EU AI Act from August 2, 2026: What actually applies to a 20-person business (Update)

For weeks, the message has been circulating that as of August 2, 2026, strict AI obligations would apply to small and medium enterprises, including strict requirements for high-risk systems such as candidate pre-selection or creditworthiness checks. This is no longer true as of now. The EU Council confirmed a so-called Digital Omnibus Deal on June 29, 2026, which shifts these exact deadlines significantly. For a typical 20-person business, this changes substantially what actually has to be done on the deadline.

What actually takes effect on August 2, 2026

As of August 2, 2026, exclusively the transparency requirements from Article 50 of the EU AI Act take effect, not the stricter high-risk obligations from Annex III. Specifically, that means: whoever uses a chatbot, a voice agent, or AI-generated content must disclose that a person is communicating with an AI or that content was machine-generated. For systems already on the market at that time, a four-month transition period until December 2, 2026 additionally applies to the disclosure obligations under Article 50 paragraph 2, as the law firm Gibson Dunn sets out in their analysis of the final Omnibus agreement.

What the Digital Omnibus Deal shifted in the deadlines

The high-risk obligations from Annex III for standalone AI systems, such as for candidate pre-selection, creditworthiness checks, or in education, shift from originally August 2, 2026 to December 2, 2027. For AI embedded in regulated products, such as medical devices, machinery, or vehicles under Annex I, the deadline shifts from August 2, 2027 to August 2, 2028. Both new deadlines stem from the Digital Omnibus Deal: Following a preliminary political agreement in early May 2026, approval by the European Parliament on June 16, 2026, and final confirmation by the Council on June 29, 2026, the new deadlines are fixed, even though formal publication in the Official Journal is still pending. The original roadmap with the old deadline of August 2, 2026 for Annex III is documented by the AI Act Service Desk of the EU Commission.

What this means for your 20-person business

Anyone who does not use a high-risk application such as candidate pre-selection or credit scoring only needs to meet the transparency requirement by August 2, 2026, and has gained noticeably more time for everything else through the shift. Most automations in a 20-person business, from invoice processing to reporting to internal knowledge assistants, fall anyway into the minimal-risk category and are not affected by the shift at all because they never fell under Annex III. The transparency requirement becomes relevant especially where customers interact directly with an AI: in the chatbot on the website, in the voice agent on the phone, or in AI-generated marketing texts and images.

In our own projects, a short, clearly visible notice in the conversation or on the page usually suffices, for example: "You are speaking with an AI assistant from NordFlux." The technical effort is manageable, but the obligation itself is not negotiable.

How to practically categorize your AI use now

The categorization can be clarified in three steps without waiting for the formal Omnibus publication in the Official Journal.

• List all AI applications in your business, each with its purpose of use.
• Check for each application whether it makes or pre-makes decisions about people, such as in applications or creditworthiness. Only then is Annex III relevant; otherwise, it usually falls into the minimal-risk category.
• Check whether customers interact directly with the AI, for example in chat, on the phone, or through generated content. If so, the transparency notice must be in place by August 2, 2026.

Anyone uncertain about how to categorize their own application receives in our AI consulting a clear, written categorization by risk class, not just an oral assessment.

Update to our original article

This article updates our earlier article EU AI Act: Is my business affected?, which was created before the final confirmation of the Digital Omnibus Deal by the Council and could not yet mention the new shifts to December 2027 and August 2028. The assessment there that most automations are non-critical remains correct; we supplement the concrete new deadlines here.

Frequently asked questions

Must I label my chatbot from August 2, 2026?

Yes. Provided customers interact with a chatbot or voice agent, the transparency requirement from Article 50 applies from this date, regardless of the shift in high-risk obligations.

Does the shift also apply if I already use a high-risk application?

Yes. The new deadlines, December 2, 2027 for standalone systems under Annex III and August 2, 2028 for embedded systems under Annex I, apply regardless of when the application was introduced.

Where do the new deadlines come from?

They result from the Digital Omnibus Deal, which was finally confirmed by the EU Council on June 29, 2026, after approval by the European Parliament on June 16, 2026, documented in part by the law firm Gibson Dunn.

Do I still need a risk assessment for my AI applications?

Yes. A brief written overview remains useful because it shows that you are deliberately and controlledly managing your AI use, regardless of the exact deadline.