The EU AI Act After The Digital Omnibus: Risk Tiers And The Real Timeline

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is binding law in all 27 Member States. It entered into force on 1 August 2024 and applies in stages.¹ In July 2026 the EU amended it through the Digital Omnibus on AI, Regulation (EU) 2026/1744, which pushed back the most demanding obligations and added two new bans.²

Many explainers written before mid 2026 still show 2 August 2026 as the date when high-risk rules start. That is no longer correct. This article sets out the risk tiers, the dates that apply as of October 2026, and a simple way to judge whether a system might be high-risk. General-purpose models such as large language models have their own regime, covered in General-Purpose AI Models Under The EU AI Act.

Who The Act Applies To

The Act reaches well beyond companies based in the EU. It applies to providers that place AI systems or general-purpose AI models on the EU market wherever they are established, to deployers located in the EU, and to providers and deployers in other countries when the output of their AI system is used in the EU.¹ A UAE company selling an AI hiring tool to a European employer, for example, can be in scope.

The two roles matter throughout. A provider develops an AI system and puts it on the market under its own name. A deployer uses an AI system in its own work. Most obligations fall on providers, but deployers have duties too.

Four Tiers Of Risk

The Act does not regulate AI as a single category. It places systems in tiers according to the harm their use could cause, with duties that grow as the risk rises.

Breaking the prohibitions carries the heaviest fines in the Act: up to EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher. Most other breaches, including of high-risk and transparency duties, can reach EUR 15 million or 3 percent. For small and medium-sized enterprises the lower of the two figures applies, and the Digital Omnibus extended that treatment to small mid-cap companies for most fines.³

High-risk providers must run a risk management system, apply data governance to training data, keep technical documentation and logs, give deployers clear instructions, design for human oversight, and meet standards for accuracy and cybersecurity (Articles 9 to 15). Deployers must use the system as instructed, assign competent human oversight and monitor its operation. Public bodies and some private deployers, such as those assessing creditworthiness, must also carry out a fundamental rights impact assessment before use (Article 27).⁴

What The Digital Omnibus Changed

The Omnibus was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026. It entered into force on the third day after publication, which is 27 July 2026, the date the Commission also gives on its AI Act page.^{2 5}

The main changes, as of October 2026:

• High-risk deadlines moved. Requirements for Annex III systems now apply from 2 December 2027, and for AI in Annex I products from 2 August 2028. The original dates were 2 August 2026 and 2 August 2027. A high-risk system whose type and model was already placed on the market or put into service before the new dates is caught only if its design changes significantly afterwards, and this covers later identical units of that model too. Systems meant for public authorities must comply by 2 August 2030 in any case.⁶
• Two new prohibitions. From 2 December 2026, the Act bans AI systems that create realistic intimate imagery of identifiable people without their consent, and systems that generate child sexual abuse material as defined in the EU directive on that subject.⁷ For providers, the ban covers systems built for this purpose, and systems whose design makes such output a reasonably foreseeable result that can be reproduced without significant technical modification, where no adequate safeguards are in place to prevent it. For deployers, it covers using a system in order to produce such material.⁸
• More time for content marking. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to mark their output in a machine-readable way under Article 50(2).⁶
• AI literacy softened. Article 4 used to make providers and deployers responsible, as far as they could, for their staff reaching an adequate level of AI literacy. Under the new wording they must take steps that help staff build that literacy, and nobody has to guarantee that any particular person reaches a set level.⁹
• Other adjustments. These include a legal basis to process sensitive personal data for bias detection, a narrower definition of “safety component”, lighter treatment for small mid-cap companies, and exclusive AI Office supervision of certain AI systems built on a provider’s own general-purpose model. Machinery was also moved from Section A to Section B of Annex I. For Section B products, only a few AI Act provisions apply directly, and the high-risk requirements for AI in machinery are instead to be written into the Machinery Regulation through delegated acts that must apply by 2 August 2028.¹⁰

The Omnibus did not change the core obligations for general-purpose AI models, the prohibitions already in force, or the 2 August 2030 deadline for high-risk systems used by public authorities.⁶

The Timeline As Of October 2026

In short: the original prohibitions, AI literacy and general-purpose model rules are already live. Transparency duties for chatbots and deepfakes have applied since 2 August 2026, apart from the marking extension for older generative systems. High-risk requirements are the main obligations still ahead.

Is My System High-Risk?

The flowchart below follows the structure of Article 6. It is a simplification for orientation only and is not legal advice. Borderline cases depend on detailed legal tests and on Commission guidance, so confirm any conclusion with qualified counsel.

Whatever the result above, check transparency separately. The Article 50 duties sit alongside the high-risk rules rather than replacing them, so a high-risk system can carry both.¹² The one exception in this simplified view is a Section B product, where the AI Act applies only in part.