In May 2026, EU lawmakers agreed the Digital Omnibus on AI. Its headline change was postponing the rules for high-risk AI, such as tools used in hiring, credit and insurance, from August 2026 to 2 December 2027.
Many businesses read that as the AI Act being delayed. It wasn't. Most of what affects a typical SME day to day either stayed on schedule or is already in force.
What moved
High-risk AI listed in Annex III now has until 2 December 2027. High-risk AI built into regulated products, such as machinery or medical devices, moved to 2 August 2028.
What didn't move
The transparency duties in Article 50 applied from 2 August 2026, as planned. If your website chatbot doesn't tell customers they're talking to AI, that's a current gap, not a future one.
The banned practices have applied since February 2025, and the Omnibus added a new ban on AI that generates non-consensual intimate imagery.
What it means for you
If you use AI to screen applicants or assess customers, you now have about 14 months instead of none. That's enough time to do the work properly, but only if you start well before the deadline. Human oversight, record-keeping and informing the people affected take time to build into a process.
Start with an inventory. List every AI tool you use, including features switched on inside software you already pay for, and what each one is used for. That one list tells you which deadline applies to which tool.
Want to know where your business stands? Take the two-minute check.