EU AI Act Compliance for SMEs: The Complete 2026 Guide

About This Law

Official Name: Regulation (EU) 2024/1689, EU AI Act, amended by Digital Omnibus on AI (political agreement May 7, 2026; formal adoption expected July 2026)

Entered into Force: August 1, 2024. Omnibus amendments expected in Official Journal before August 2, 2026.

Jurisdiction: All 27 EU member states directly. Extraterritorial: any organisation worldwide placing AI on EU market or whose AI outputs are used within the EU.

Prohibited AI (Active Now): In force since February 2, 2025. Social scoring, subliminal manipulation, real-time biometric surveillance (narrow exceptions), exploitation of vulnerabilities. NEW: AI-generated non-consensual intimate imagery (nudifiers) and CSAM added by Omnibus.

GPAI Model Obligations: In force since August 2, 2025. General-purpose AI model providers must maintain technical documentation, comply with copyright law, publish summaries of training data.

Article 50 Transparency (Active August 2, 2026): Chatbot disclosure, emotion recognition labelling, deepfake marking. UNCHANGED by Omnibus. Watermarking (Article 50(2)): NEW deadline December 2, 2026.

High-Risk AI Annex III Standalone (Updated): Employment, credit, education, biometrics, law enforcement, critical infrastructure: NEW deadline December 2, 2027 (was August 2, 2026). Grandfathering: systems placed on market before this date not subject to HRAIS requirements unless substantially modified.

High-Risk AI Annex I Products (Updated): Medical devices, machinery, toys, vehicles: NEW deadline August 2, 2028 (was August 2, 2027).

Maximum Penalties: EUR 35M or 7% global turnover (prohibited practices); EUR 15M or 3% (high-risk non-compliance); EUR 7.5M or 1.5% (transparency/watermarking). Lower caps for SMEs.

SME Extensions: Omnibus extends SME compliance simplifications to Small Mid-Cap companies (SMCs) with up to 750 employees and EUR 150M annual revenue.

Introduction

Everything you read about August 2, 2026 being the EU AI Act deadline for high-risk AI just became outdated. On May 7, 2026, the European Parliament and the Council reached a political agreement on the Digital Omnibus on AI, the most significant amendment to the EU AI Act since it entered force. The headline change: the compliance deadline for most high-risk AI systems has been extended from August 2, 2026 to December 2, 2027. For standalone Annex III systems, that is 16 additional months. For high-risk AI embedded in regulated products, the new deadline is August 2, 2028.

The Omnibus was prompted by a stark reality: technical standards and guidance documents that businesses need to implement high-risk AI requirements are not ready. Implementation was visibly off track. The co-legislators extended the deadline rather than rush compliance against standards that do not yet exist. Formal adoption is expected by July 2026, before the original August deadline.

Here is what this means for your SME: the extra time is a gift, not a licence to pause. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, emotion recognition marking) still apply from August 2, 2026, unchanged. Prohibited AI practices have been banned since February 2, 2025. And a new watermarking obligation kicks in December 2, 2026. The Act is already in force. The clock is running.

Read on for the updated compliance roadmap, including what the Omnibus changes, what it does not change, and the exact steps your SME must take before each remaining deadline.

What the EU AI Act Omnibus Actually Changes

The Digital Omnibus on AI, agreed May 7, 2026, amends the EU AI Act in five significant ways. Understanding each change precisely is essential because some deadlines moved and others did not.

• High-risk deadline extended (Annex III): Standalone high-risk AI systems, including those used in employment screening, credit decisions, education, biometrics, law enforcement, and critical infrastructure, now have until December 2, 2027 to comply. This is the change that affects the most businesses.
• High-risk deadline extended (Annex I products): AI embedded in regulated products (medical devices, machinery, toys, vehicles, lifts) now has until August 2, 2028.
• Grandfathering introduced: AI systems already placed on the EU market before the respective new deadlines will NOT be subject to high-risk AI requirements unless they undergo a substantial modification after those dates. This is a major commercial planning lever for products already deployed.
• Watermarking compressed (Article 50(2)): The grace period for providers to implement AI-generated content watermarking was cut from six months to three. The new deadline is December 2, 2026. This affects all generative AI system providers regardless of risk tier.
• New prohibition added: AI systems that generate non-consensual sexually explicit or intimate imagery (nudifiers) and child sexual abuse material (CSAM) are now prohibited under Article 5, with fines of up to EUR 35 million or 7% of global turnover.

What the Omnibus does NOT change: Article 50 transparency obligations (chatbot disclosure, emotion recognition labelling, deepfake disclosure) still apply from August 2, 2026. GPAI model obligations remain unchanged from August 2025. Prohibited practice enforcement from February 2025 is unchanged.

What Is the EU AI Act?

The EU AI Act is the world’s first comprehensive, risk-based legal framework for artificial intelligence. Its full official title is Regulation (EU) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence. It was proposed by the European Commission in April 2021, negotiated over three years, and entered into force on August 1, 2024, following the longest AI legislative process in EU history.

Unlike a directive, a regulation is directly applicable law across all 27 EU member states simultaneously. No national AI Act is needed in France, Germany, or Spain: the EU AI Act is already their law. The Act also applies extraterritorially: a US company selling AI hiring tools to French firms, or a Singapore SaaS provider serving German clients, must comply. This is the Brussels Effect in action.

The Act is risk-based, not sector-based. Your compliance obligations depend entirely on what your AI system does and how significant its impacts on people are, not on your company’s industry or size.

The 4 Risk Tiers: Where Does Your AI System Land?

The Act divides AI systems into four categories. Getting this classification right is not optional: it determines everything that follows.

• Unacceptable Risk (Prohibited): Banned since February 2, 2025. Social scoring, real-time biometric surveillance (narrow exceptions), AI exploiting psychological vulnerabilities, subliminal manipulation, and now (via the Omnibus) AI-generated non-consensual intimate imagery. If your system does any of these, stop immediately.
• High-Risk AI: The most heavily regulated tier. Systems in healthcare, employment screening, credit scoring, educational assessment, law enforcement, critical infrastructure, and biometrics fall here. Full compliance required by December 2, 2027 (Annex III standalone) or August 2, 2028 (embedded in regulated products).
• Limited Risk: Chatbots, deepfake generators, emotion recognition tools. Core obligation is transparency: users must know they are interacting with AI. This tier’s disclosure obligations apply from August 2, 2026.
• Minimal Risk: Spam filters, AI in video games, low-impact recommendation engines. No specific obligations beyond good practice.

Most SMEs operate in the Limited Risk or Minimal Risk tiers. However, if your business uses AI for recruitment, loan decisions, or health-related assessments, you are almost certainly in the High-Risk category regardless of your company size.

What Still Applies From August 2, 2026

The Omnibus deadline extension is not a reason to stop compliance work. Three obligations apply from August 2, 2026 regardless of the Omnibus.

First, Article 50 transparency obligations cover all AI systems that interact with the public. Any product or service that uses a chatbot must clearly disclose it is AI-powered. AI systems that generate synthetic audio, images, or video must be labelled as AI-generated. Systems using emotion recognition on natural persons must inform them.

Second, GPAI model obligations from August 2025 remain fully in force. If your business provides a general-purpose AI model, you must maintain technical documentation, register with the EU AI Office, comply with copyright law, and publish training data summaries.

Third, prohibited practices remain banned since February 2025. No new grace period applies to these. The Omnibus adds a new prohibition (nudifiers) to this list.

Not sure which 2026 obligations apply to your AI systems right now, and which of your high-risk systems benefit from the December 2027 extension? Book your free 30-minute EU AI Act review. We will map every system to the correct tier and deadline, at no cost and no commitment.

What High-Risk AI Compliance Requires (Starting December 2027)

The extra time from the Omnibus does not make the high-risk requirements lighter. The seven obligations for Annex III high-risk AI systems remain unchanged.

1. Risk management system: A documented, continuous process to identify and mitigate risks across the AI system’s lifecycle.
2. Data governance: Training, validation, and test datasets must meet quality requirements. Bias must be addressed. Data provenance must be documented.
3. Technical documentation: A comprehensive technical file covering the system’s purpose, design, performance, and limitations.
4. Transparency for users: Clear instructions so deployers and users understand the system’s capabilities and limitations.
5. Human oversight: Built-in mechanisms allowing human review, override, and shutdown. The oversight must be genuine, not a rubber stamp.
6. Accuracy, robustness, and cybersecurity: Measurable performance standards and resilience against adversarial inputs.
7. Fundamental Rights Impact Assessment (FRIA): Required for deployers of certain high-risk systems including employment screening AI.

SME-Specific Protections Under the Omnibus

The Omnibus extends all SME protections to Small Mid-Cap companies (SMCs) with up to 750 employees and EUR 150 million annual revenue. These protections include simplified technical documentation templates, reduced post-market monitoring obligations, lower maximum fine thresholds, and priority access to regulatory sandboxes.

The AI regulatory sandbox deadline has also been extended. Member states now have until August 2, 2027 to establish national AI regulatory sandboxes. Spain’s AESIA published 16 practical compliance guides in December 2025, available free of charge. The European AI Office runs a free AI Act Compliance Checker at artificialintelligenceact.eu.

Your Updated EU AI Act Compliance Plan for SMEs

• Audit prohibited practices immediately: The Omnibus adds nudifiers to the prohibited list. If any system your business uses or sells could generate non-consensual intimate content, legal review is required now.
• Build your AI inventory and classify each system: Every AI system in your business needs a documented risk tier. The December 2027 deadline does not reduce the urgency of knowing which tier applies.
• Prepare for August 2, 2026 transparency obligations: Update your disclosure mechanisms for any customer-facing AI: chatbot labelling, emotion recognition notices, and AI-generated content disclosure.
• Plan watermarking implementation for December 2, 2026: If your business produces or deploys generative AI that outputs synthetic content to users, your watermarking infrastructure must be live by December 2, 2026.
• Use the 2027 window to build high-risk AI governance properly: For Annex III systems, the extension to December 2027 is an opportunity to build documentation, human oversight mechanisms, and FRIA processes correctly.

Frequently Asked Questions

Did the Omnibus change the August 2, 2026 deadline for everything?

No. The Omnibus extended only the high-risk AI (HRAIS) compliance deadlines. Article 50 transparency obligations still apply from August 2, 2026. Prohibited practices remain banned since February 2, 2025. Watermarking under Article 50(2) moves to December 2, 2026. Formal adoption is expected by July 2026.

What is the grandfathering rule in the Omnibus?

AI systems already placed on the EU market before the new HRAIS deadlines are not subject to high-risk AI requirements unless they undergo a substantial modification after those dates. This gives operators of already-deployed systems significant planning flexibility.

Does the EU AI Act apply to my business if I am based outside the EU?

Yes. The extraterritorial scope is unchanged. If your AI system is placed on the EU market or if the output of your AI is used within the EU, the Act applies. This covers US, UK, and Asia-based companies serving European customers.

What are the fines for non-compliance?

Fines range from EUR 7.5 million (1.5% of global turnover) for transparency violations up to EUR 35 million (7% of global turnover) for prohibited practices. The Omnibus maintains proportionately lower maximum penalties for SMEs.

Conclusion

The EU AI Act Omnibus changed the timeline, not the direction. High-risk AI compliance is now due December 2027 for most standalone systems, giving SMEs additional preparation time. But August 2, 2026 remains an active compliance date for transparency obligations, and the new December 2, 2026 watermarking deadline is closer than it looks.

Use the extended window to build proper governance, not to delay. The businesses that treat the extra time as an invitation to prepare systematically will face December 2027 with minimal friction.

Ready to build your EU AI Act compliance programme on the updated timeline? Book your free compliance review today. We will map your systems to the correct tier, identify your August 2026 and December 2026 obligations, and give you a clear roadmap for December 2027, at no cost and no commitment.