings that depend on the type of violation, with the highest ceiling for prohibited practices. Read the penalties chapter in the consolidated text on EUR-Lex rather than relying on figures quoted secondhand.
Do I need a Chief AI Officer?
The Act does not create that title. What helps in practice is one named accountable person per AI use case. That can be a product lead, a legal counsel or an existing risk officer.