The AI Act after the Digital Omnibus: what businesses using AI need to do
The EU AI Act was amended in July 2026. Which obligations apply to a company that uses AI rather than builds it, which dates moved, and a short checklist to work through.
Regulation7 min readSoventia Ltd
If your company uses AI rather than builds it, the EU AI Act asks relatively little of you today. You must not use AI for the practices the Act prohibits, you must take measures to support AI literacy among the people who use it, and in a few specific cases you must tell people that content is AI-generated. The heavier rules for high-risk uses now apply from 2 December 2027, after the Digital Omnibus on AI moved the date in July 2026.
Are you a provider or a deployer?
The AI Act gives different duties to different roles. The two that matter for most companies are:
- Provider: the organisation that develops an AI system, or has one developed, and puts it on the market or into service under its own name.
- Deployer: the organisation that uses an AI system under its own authority in its work.
A company whose staff use an AI assistant, or which uses AI inside its own processes, is a deployer. A company that builds an AI feature into a product and sells it is a provider of that system. Many companies are both, for different systems.
Does it apply to a UK company?
It can. The Act applies to providers and deployers established outside the EU where the output produced by the AI system is used in the Union. A UK company that uses AI to produce something its EU clients rely on should assume it is in scope for that system.
What the Digital Omnibus changed
The Commission proposed the Digital Omnibus on AI in November 2025. It was adopted in July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. For a company using AI, the changes that matter most are these:
- High-risk dates moved. The rules for high-risk systems listed in Annex III now apply from 2 December 2027, and for AI that is a safety component of regulated products from 2 August 2028. Both are fixed calendar dates. The proposal had tied them to the availability of standards; the final text did not.
- AI literacy was softened, not removed. Providers and deployers must still take measures to support the development of AI literacy among their staff and others using AI on their behalf. The new text says this does not require guaranteeing any specific level of literacy in any individual, and adds a duty on the Commission and member states to help, particularly for small companies.
- Two prohibitions were added. From 2 December 2026, AI systems that generate realistic intimate or sexually explicit images of an identifiable person without their consent, or child sexual abuse material, are prohibited.
- Transparency did not move. The Article 50 duties have applied since 2 August 2026. Providers of systems that generate synthetic content and were already on the market before that date have until 2 December 2026 to add the required machine-readable marking.
- Smaller companies get some relief on fines. The rule that a small or medium-sized company's fine is capped at the lower of the two maximums was extended, in part, to small mid-caps.
The dates, in one place
1 Aug 2024
The AI Act enters into force
2 Feb 2025
Prohibited practices banned; AI literacy duty appliesaffects users of AI
2 Aug 2025
Rules for general-purpose AI model providers apply
27 Jul 2026
Digital Omnibus in force; AI literacy duty softenedaffects users of AI
2 Aug 2026
Transparency duties (Article 50) applyaffects users of AI
- This post, October 2026
2 Dec 2026
Two new prohibitions applyaffects users of AI
2 Dec 2027
High-risk rules for Annex III uses apply (moved from 2 Aug 2026)affects users of AI
2 Aug 2028
High-risk rules for regulated products apply (moved from 2 Aug 2027)
What a company using AI should do now
- List the AI you use. Who uses which tool, for what, with what data. Include the AI features inside software you already pay for, not only the tools people chose themselves.
- Check the list against the prohibitions. The one most likely to catch an ordinary business is emotion recognition in the workplace, which is prohibited except for medical or safety reasons.
- Support AI literacy, and write down what you did. Guidance on approved tools, training matched to how people actually use AI, and a named person to ask. The duty is one of demonstrable effort.
- Mark AI-generated content where Article 50 requires it. If you publish AI-generated or manipulated images, audio or video that could pass as real, disclose it. If you publish AI-generated text to inform the public on matters of public interest, disclose that too, unless a person has reviewed it and someone holds editorial responsibility for it.
- Spot high-risk uses now, not in 2027. If you use AI in recruitment, worker management, credit decisions, education or another Annex III area, the deployer duties in Article 26 will apply from 2 December 2027: use the system according to its instructions, assign human oversight to people with the competence and authority to exercise it, keep the logs for at least six months, and inform workers' representatives before using it at work.
- Keep the GDPR in view. Most AI that touches personal data needs the same data protection work it always did, including an impact assessment where the processing is high risk.
What the fines look like
For the prohibited practices, fines go up to 35 million euros or 7% of worldwide annual turnover, whichever is higher. For most other obligations, including transparency, the maximum is 15 million euros or 3%. For small and medium-sized companies, each maximum is the lower of the two figures instead.
How we handle it in the systems we build
When we build an AI system, we work out its likely classification during the plan, before anything is built. Logging, human approval for consequential actions and the documentation a deployer needs are part of the build rather than an afterthought. We do not give legal opinions: where a use sits close to a high-risk category, we say so and suggest you take advice.