If you only read the headlines from late July, you came away with one message: the EU blinked. After months of lobbying from big technology companies, Brussels agreed to push back the hardest parts of the AI Act. “Delayed.” “Watered down.” “Relief for business.”
All of that is real. And if you run a small company, most of it is not about you.
Here is the fuller, less comfortable picture — what moved, what didn’t, and why the “it’s all been pushed to 2027” reading is a trap.
What actually changed: the Digital Omnibus
On 24 July 2026 the EU published the Digital Omnibus — Regulation (EU) 2026/1744 — in the Official Journal. It came into force on 27 July 2026. It is a genuine simplification package, and it does defer the heavy obligations:
- Annex III high-risk systems (the use-based ones — hiring, credit, education, and so on) were postponed from 2 August 2026 to 2 December 2027 — a sixteen-month slip.
- Stand-alone high-risk systems now apply from 2 December 2027.
- High-risk systems built into products now apply from 2 August 2028.
- The duty on member states to run a regulatory sandbox was pushed from 2 August 2026 to 2 August 2027.
The stated reason is honest enough: the standards and guidance those obligations depend on — the CEN-CENELEC technical work — simply weren’t ready. You cannot demand third-party assessment against a standard that doesn’t exist yet.
So yes: if you were dreading a high-risk conformity assessment this month, you got breathing room.
What did NOT move — and this is the part with your name on it
Here’s what the “everything’s delayed” headlines quietly skipped.
Article 50 — transparency — went live on 2 August 2026. It was not postponed. If you deploy a chatbot, it has to make clear people are talking to a machine. If you publish AI-generated image, audio or video, it has to be labelled as artificial. This applies whether or not your system is “high-risk” — it’s about honesty, not risk tier. (Pre-existing systems get until 2 December 2026 on the machine-readable watermarking part, but the disclosure duty itself is here now.)
Enforcement switched on the same day. From 2 August 2026 the European AI Office can formally investigate and enforce the rules on general-purpose AI models and on prohibited practices. For the first time, the law has teeth.
The fine behind it is not symbolic: up to €15 million or 3% of worldwide annual turnover, whichever is higher.
And the Omnibus didn’t only subtract — it added a prohibition. It bans AI systems that generate child sexual abuse material, or that depict the intimate parts of an identifiable person without consent, with compliance required by 2 December 2026. That is the opposite of “watering down.”
Why “nobody’s enforcing it yet” is the wrong bet
The tempting conclusion for a small firm is: the scary stuff is in 2027, enforcement is uneven, so I’ll wait.
Three problems with that.
First, your obligations don’t wait for the calendar you’re hoping for. Article 4 (AI literacy) has applied since 2 February 2025. Article 50 applies now. Neither was touched by the Omnibus. The 2027 dates belong to high-risk systems — a different category that most small businesses don’t even operate.
Second, the gap closes backwards. Enforcement machinery is still being stood up across member states, so day-one enforcement is patchy. But once an authority is operational, it can look back at conduct that was already non-compliant. “There was no referee that week” has never been much of a defence.
Third, the regulator often isn’t the first to ask. More and more, the first person who says “show me your AI compliance” is an enterprise customer running due diligence before they sign. They don’t wait for Brussels, and they don’t grade on a curve.
The honest summary
The Digital Omnibus is good news if you build high-risk AI and needed time. For nearly everyone else, the story is simpler and less relaxing: the cheap, simple duties are live and enforceable; the expensive, complicated ones got more time.
The businesses that read “delayed” and did nothing are betting the gap stays open forever. It won’t.
If you want the two things that actually apply to most small firms right now:
- Article 4 (AI literacy) — a one-page policy and a dated training record.
- Article 50 (transparency) — label your chatbots and your AI-generated content.
Do the quiet, boring thing this week: assemble the record while everyone else argues about what got delayed.
Not sure what applies to you? Start with the free 2-minute self-check — it tells you exactly which obligations are yours, then points you to the plain-language Handbook (€35) if you want the full walkthrough. Link: linktr.ee/frelih
This article was written by me and edited with AI — the exact kind of disclosure Article 50 is about. It is general information on the EU AI Act, not legal advice.
Leave a comment