EU AI Act for Deployers: What Changes Under the 2026 Digital Omnibus

On 27 July 2026, the European Union published Regulation (EU) 2026/1744—the Digital Omnibus on AI. The headline relief was immediate: the enforcement deadline for standalone high-risk AI systems under Annex III moved from August 2026 to 2 December 2027. But European SMEs cannot close their compliance folders and look away. Several core rules for organisations buying and running AI tools apply right now.

Most European businesses will never train a foundation model from scratch. Instead, they buy third-party AI tools: customer support copilots, resume screening software, code assistants, and automated fraud scoring. Under the EU AI Act, using AI tools in your business makes you a deployer (Article 3(4)). Deployers carry distinct legal responsibilities that software vendors cannot shoulder on your behalf.

Here is what changed under the Digital Omnibus, what remains active today, and how your team should adapt.

---

What did the Digital Omnibus actually postpone?

The European Commission introduced the Digital Omnibus to fix a practical bottleneck: harmonised technical standards. European standardisation bodies (CEN-CENELEC) were running behind on delivering the technical specifications required for high-risk conformity assessments. Forcing companies to comply without published European harmonised standards would have caused legal chaos.

The Digital Omnibus revised two key dates:

1. Standalone High-Risk AI Systems (Annex III): Enforcement shifted to 2 December 2027. This covers AI used in employment and recruitment, credit evaluation, biometrics, critical infrastructure, and essential public services.
2. Embedded High-Risk AI Systems (Annex I): Enforcement shifted to 2 August 2028. This covers AI systems embedded as safety components in regulated physical products, from medical hardware to industrial machinery.

The Omnibus also extended small-business administrative flexibilities to small mid-cap enterprises (companies with up to 499 employees), easing documentation requirements for mid-tier European firms.

---

Which deployer obligations apply right now?

The postponement applies strictly to high-risk conformity regimes. It did not freeze the rest of the rulebook. If your company deploys AI tools in the European Union, three major obligation areas are already enforceable:

1. Article 50 Transparency Obligations

From August 2026, transparency rules apply across the board. If you deploy an AI chatbot on your website, you must clearly inform users that they are interacting with an AI system, unless this is obvious from the context. If your marketing team publishes synthetic audio, video, or realistic images, you must apply machine-readable watermarks or clear visual disclosures.

2. Article 4 AI Literacy

Mandatory since February 2025. Employers deploying AI systems must ensure their staff possess sufficient AI literacy. Your engineers, marketing staff, and HR teams must understand how your AI tools work, where their data goes, and what risks they introduce.

3. Prohibited AI Practices (Article 5)

Article 5 bans have been active since February 2025. The Digital Omnibus added explicit prohibitions against AI tools generating non-consensual intimate imagery. If a vendor tool performs emotion recognition in the workplace or untargeted facial scraping, using it inside the EU is illegal today.

---

The Article 25 trap: When does a buyer become a provider?

This is the costliest trap for European SMEs. Under Article 25 of the AI Act, an organisation that buys a third-party AI system can legally transform into its provider overnight. If that happens, your company inherits the entire technical documentation burden, conformity assessments, and CE marking duties.

You become a provider if your team:

• Puts its own name or trademark on an existing third-party AI tool.
• Makes a substantial modification to an existing AI system (e.g. fine-tuning an open-source model on proprietary operational datasets in a way that shifts performance parameters).
• Changes the intended purpose of a general-purpose AI tool so that it now functions as a high-risk AI system (such as wiring an LLM directly into resume screening or employee promotion scoring).

If you build internal integrations, always preserve the vendor's intended purpose documentation. Do not rebrand high-risk tools without legal review.

---

Practical 4-step deployer checklist for EU SMEs

Take advantage of the timeline extension to put clean evidence in place without rushing:

| Step | Action | Required Output | | :--- | :--- | :--- | | 1. Maintain AI System Inventory | Log every AI tool across engineering, marketing, and HR. | Internal AI register linked to your ROPA. | | 2. Review Vendor Instructions | Confirm your team uses third-party AI strictly within vendor specifications (Article 26(1)). | Documented vendor terms and approved usage policy. | | 3. Configure Article 50 Notices | Add user-facing disclosures to public chatbots and synthetic content. | Visible UI badges and automated watermarking. | | 4. Retain System Logs | If using AI for decisions affecting individuals, store system logs for at least six months (Article 26(5)). | Audit-ready log retention pipeline. |

Don't let the 2027 extension create complacency. Reviewing your AI inventory now turns compliance from a fire drill into an orderly operational routine.

---

Disclaimer: EuroComply provides compliance readiness tools and evidence drafts. This guide is for informational purposes and does not constitute legal, regulatory, or compliance advice. Have technical documentation and assessments reviewed by qualified counsel.