AI Act 2026-2027: The Updated Compliance Guide After the Digital Omnibus
·
Updated on ·
By 
Aymeric Guyard · 10 min read
In brief
- The AI Act (EU Regulation 2024/1689) governs AI systems according to four risk levels. Prohibited practices have applied since 2 February 2025, obligations for general-purpose models since 2 August 2025, transparency (Art. 50) since 2025. The Digital Omnibus (provisional agreement of 7 May 2026) postponed most high-risk obligations in Annex III to 2 December 2027. Any company that uses or provides AI in the EU is concerned, including as a simple user of a third-party tool.
What exactly is the AI Act?
The AI Act is Regulation (EU) 2024/1689 of 13 June 2024, which entered into force on 1 August 2024. It is the world's first horizontal legal framework dedicated to artificial intelligence. It does not regulate a technology as such, but its uses: the same model can be harmless in one context and high-risk in another. The regulation therefore operates system by system, not company by company.
Second founding principle: the distinction of roles. The regulation applies to providers (those who develop and place an AI system on the market under their own name), to deployers (those who use an AI system in a professional context), as well as to importers and distributors. The vast majority of companies are deployers—but as soon as a company markets software incorporating AI under its brand, it becomes a provider, with significantly heavier obligations. See Provider or deployer: determining your role.
The four risk levels and their obligations
The classification determines the intensity of your obligations. The most common mistake is to believe that the AI Act only concerns large publishers. This is false: an SME that uses an automated recruitment or scoring tool may fall under the strictest obligations, not because of its size, but because of the nature of the system deployed.
| Level | Examples | Main obligation |
|---|---|---|
| Unacceptable (prohibited) | Social scoring, subliminal manipulation, emotion recognition at work, sensitive biometric categorisation | Total ban since 2 February 2025 |
| High risk (Annex III) | Recruitment/HR, credit scoring, education, essential services, biometrics | Risk management, documentation, human oversight, transparency, logging |
| Limited | Chatbots, generative AI, deepfakes | Transparency (Art. 50) |
| Minimal | Spam filters, spell checkers, basic recommendation | No specific obligation |
Details by sector: the 4 risk levels explained by sector.
The actual timeline after the Digital Omnibus
The Digital Omnibus package (Commission proposal of 19 November 2025, provisional political agreement Council/Parliament of 7 May 2026) amended the original timeline. Here are the dates to remember.
| Date | What applies |
|---|---|
| 1 August 2024 | Regulation enters into force |
| 2 February 2025 | Prohibited practices + AI literacy (Art. 4) |
| 2 August 2025 | Obligations for general-purpose models (GPAI) + governance |
| 2 August 2026 | Transparency (Art. 50) fully applicable |
| 2 December 2027 | High-risk systems in Annex III (postponed from August 2026) |
| 2 August 2028 | High risk embedded in already regulated products (Annex I / Art. 6.1) |
| 31 December 2030 | Extended deadline for certain systems deployed before August 2026 |
Caution: the postponement of high risk to December 2027 is not an invitation to wait. The inventory, classification and training (Art. 4, already in force) must be initiated from 2026. High-risk compliance takes 12 to 18 months to prepare.
What the Digital Omnibus has lightened
Beyond the postponement, the Omnibus package (COM(2025) 87) introduced a substantive relief: AI systems that are safety components embedded in products already subject to third-party CE conformity assessment (machinery, medical devices, vehicles) are quasi-exempt from the high-risk regime. For these systems, only the obligation to register in the EU database remains. This relief mainly benefits industrial AI, less so HR, credit or essential services uses, which remain fully within the scope of high risk.
AI Act and GDPR: two complementary regulations
The GDPR governs personal data; the AI Act governs AI systems. Both apply simultaneously whenever AI processes personal data, which is the most common case. The fundamental rights impact assessment (FRIA, Art. 27 of the AI Act) can be conducted consistently with the DPIA (Art. 35 of the GDPR). A company already mature on the GDPR has a reusable methodological foundation. See AI Act or GDPR: which regulation applies?.
Sanctions: what you risk
Sanctions are graduated: up to €35m or 7% of worldwide turnover for the use of prohibited AI; up to €15m or 3% for a breach of high-risk obligations; up to €7.5m or 1% for lack of transparency. For SMEs and start-ups, the amount applied is the lower of the absolute cap and the percentage. In France, CNIL has been designated as the competent national authority.
Your action plan in 5 steps
- Inventory all AI systems used or developed, including AI functions embedded in your SaaS and shadow AI.
- Classify each system according to the four risk levels.
- Take measures to develop your teams' AI literacy (Art. 4, already required).
- Document: register of systems, classification decisions, supplier exchanges, human oversight measures.
- Prioritise high-risk systems and transparency obligations, with the support of a DPO or compliance officer.
Detailed steps: the AI Act checklist in 10 steps for an SME.
Take action
Data Comply One supports your AI Act compliance end to end: mapping of your AI systems, classification, AI Act module, outsourced DPO and training via DCO Academy.
Discover the AI Act software →Test my compliance for free