The EU AI Act Calendar After the Digital Omnibus: What Applies to Your Business Today and What Moved

By the end of this post you will have a dated checklist for your own company: which EU AI Act obligations already apply to you, which ones moved when the Digital Omnibus became law in July 2026, and what to finish in September. You need a spreadsheet and about an hour. No lawyer is required for the first pass.

What you need

• A list of every AI tool your company touches: chatbots, image generators, CV screeners, the model on your own server, the AI features inside your CRM.
• The two legal texts, both free to read: the AI Act, Regulation (EU) 2024/1689, and the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
• Optional: any AI assistant, local or cloud, to draft your inventory. The prompt is in Step 4.

Step 1: Read the calendar as it stands on 9 September 2026

Obligation	Articles	Applies from	Status today	Did the Omnibus move it?
Prohibited practices	Art. 5	2 Feb 2025	In force	No. One addition: systems that generate non-consensual intimate images or child sexual abuse material are banned from 2 Dec 2026.
AI literacy	Art. 4	2 Feb 2025	In force	Reworded. You must “take measures to support” staff AI literacy, proportionate to the context, rather than guarantee a competency level.
General-purpose AI models (GPAI)	Arts. 53-55	2 Aug 2025	In force	No.
Transparency: chatbots, synthetic content, deepfakes, emotion recognition	Art. 50	2 Aug 2026	In force	Partly. Marking of synthetic content by systems already on the market before 2 Aug 2026 has until 2 Dec 2026.
Penalties, governance, everything not listed elsewhere	Art. 99 and others	2 Aug 2026	In force	No.
High-risk, stand-alone (Annex III: employment, credit, education, essential services)	Arts. 6-49	2 Dec 2027 (was 2 Aug 2026)	Preparation window	Yes, 16 more months.
High-risk inside regulated products (Annex I: machinery, medical devices, toys, vehicles)	Arts. 6-49	2 Aug 2028 (was 2 Aug 2027)	Preparation window	Yes, 12 more months.
National regulatory sandboxes operational	Art. 57	2 Aug 2027	Coming	Date set by the Omnibus.
Legacy high-risk systems used by public authorities	Art. 111	2 Aug 2030	Coming	Date set by the Omnibus.

Dates come from the Omnibus text on EUR-Lex, the AI Act Explorer’s Omnibus summary, and the notes published by Gibson Dunn and the Cloud Security Alliance.

Two things to hold onto. Nothing that was already in force moved backwards. And any article that still treats 2 August 2026 as the high-risk deadline was written before July and is out of date.

Step 2: Find your row with five questions

1. Do you build or sell an AI system, or only use one? Build or sell: you are a provider, with the heavier list. Use: you are a deployer. Many small companies are both. If you fine-tune a model and put your name on it, you are its provider.
2. Does any of your AI talk to people, generate images, audio, video or text that could pass as human-made, or read emotions? Yes: Article 50 applies to you today.
3. Is AI involved in decisions about people’s jobs, credit, education, insurance or access to public services? Yes: you are probably in Annex III and your date is 2 December 2027. Our risk classification guide walks through the categories.
4. Is your AI a safety component of a product that carries CE marking (machinery, medical device, lift, toy)? Yes: Annex I, 2 August 2028, handled together with your product’s conformity process.
5. How big are you? Under 250 staff and up to EUR 50 million turnover: SME. Under 750 staff and up to EUR 150 million turnover or EUR 129 million balance sheet: small mid-cap, a category the Omnibus added. Both get simplified technical documentation on a Commission template, a quality system “proportionate to size”, and lower fine caps.

If you answered no to questions 2, 3 and 4, your list today is short: AI literacy, the prohibitions, and vendor hygiene. That describes most small businesses running a local model over internal documents.

Step 3: The dated checklist, obligation by obligation

Already due: prohibited practices (since 2 Feb 2025)

• Confirm none of your tools does social scoring, manipulative targeting of vulnerable groups, untargeted facial scraping, or emotion recognition at work or in school. The eight practices fit on one page.
• Before 2 Dec 2026: if you run an image or video generator, make sure it refuses to produce intimate images of identifiable people.

Already due: AI literacy (since 2 Feb 2025)

• A one-page policy: which tools staff may use, with which data, and who to ask.
• A short training session for everyone who uses AI at work. Forty-five minutes is a reasonable session.
• Keep the attendance list and the slides. That is your evidence of “measures taken”.

Already due: transparency, Article 50 (since 2 Aug 2026)

• Every chatbot tells the person it is an AI at first contact. One line in the welcome message.
• Generated images, audio and video carry a machine-readable mark. If your generator was on the market before 2 Aug 2026, finish this by 2 Dec 2026.
• Deepfakes of real people are visibly labelled.
• AI-written text published on matters of public interest says so, unless a person reviewed it and takes editorial responsibility.

Already due if you publish a model: GPAI (since 2 Aug 2025)

• Technical documentation, a copyright policy and a public summary of training data. If you only download and run open models, this is your model provider’s job, not yours.

Due 2 Dec 2027: Annex III high-risk

• Q4 2026: inventory and written classification of each system (the prompt in Step 4 gives you a first draft).
• H1 2027: risk management, data governance, logging, and a human oversight design; instructions for use from each provider.
• H2 2027: technical documentation on the SME template, conformity assessment, registration in the EU database.

Due 2 Aug 2028: Annex I. Same list, one year later, coordinated with the CE process for the product.

Step 4: What to do this month

1. Build the inventory. Paste this into any assistant: “Here is the software we use: [list]. For each item, say whether it contains an AI component, whether it interacts with people or generates content, and whether it influences decisions about employment, credit, education or public services. Return a table with one row per item.” Check every answer. It is a draft, not a legal opinion.
2. Fix the Article 50 wording this week. A sentence in the chatbot greeting and a metadata flag on generated files.
3. Book the AI literacy session before October. Forty-five minutes, an attendance list, done.
4. If question 3 was a yes, put 2 December 2027 in the company calendar with a reminder for January 2027. Fifteen months is enough when you start now.
5. Email each AI vendor one question: “Which AI Act risk category is your product in, and when will you send the instructions for use?” Keep the reply with the inventory.

Where this fits, and the limits of this post

Running models on your own hardware does not change your row in the table, but it makes three rows easier: data governance (the data never leaves), logging (the logs are on your disk) and vendor hygiene (you are the vendor). Our compliance guide for 2026 covers the documentation side in more depth.

Limits: this is a checklist, not legal advice. The Commission is still publishing guidelines on high-risk classification and the SME documentation template, so revisit this list in early 2027. In Spain the supervising authority is AESIA; see what Spanish businesses need to know. What will not change is the order: what applies today applies today.

Next steps

• Classify each system properly: AI risk classification under the EU AI Act.
• Check the banned list against your tools: 8 prohibited AI practices.
• See our standing summary page: EU AI Act resources.
• Grab the template: AI risk classification worksheet.
• Grab the template: Prohibited practices checklist (Article 5).

Work with us

We run this triage with clients in a single working session and leave them with the inventory, the classification and the calendar entries. If you want a second pair of eyes on yours, get in touch or see how our consulting works.