The EU's AI regulation, the AI Act, is being introduced in stages. During 2026 the timetable was changed through a so-called omnibus package, and several dates that many companies had prepared for have been moved. At the same time, other parts have already started to apply. Here we explain what applies right now.

The AI Act in brief

The AI Act regulates AI based on risk. Some uses are prohibited, high-risk systems face extensive requirements, and for limited-risk AI the main requirements concern transparency. The vast majority of AI solutions companies use today, such as support for writing, document handling or internal compilations, fall into the lower risk classes.

The omnibus package: high-risk requirements are postponed

In May 2026 the EU institutions reached a political agreement on amendments to the AI Act.[1] The amendments were formally adopted as Regulation (EU) 2026/1744.[2] The most important change concerns the timetable for high-risk AI systems:

  • Stand-alone high-risk systems (Annex III), for example in recruitment and credit scoring, must meet the requirements by 2 December 2027 instead of 2 August 2026.[1][2]
  • AI that is part of regulated products (Annex I) has until 2 August 2028.[1][2]

It is important to understand that the requirements have not been removed. Risk management, data governance, technical documentation and human oversight still need to be in place, just later.

What already applies

  • Prohibited AI practices have been banned since 2 February 2025.[1]
  • Rules for general-purpose AI models, the large language models, have applied since 2 August 2025.[1]
  • The transparency requirements in Article 50 apply according to the original timetable from 2 August 2026. For existing systems there is a transition period for labeling AI-generated content until 2 December 2026.[1][2]

The omnibus package also softens the AI literacy requirement for staff. Instead of guaranteeing a certain level, companies must support employees in developing their knowledge of AI.[1] The package also introduces a new category, small mid-cap companies, which get some of the same relief as small and medium-sized enterprises.[2]

What does it mean for your company?

For most companies that use AI to work more efficiently, transparency is the most important issue right now. Among other things, it is about:

  • informing users when they interact with an AI system, for example a chatbot on your website,
  • labeling content that has been generated or manipulated by AI where the rules require it,
  • keeping track of which AI systems you use and for what.

If you use AI in decisions that significantly affect people, for example when selecting candidates or assessing creditworthiness, you should start preparing for the high-risk requirements now. The extra time is best spent building documentation and routines, not waiting.

Checklist

  1. Take stock of which AI systems you use and what they are used for.
  2. Assess which risk class each use falls into.
  3. Make sure users are informed when they interact with AI.
  4. Appoint someone responsible for AI matters and give employees basic training.
  5. For systems that may be classed as high risk: start documenting data, decision logic and human oversight.

This article is a summary and not legal advice. Always check what applies to your specific business.

Sources

  1. [1] Gibson Dunn, EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes, 2026. www.gibsondunn.com
  2. [2] Orrick, EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, July 2026. www.orrick.com