← Back to the blog
6 min read

Which AI Act obligations apply to an SME after the Digital Omnibus

Prohibitions and AI literacy have applied since 2 February 2025, and Article 50 transparency since 2 August 2026. The Omnibus postponed only the high-risk obligations: to 2 December 2027 for Annex III areas and 2 August 2028 for Annex I products.

Two deadlines come sooner, on 2 December 2026. A new prohibition bans generating intimate or sexually explicit images of identifiable people without their consent. The same provision bans generating child sexual abuse material. By that date, generative systems placed on the market before 2 August 2026 must also mark their output under Article 50(2). If you buy image or text generation from a vendor, ask them now how they will meet it.

What the Omnibus is and where to find it

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026. It amends Regulation (EU) 2024/1689, the AI Act. That number is what you search for on EUR-Lex.

The calendar as it now stands

  • Prohibitions and AI literacy: 2 February 2025.
  • Governance and general-purpose AI models: 2 August 2025.
  • General application, including Article 50 transparency: 2 August 2026.
  • The new Article 5(1) prohibition, and the end of the Article 50(2) period for generative systems placed on the market before 2 August 2026: 2 December 2026.
  • Commission guidance on the post-market monitoring plan, which matters to providers of high-risk systems: 2 September 2027.
  • High-risk obligations for Annex III areas: 2 December 2027. These are Chapter III, sections 1 to 3: how a system is classified, the requirements it must meet, and the duties of providers and deployers.
  • The same obligations for AI built into products regulated under Annex I: 2 August 2028.

The Commission’s AI Act page confirms the Omnibus’s entry into force on 27 July 2026 and the dates of 2 August 2026, 2 December 2027 and 2 August 2028. We could not retrieve the regulation’s text from EUR-Lex while writing this. The other items come from published analyses of the Official Journal text by nicfab and the Future of Privacy Forum (FPF). They are the 2 December 2026 items, the Article 4 and 6(3) changes, the small mid-cap definition and the article numbers in the SME section. Check them against the regulation before you rely on them.

What applies today: transparency under Article 50

For most SMEs this is the part that matters now.

  • Providers of a system that interacts with people, such as a chatbot, must design it so people are told it is an AI, unless that is obvious.
  • Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format.
  • Deployers of emotion recognition or biometric categorisation must inform the people exposed to it.
  • Deployers of deepfakes must disclose them. The same applies to text published on matters of public interest, except text that has gone through human review or editorial control with someone holding editorial responsibility for the publication.
  • The information must be given in a clear and distinguishable manner, at the latest at the first interaction or exposure.

So the duties follow your role. A chatbot you build and run on your own website is yours to design, notice included. With a vendor’s chatbot, that design duty sits with the vendor as provider. Write into the contract that the chatbot tells users they are talking to an AI, and check that your configuration does not hide the notice. Marking generated output is also the provider’s job, which for bought-in tools means the vendor. Disclosing a deepfake falls on whoever deploys it, which is you when you publish it.

AI literacy: softer wording, obligation kept

The Omnibus changes Article 4 from ensuring a sufficient level of AI literacy to taking measures to support its development. It also states that the article does not require any specific level of AI literacy of any individual. Both FPF and nicfab report that the obligation itself remains in the final text. We have that from their analyses, not from the Official Journal, so make it the first point you check on EUR-Lex.

What you need to show is the measures you took. Internal guidance on which AI systems staff may use, short training sessions and a named person to ask are all measures you can record.

What the Omnibus offers smaller companies

The Omnibus defines SMEs by reference to Recommendation 2003/361/EC and adds a category of small mid-caps. FPF’s analysis describes these as companies with fewer than 750 employees and an annual turnover not exceeding EUR 150 million. Confirm that definition in the regulation itself.

The analyses list four measures, mostly for companies that provide high-risk systems:

  • simplified technical documentation (Article 11(1));
  • a proportionate quality management system (Article 17(2));
  • priority access to regulatory sandboxes (Article 57(3a));
  • a cap on fines for small mid-caps (Article 99(6a)).

The analyses we used do not say how that cap is set, so read Article 99(6a) before you count on it. A company that only uses AI from vendors will rarely touch any of these measures.

A provider that considers a system not high-risk under Article 6(3) must still register it, with less information than before. A new Article 4a gives a legal basis for processing special categories of personal data to detect and correct bias. Every one of its conditions has to be met. It is relevant only if you use such data to find and fix bias in an AI system.

What to do this quarter

Start with an inventory of every AI system and automation in the company. Include chatbots, text or image generation, document extraction and classification. Include the AI features inside software you already pay for, such as your CRM, HR tool or office suite. For each, note whether the company is the provider or the deployer.

Next, go through the ones that touch Article 50. Check that chatbots tell people they are talking to an AI. Then check what you publish. Deepfakes always need a disclosure. Text on matters of public interest needs one unless it was reviewed under someone’s editorial responsibility. As we read Article 50(4), ordinary marketing copy falls outside it, though the tool’s provider still has to mark that output in machine-readable form.

Then ask whether any system could fall into an Annex III area. The Commission’s examples include biometrics, critical infrastructure and education. The annex covers more areas than these, so read it against your inventory. The Commission’s guidelines on high-risk classification are still pending, so involve a lawyer where the answer is unclear. Should a system fall in scope, use the time until 2 December 2027 to prepare documentation, human oversight and monitoring.

Finally, write down the AI literacy measures you already have.

How we build automations

When DisruptiveCats builds document extraction for a client, every field carries the sentence it came from and a confidence score. Uncertain cases go to a person to decide. For each extracted value you can see its source and whether a person confirmed it. That does not by itself make a company compliant with the AI Act.

Sources

Shall we build something that lands on its feet?

Tell us your challenge. We reply with a plan you can act on.

Start a project