The short answer
For an ordinary small or medium business that uses AI and does not offer a high-risk system, one obligation mainly applies: AI literacy. That duty has applied since 2 February 2025 and was softened on 27 July 2026: you take measures to support the AI literacy of your people, but you do not have to guarantee a specific level of knowledge per person. The big deadline for high-risk systems moved with the Digital Omnibus from 2 August 2026 to 2 December 2027.
What changed in July 2026
Many pages still name 2 August 2026 as the deadline for high-risk systems. That is no longer correct. 2 August 2026 does remain the general start date, including for the transparency rules. The Digital Omnibus, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026. It moves the obligations for stand-alone high-risk systems under Annex III to 2 December 2027, and those for AI in regulated products under Annex I to 2 August 2028.
What was not postponed: the prohibited practices from February 2025 and the rules for general purpose models from August 2025. The AI literacy duty was not postponed either, but it was softened. What it says now is below.
The timeline
| Date | What | Affects you if |
|---|---|---|
| 2 February 2025 | Prohibited AI practices and the AI literacy duty, lighter since 27 July 2026 | You use AI. This applies today, to almost everyone |
| 2 August 2025 | Rules for general purpose models | You offer a model yourself. Most small businesses do not |
| 2 August 2026 | Transparency obligations (marking of AI content by systems already on the market before that date: by 2 December 2026 at the latest) | You let people talk to AI or publish AI-generated content |
| 2 December 2027 | High-risk systems under Annex III | You use AI for recruitment, credit scoring or similar |
| 2 August 2028 | High risk in regulated products under Annex I | You build AI into machinery or medical devices |
AI literacy: the obligation that already applies
The Digital Omnibus rewrote Article 4. Since 27 July 2026 it says that providers and deployers of AI systems take measures to support the development of AI literacy of their staff. If you use AI in your business, you are a deployer. You take into account the knowledge, experience and training of your people and what they use the AI for.
The new text of Article 4 states explicitly that you do not have to guarantee any specific level of AI literacy of any individual (Regulation (EU) 2026/1744, Article 1, point 5). The old text still asked for a sufficient level. There is no certificate attached and no mandatory number of hours.
In practice that is a short session per team, a work instruction next to the work itself, and a list of who attended when. That is how you show you take measures. It is not a large project. See AI training for your team.
What a small business sensibly does today
- Write down which AI systems you use and what for. That takes an hour and you need it for everything afterwards.
- Take measures for AI literacy, such as a short training, and record who was brought up to speed and on what. That is how you show you take them.
- Check whether one of your applications falls under Annex III, for example in recruitment. If so, you have until December 2027.
- Make sure people can tell when they are talking to AI instead of to an employee.
- Record per workflow who approves and when it stops. That is not an AI Act requirement, but it is what you need the moment someone asks how you control it.
This is a practical summary and not legal advice. If classification is in doubt, a lawyer should look at it.
Frequently asked questions
Does the AI Act apply to small companies as well?
Yes, but what applies depends on what you do. If you use ordinary AI tools for office work, the AI literacy duty is the obligation that affects you: taking measures that support your people's AI knowledge. High-risk rules only apply to specific uses.
Has the 2 August 2026 deadline lapsed?
For high-risk systems it moved to 2 December 2027 through the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. The transparency obligations and the earlier phases remain.
What exactly is AI literacy?
Knowing what AI can do, what it cannot do and where it goes wrong, matched to the work someone does with it. Since 27 July 2026 Article 4 asks you to take measures that support this in your people. You do not have to guarantee a specific level per person and there is no mandatory certificate. Do record what you did, so you can show you take measures.
Has the AI literacy duty been postponed?
No. It has applied since 2 February 2025. The Digital Omnibus did soften it on 27 July 2026: you take measures to support the AI literacy of your people, but the law no longer asks that every employee reaches a specific level.
Do I become high-risk if I use AI for my administration?
Almost never. Administrative preparation falls outside Annex III. Recruitment, credit scoring and comparable decisions about people do fall under it.
About the author
I am Joost, AI specialist and founder of Tamboer AI. I have worked with AI daily since 2022. I tested and developed applications at one of the largest banks in the Netherlands and now build AI workflows for smaller businesses, with a person who checks every outcome. More about me.
