AI Act for SMEs after the Digital Omnibus: what still applies on 2 December 2026
What a company must do under the EU AI Act by 2 December 2026, what the Digital Omnibus changed, and a checklist for chatbots, voice agents and HR tools.
Updated 6 October 2026: a table of what the Omnibus changed with sources, and a checklist by tool. First published 26 September 2026. This is not legal advice but an overview to help you find your way. Talk to a lawyer about your own case.
Short answer: by 2 December 2026 a company that only uses AI tools needs a written AI-use policy with a record of who has read it, chatbots and voice agents that say they are AI, and labels on deepfakes. These duties already apply. What ends on 2 December is the transition for machine-readable marking of generated content, and that is mostly your vendor's job.
- Since 2 August 2026: transparency (Art. 50). People know they are talking to AI; deepfakes and AI text on matters of public interest carry a label.
- 2 December 2026: machine-readable marking of generated content (Art. 50(2)) for generative systems already on the market before 2 August 2026, and a new prohibition on generating non-consensual intimate imagery and child sexual abuse material.
- 2 December 2027: stand-alone high-risk systems in Annex III, such as CV screening and credit scoring.
- 2 August 2028: high-risk AI in regulated products under Annex I, such as medical devices.
The AI Act (Regulation (EU) 2024/1689) does not apply all at once. Some obligations have applied for more than a year, some since August, and on 2 December 2026 another transition period ends. The Digital Omnibus, in force since 27 July 2026, moved some dates but left most of what small companies have to do untouched.
If your company uses ChatGPT, Copilot, translation tools, image generators or has a chatbot on its website, now is a good time to put things in order. Most of it is less work than it sounds.
First: are you a provider or a deployer?
The Act assigns duties by role, so this is the first question.
- A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name.
- A deployer uses an AI system in its work.
Most companies are deployers: they use other people's tools. But if you put a chatbot on your website under your own name, or commission a custom model and offer it to customers as your product, you can also be the provider of that system. Decide the role tool by tool.
Timeline at a glance
| Date | What applies |
|---|---|
| 2 Feb 2025 | AI literacy (Art. 4), prohibited practices (Art. 5) |
| 2 Aug 2026 | Transparency (Art. 50): disclosure of AI interaction, labelling of deepfakes and public-interest text |
| 2 Dec 2026 | Machine-readable marking (Art. 50(2)) for generative systems placed on the market before 2 Aug 2026; new prohibition on non-consensual intimate imagery and child sexual abuse material |
| 2 Dec 2027 | Stand-alone high-risk systems in Annex III |
| 2 Aug 2028 | High-risk AI in regulated products under Annex I |
What already applies
Since 2 February 2025: AI literacy (Article 4)
A company that uses AI has to make sure the people working with it understand what the tool can do, where it goes wrong and how to handle data.
The Digital Omnibus softened this: it is now about measures that support AI literacy, not a guaranteed level of knowledge. The law asks for no certificates or exams. In practice a short written AI-use policy and a record of who has read it are enough.
The prohibited practices of Article 5 also apply since that date, for example manipulative techniques and social scoring. They are irrelevant for most companies, but worth checking once.
Since 2 August 2026: transparency (Article 50)
- People must know they are talking to AI. This covers chatbots and voice agents. The duty sits with the provider of the system; you check that the chatbot you use with customers says so clearly.
- Generated content must be machine-readably marked. Providers of generative systems must mark images, audio, video and text in a machine-readable way.
- Deployers label deepfakes, and AI-generated text published to inform the public on matters of public interest. The exception is text reviewed before publication by a person who holds editorial responsibility for it.
In July 2026 the Commission published guidelines on Article 50 with the details.
What happens on 2 December 2026
Generative systems already on the market before 2 August 2026 got a transition period for machine-readable marking of their outputs. It ends on 2 December 2026.
That concerns providers of such systems. If you use third-party tools, marking is your vendor's job. If you built a generator yourself and run it under your name, for catalogue images or speech synthesis in a call centre, it applies to you too.
Under the Omnibus, a new prohibition also starts that day: systems that generate non-consensual intimate imagery and child sexual abuse material.
Checklist by tool: chatbot, voice agent, generated content, HR
Take each tool and ask three things: who is its provider, what do people see, and what has to be in place by 2 December 2026.
Chatbot on your website or in your app
- It says it is AI at the first contact, unless that is obvious (Art. 50(1), since 2 August 2026). One line in the welcome message is enough, for example "You are talking to an AI assistant. Ask for a person at any time."
- Ask the vendor in writing who the provider is. If the chatbot runs under your name and was built for you, it may be you.
- Our note on a small model for customer support shows how we label answers a person has approved.
Voice agent on the phone
- It says at the start of the call that the caller is talking to AI (Art. 50(1)).
- The synthetic voice is generated audio. If the system is yours and was on the market before 2 August 2026, machine-readable marking of the audio is due on 2 December 2026 (Art. 50(2)). If it is a vendor's platform, ask the vendor how and from when it marks the audio.
- If it recognises the caller's emotions, the caller must be told (Art. 50(3)).
Generated images, video and audio
- Content that resembles real people, objects, places or events and could falsely pass as genuine is a deepfake. It gets a visible label, since 2 August 2026 (Art. 50(4)). For an evidently artistic, satirical or fictional work, the disclosure may be discreet so it does not spoil the work.
- An obvious drawing or diagram is not a deepfake. If you are unsure, label it; it costs nothing.
- Machine-readable marking is done by the tool's provider. If you generate catalogue images with your own model under your own name, it is yours.
Generated text
- E-mails, offers, product descriptions and internal documents need no label under the Act.
- Text published to inform the public on matters of public interest needs a label, unless a person with editorial responsibility reviews it before publication. Write down who that person is.
HR tools
- Recruitment and selection, including targeted job ads, filtering applications and evaluating candidates, and decisions on promotion, termination, task allocation and performance are in Annex III. The obligations apply from 2 December 2027. Before using such a system at work, the employer must inform workers' representatives and the affected employees (Art. 26(7)).
- Emotion recognition at the workplace has been prohibited since 2 February 2025 (Art. 5(1)(f)), except for medical or safety reasons. If a video interview tool reads candidates' emotions, stop using it now.
- Writing a job ad with ChatGPT is not high-risk. Using AI to choose who sees the ad is.
For agents that act on their own, such as sending mail or entering orders, see our note on AI agents with human approval. A free indicative self-check is on the AI Act review page.
What the Digital Omnibus changed, with sources
The Omnibus is Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The table only covers what matters to a small company by 2 December 2026.
| What | Before the Omnibus | After the Omnibus | Source |
|---|---|---|---|
| AI literacy (Art. 4) | ensure a sufficient level, from 2 Feb 2025 | take measures that support it; date unchanged | 2026/1744, new Art. 4 |
| Transparency, Art. 50(1), (3), (4) | 2 Aug 2026 | unchanged | 2024/1689, Art. 113 |
| Machine-readable marking, Art. 50(2), systems on the market before 2 Aug 2026 | 2 Aug 2026 | 2 Dec 2026 | 2026/1744, transitional provision |
| Machine-readable marking, systems placed on the market from 2 Aug 2026 | 2 Aug 2026 | unchanged, no grace period | 2026/1744 |
| Prohibition of generating non-consensual intimate imagery and child sexual abuse material (Art. 5) | not in the Act | 2 Dec 2026 | 2026/1744 |
| High-risk, Annex III | 2 Aug 2026 | 2 Dec 2027 | 2026/1744 |
| High-risk, Annex I | 2 Aug 2027 | 2 Aug 2028 | 2026/1744 |
| Simplified technical documentation, proportionate quality management, lower fine caps | SMEs | SMEs and small mid-caps | 2026/1744, Art. 11, 17, 99 |
Not changed: which use cases count as high-risk (hiring, credit and education are still on the list, only the date moved), the prohibited practices already in Article 5, and the penalty levels.
If you use AI in an Annex III area, you have until 2 December 2027. Preparation means documentation, human oversight, logging and, for some deployers, a fundamental rights impact assessment. That takes time, so don't leave it to the last month.
Penalties
Up to EUR 15 million or 3 % of annual turnover for breaching most obligations, including Article 50. Up to EUR 35 million or 7 % for prohibited practices. For SMEs and small mid-caps the lower of the two amounts applies.
A six-step checklist
- List the AI tools in the company. Who uses them, for what and with which data.
- Record the role and risk class for each tool. Deployer or provider? Is the use case in Annex III? If so, start preparing for December 2027.
- Write a short AI-use policy. Keep a record of who has read it (Article 4).
- Check disclosure. Chatbots and voice agents you use with customers must say they are AI.
- Agree on labelling. Deepfakes and AI text for the public get a label, or you introduce human editorial review.
- Check your vendor contracts. Who is the provider, what documentation you receive, and where data is processed (a GDPR data-processing agreement).
When you need a lawyer, and when we are the wrong choice
We write technical documentation: which tools you use, what role you have for each, what the rules and disclosure texts say. That covers most companies that only use AI tools. It comes in three fixed-price packages by company size, up to 10, 50 and 250 people, in 3 to 10 working days.
Go to a lawyer instead, or as well, if:
- you use AI in hiring, credit, insurance, education or access to public services. Whether your case is high-risk is a legal assessment;
- you sell an AI system or a product with AI built in under your own name, because of liability and contracts with customers;
- you enter health data or other special categories of personal data into AI tools, which usually needs a GDPR impact assessment;
- you have a complaint, a dispute or a question from a supervisory authority.
If nobody in the company uses AI, you don't need us. Check the prohibited practices once and write that down.
Frequently asked questions
What must a company do under the AI Act by 2 December 2026?
Most companies only use AI tools, and for them the work is already due: a written AI-use policy with a record of who has read it (Art. 4, since 2 Feb 2025), chatbots that say they are AI, and labels on deepfakes (Art. 50, since 2 Aug 2026). The 2 December 2026 date ends the transition for machine-readable marking of generated content, which is a duty of the provider of the generative system.
Did the Digital Omnibus postpone the Article 50 transparency duties?
No. Article 50 has applied since 2 August 2026. The Omnibus only gave generative systems already on the market before that date until 2 December 2026 for machine-readable marking of their outputs.
Do we have to label text we write with ChatGPT?
The Act does not require it for ordinary e-mails, offers or internal documents. A label is needed for AI-generated text published to inform the public on matters of public interest, unless a person with editorial responsibility reviews it before publication, and for deepfakes.
Are HR tools such as CV screening high-risk, and from when?
Yes, recruitment, candidate ranking and performance evaluation are in Annex III. After the Digital Omnibus those obligations apply from 2 December 2027, and AI in regulated products under Annex I, such as medical devices, from 2 August 2028. Emotion recognition at the workplace has been prohibited since 2 February 2025.
Do we need a lawyer or a technical review?
For most SMEs that only use AI tools, a technical review is enough: a tool inventory, a policy and disclosure texts. We do it at a fixed price by company size; the packages are on mediaatlas.si/ai-act.html. You need a lawyer if you use AI in an Annex III area, sell an AI system under your own name, or have a dispute or a question from a supervisory authority.
Sources
- AI Act, Regulation (EU) 2024/1689 (EUR-Lex)
- Digital Omnibus on AI, Regulation (EU) 2026/1744 (EUR-Lex, Official Journal)
- Commission guidelines on the Article 50 transparency obligations
We checked the Digital Omnibus dates against its text in the Official Journal. Once EUR-Lex publishes the consolidated text of the Act, check them there. This note is general information and does not replace legal advice.