The EU AI Act After the Omnibus, for Leaders Who Deploy

The EU AI Act is law, and parts of it already apply. The Digital Omnibus moved the dates for high-risk systems: 2 December 2027 for the uses listed in Annex III, 2 August 2028 for AI inside regulated products. It did not move the bans, the AI literacy duty or the rules for general-purpose models, and the transparency rules still apply from 2 August 2026, with a short grace period for older generative systems. For a company that deploys AI, most of what is due today comes down to knowing what you run and what role you play.

Updated 4 October 2026. Rebuilt as a short reference, with every date checked against the Official Journal texts of the Act and the Omnibus. The changes are listed at the end.

What Applies Today, and What Is Coming?

The Act is Regulation (EU) 2024/1689, in force since 1 August 2024. The Omnibus is Regulation (EU) 2026/1744, signed on 8 July 2026, published on 24 July 2026 and in force since 27 July 2026. The amended Act sets the dates below, most of them in Article 113.

Two transition rules matter for systems already running. A high-risk system that was on the market before its high-risk date is covered only once its design changes significantly (Article 111(2)). Generative systems already on the market before 2 August 2026 have until 2 December 2026 to mark their output in a machine-readable way (Article 111(4)). New systems have had to do so since 2 August 2026.

Does the EU AI Act Apply to a Company Outside the EU?

Yes. Article 2(1) lists who is covered, and three of its cases matter most here. It covers providers that place an AI system or a general-purpose model on the EU market, wherever they are established. It covers deployers established or located in the EU. And it covers providers and deployers in a third country "where the output produced by the AI system is used in the Union".

The third case is the one boards miss. A US or Gulf company that scores applicants, prices policies or screens candidates, where the output is used in the EU, is covered for that use even if no server or office sits in Europe. A provider outside the EU that sells a high-risk system into the EU must first appoint an authorised representative in the EU by written mandate (Article 22). The deployer duties do not apply to a person using AI for purely personal, non-professional purposes (Article 2(10)).

Where Does Your System Sit?

I use one model with clients to place every system. I call it the Compliance Surface Area Model. It asks three questions, and the answers together set the obligations. No single answer does.

1. Which risk tier? Banned (Article 5), high-risk (Annex III uses or Annex I products), subject to transparency duties (Article 50), or none of these. The AI literacy duty applies across all four.
2. Does it run on a general-purpose model? The model's provider carries the model duties in Chapter V. It must give providers who build on the model the documentation they need to meet their own duties (Article 53(1)(b)). A model trained with more than 10²⁵ floating-point operations is presumed to have high-impact capabilities, and so to carry systemic risk, unless its provider persuades the Commission otherwise (Articles 51(2) and 52(2)).
3. What is your role? Provider, deployer, importer or distributor (Article 3). A company is usually the deployer of what it buys and can be the provider of what it builds, so one company often holds both roles across its systems.

Two details change many classifications. An Annex III system is not high-risk if it poses no significant risk and meets one of four narrow conditions, such as doing only a procedural or preparatory task, but it is always high-risk if it profiles people (Article 6(3)). And the role can switch. Under Article 25, a deployer becomes the provider of a high-risk system if it puts its own name on the system, makes a substantial modification to it, or changes the purpose of a system, including one built on a general-purpose model, so that it becomes high-risk. A general chatbot put to work screening job applicants would be one example.

For the vendor side of that handoff, see the vendor governance scorecard and the third-party AI risk framework.

What Does a Deployer Owe Under Each Date?

Most of a deployer's duties sit in Article 26, and for Annex III systems they apply from 2 December 2027. The duties in Articles 4 and 50 already apply.

The impact assessment does not have to start from zero. Where a GDPR data protection impact assessment already covers some of the same ground, the deployer can cross-refer to it (Article 27(4)). The GDPR guide covers that layer.

What Are the Fines?

Member States set the rules on penalties, within ceilings the Act fixes in Article 99. In each of its three tiers the higher of the two figures applies to most companies, and the lower to small and medium-sized enterprises.

• Banned practices: up to EUR 35 million or 7% of worldwide annual turnover (Article 99(3)).
• The operator duties listed in Article 99(4), including provider duties (Article 16), the deployer duties in Article 26 and the transparency duties in Article 50: up to EUR 15 million or 3%.
• Incorrect or misleading information to authorities or notified bodies: up to EUR 7.5 million or 1% (Article 99(5)).
• Providers of general-purpose models: the Commission can fine up to EUR 15 million or 3%, whichever is higher (Article 101).

The Omnibus added small mid-cap enterprises to the lower-figure rule for the second and third tiers (Article 99(6a)). Only the bans carry the EUR 35 million ceiling. A missed logging or oversight duty sits in the EUR 15 million tier.

What Should a Deployer Do Now?

Six steps, in order. The first four are already due.

1. List every AI system in use. Include AI features inside software you buy. For each, record your role and its risk tier. Use the worksheet if you have no inventory.
2. Check the list against Article 5. In bought tools I would check first for emotion inference at work, social scoring and untargeted face scraping. Check generative tools against the two new bans before 2 December 2026.
3. Record your AI literacy measures. Who was trained, on what, and when.
4. Meet the Article 50 duties. Notices for emotion recognition and biometric categorisation, and labels for deepfakes and for public-interest text that no editor reviewed.
5. Prepare each Annex III system for 2 December 2027. Name the people who oversee it, set log retention to at least six months, draft the notices to workers and to the people affected, and run the impact assessment where Article 27 applies.
6. Check your contracts. Get the instructions for use and the information your providers must supply, and watch for any change that would make you a provider under Article 25.

For how the EU rules sit next to other regimes, see the global AI regulation comparison guide, the NIST AI RMF crosswalk and the UAE reference. If the paperwork is growing and nothing in how systems are built has changed, that is the gap I describe in Policy Is Not Control.

Sources and Changes

• Regulation (EU) 2024/1689 (the AI Act), Official Journal of 12 July 2024: Articles 2, 3, 4, 5, 6, 11, 22, 25, 26, 27, 50, 51, 53, 57, 72, 99, 101, 111 and 113, and Annexes I and III.
• Regulation (EU) 2026/1744 (the Digital Omnibus on AI), Official Journal of 24 July 2026, Article 1, points (4), (5), (7), (10), (12), (13), (22), (30), (38), (39), (40) and (41).
• Both texts were read in the Publications Office copies of the Official Journal on 4 October 2026. The AI Act Service Desk publishes the Commission's guidance.
• NIST, AI Risk Management Framework 1.0, section 5, for its four functions.

Changes on 4 October 2026. The piece was cut from about 3,000 words to a reference. Every date now follows the amended Act. The anonymised client story and the cost ranges were removed because they could not be checked against a record. Four charts that showed illustrative figures (a readiness radar, a burden heatmap, a fines tornado with a trust premium bar, and a plot of named models) were replaced with charts drawn only from the law. Three statements were corrected: small and medium-sized firms do get relief (lower fines and simpler documentation); older high-risk systems do get a transition (Article 111); and AI in Annex I products is due on 2 August 2028, not "2027+". A comparison table that listed a "Respond" function in the NIST AI RMF was removed. The framework has four functions: Govern, Map, Measure and Manage.

I am not licensed to practise law in the EU. This is a board-level reading of the Official Journal texts. Confirm specifics with EU counsel before you act.