In this article13 sections
  1. The headline changes that matter to small and medium employers
  2. The timetable in plain terms
  3. Which duties apply to you now
  4. What the postponements actually change for deployers
  5. Article 4: AI literacy as a duty to support learning
  6. Article 50: transparency you must keep doing now
  7. SME simplifications: what the law says and how to use them
  8. Practical checklist for an SME that buys or deploys AI
  9. How enforcement works and what happens if you get it wrong
  10. How much will compliance cost? Practical budgeting notes
  11. Quick, low‑cost actions you can take this week
  12. Where to read the primary sources
  13. Final practical roadmap for the next 12 months

TL;DR: The "digital omnibus ai act" update moves most high-risk duties into late 2027 and 2028, leaves transparency duties in force, reframes Article 4 as a literacy support duty, and keeps SME simplifications. Read this to know what you must do now, what you can phase in, and what the Commission can do if rules are breached.

You run an EU company of 10 to 249 people. You buy or deploy AI tools. You do not build models. You need clear, practical steps. This article explains what Regulation (EU) 2026/1744 changed for deployers like you.

Sources used here are the European Commission pages on the AI Act and the AI Pact, and the European Parliament briefing. Links to those pages appear where they support a claim. This is explanatory information, not legal advice.

The headline changes that matter to small and medium employers

Each line above links to the Commission or Parliament pages where the Act, its timetable and the implementation support are described. Read those pages for the primary texts and guidance.

The timetable in plain terms

Short version. Some obligations already apply. Many high‑risk obligations were given extra time.

Why this matters. You may already be subject to transparency duties and basic obligations. But more technical compliance steps for high‑risk systems have been given a later start date. Use the breathing room to prepare documentation and processes.

Which duties apply to you now

Start with these checks. They are low cost and high impact.

These steps are practical, do not require heavy investment, and reduce day‑one enforcement risk.

What the postponements actually change for deployers

The Commission moved some demanding, documentation heavy and certification tasks into later dates. That affects both your schedule and your budget.

What this does not mean. A later effective date is not a waiving of duties. It is a rearrangement of when certain technical and certification rules must be in place. Immediate obligations like transparency still apply.

Article 4: AI literacy as a duty to support learning

The AI Act frames AI literacy as part of the broader governance effort. The updated Article 4 emphasises support for literacy rather than a general duty to teach staff how to code models.

What that looks like for you.

If you want a concise breakdown of what Article 4 means in practice for an SME, see this short internal guide. /blog/comply/eu-ai-act-article-4-what-european-smes-actually-need-to-do.

Article 50: transparency you must keep doing now

Article 50 requires information for users when an AI system interacts with them and when a system generates content that could be mistaken for human work. The duty sits with providers and deployers depending on the context.

If you use chatbots with customers, you must keep doing these things now:

  • Disclose that users are interacting with an AI. Keep that disclosure visible and clear.

  • Make basic information available about the AI system and the purpose of the interaction.

The Act sets these transparency requirements to manage limited‑risk AI systems. The European Parliament briefing summarises the Act's transparency layer. [europarl.europa.eu](https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence).

If you need a practical checklist on Article 50 and chatbots, read this explainer. /blog/comply/ai-act-article-50-transparency-chatbots-deepfakes.

SME simplifications: what the law says and how to use them

The Act recognises the compliance burden for smaller organisations. The Commission supports phased implementation and voluntary preparation through the AI Pact. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-pact).

How SME simplifications help you.

  • More time to implement high‑cost, technical compliance measures.

  • Possibility to use proportionate documentation and reduced administrative burdens where the risk profile and size justify it.

Use the AI Pact as a resource. It provides events, templates and voluntary pledge mechanisms to show early engagement with the rules. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-pact).

Practical checklist for an SME that buys or deploys AI

Use this checklist as an operational guide. It splits tasks by "Do now" and "Phase in before the deadlines."

ActionDo nowPhase in before high‑risk dates
Maintain an AI inventory with supplier contact and use caseX
Add clear AI disclosure on chatbots and customer‑facing systemsX
Assign an AI owner and a simple governance processX
Conduct a basic risk screening (is this high‑risk?)X
Gather user instructions and provider documentationX
Prepare technical documentation for high‑risk systemsX
Review contracts with suppliers for support on conformityX
Plan training to meet Article 4 literacy support dutiesXX

Notes on the table. "X" marks recommended timing. "Phase in before high‑risk dates" means before the applicable December 2027 / 2028 stagings described in the Commission material. See the AI Pact and the AI Act page for the detailed timeline. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-pact) [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai).

How enforcement works and what happens if you get it wrong

The European AI Office and national authorities have powers to enforce the Act. The AI Office can request information, carry out inspections, require corrective action and impose fines or restrictions. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-office).

What this means for you.

  • Keep records. Regulators will ask for documentation first. You should be able to show your AI inventory, risk screening and who is responsible internally.

  • Respond quickly to requests. The Commission can request information from providers and deployers. The Act gives those powers. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-office).

  • Transparency failures are visible. A missing disclosure on a chatbot is an obvious breach that is easy for complaint bodies or users to spot.

This is not legal advice. If a regulator engages with you, consider seeking professional legal support.

How much will compliance cost? Practical budgeting notes

Costs depend on risk level and complexity. A simple chatbot needs low investment. A high‑risk, decision‑making system needs more time and technical support.

Budget lines to expect.

  • Time to create and maintain an AI inventory. This can be done in‑house.

  • Legal and procurement review of supplier contracts for conformity support.

  • Technical documentation and testing for systems that will be classified as high‑risk.

  • Training and pocket guides to meet Article 4 literacy support duties.

Use the extra time to phase spend. The Commission set later dates to ease the transition for businesses. [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/ai-pact).

Quick, low‑cost actions you can take this week

  • Start an AI inventory. Note vendor, model name, purpose, users and data flows.

  • Add a short disclosure to any customer‑facing chatbot: "You are chatting with an AI".

  • Assign an internal owner who signs off new AI tool purchases.

  • Ask suppliers for their conformity documentation and any user instructions they provide.

These steps reduce immediate exposure. They also create the foundation for the heavier work you will do before the December 2027 and 2028 milestones.

Where to read the primary sources

For a focused primer on Annex III and the high‑risk categories, our note explains those groups and what they mean for deployers. /blog/comply/annex-iii-eu-ai-act-high-risk-categories

Final practical roadmap for the next 12 months

  1. Inventory and owner. Create the AI register and name the internal owner.

  2. Quick transparency fixes. Update chatbots and customer interfaces with clear disclosures now.

  3. Supplier ask list. Request provider documentation, conformity claims and user instructions.

  4. Risk screening. Classify current systems as minimal, limited or high risk.

  5. Plan for high‑risk. If any system may be high risk, budget for technical documentation and conformity steps ahead of the 2027/2028 phase‑ins.

  6. Record your literacy support. Keep short evidence of staff briefings and user guides, aligned with the Article 4 support duty.

These steps are practical. They keep you compliant with immediate duties and ready for the phased requirements.

If you want a short, step‑by‑step inventory template that takes 30 minutes to complete, see our quick start. /blog/comply/eu-ai-act-ai-system-inventory-30-minutes

Take action now. The Act gives you time for the heavier technical work. It does not remove the need for basic disclosure, inventory and governance.

Take the free EU AI Act check

Sources

  1. AI Pact | Shaping Europe’s digital future
  2. AI Act | Shaping Europe’s digital future
  3. EU AI Act: first regulation on artificial intelligence | Topics | European Parliament
  4. European AI Office | Shaping Europe’s digital future

Not sure where your company stands?

Answer 15 questions about how your team uses AI. You get a compliance score and the gaps to close first, as a PDF.

Am I compliant? Check in 2 minHow Khairos Comply works