What Changed in 2026: The Digital Omnibus and EU AI Act Enforcement

Updated 7 Oct 2026: Digital Omnibus on AI (Regulation (EU) 2026/1744).

What changed in 2026

EU AI Act enforcement looks different from what this post described when it was first published. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It rewrote Article 4, moved the high-risk deadlines, added two new prohibitions and changed some of the fine rules. Days later, on 2 August 2026, the AI Act began to apply in general, and national market surveillance authorities supervise it from that date. If your company uses AI in hiring, performance management, credit scoring, or customer-facing decisions, the clock is running, just not always on the dates you were told.

The new timeline

The Regulation entered into force on 1 August 2024 and applies in stages. After the Omnibus, the calendar looks like this:

2 February 2025: Article 5 prohibitions and the Article 4 AI literacy duty apply.
2 August 2025: General-purpose AI obligations apply.
27 July 2026: The new wording of Article 4 applies.
2 August 2026: The Act applies in general, including the Article 50 transparency rules. National authorities supervise from this date.
2 December 2026: Two new prohibitions apply, and the Article 50(2) grace period ends (see below).
2 December 2027: Main obligations for high-risk AI systems under Annex III apply. Until the Omnibus, this date was 2 August 2026.
2 August 2028: Obligations for high-risk AI in regulated products (Annex I) apply.

For most HR Directors and COOs, the date to circle has moved from August 2026 to December 2027. That is a reprieve for the high-risk rules, not for everything else.

Article 4: the obligation that surprises people

Article 4 of the AI Act has applied since 2 February 2025, and the Omnibus did not delay it. It changed what it asks. Until July 2026, the text required providers and deployers to "ensure, to their best extent, a sufficient level of AI literacy". Since 27 July 2026, they "shall take measures to support the development of AI literacy" of their staff and others operating AI on their behalf, and the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". The Commission and Member States must now also support providers and deployers, in particular SMEs.

This is not about training data scientists. The HR manager using an AI shortlisting tool and the line manager receiving AI-generated performance scores need support to understand what the system does, how it can fail, and when to override it. Article 4 sets no minimum training hours or certification standard, but you still have to take real measures. Regulators will ask: what did you do, when, and for whom?

There is no Article 4 deadline ahead. According to the Commission's AI Literacy Q&A, national market surveillance authorities supervise and enforce it from 2 August 2026. For most SMEs, this is still the lowest-hanging fruit in terms of compliance.

The high-risk category you probably already meet

Annex III of the AI Act lists the AI use cases classified as high-risk. Point 4 is the one most relevant to companies with 20 to 200 employees:

AI systems used for recruitment or selection of natural persons, notably for advertising vacancies, screening or filtering applications, evaluating candidates in the course of interviews or tests.

If you use any tool that scores CVs, ranks candidates, or analyses video interviews, you are operating a high-risk AI system. Its obligations include conformity assessments, technical documentation, logging of system outputs, and the transparency disclosures required under Article 13. The vendor may be the provider, but you, as the deployer, still have obligations under Articles 26 and 27, which now apply from 2 December 2027.

Article 50 transparency and its one grace period

Article 50's transparency rules, such as telling people they are talking to a chatbot, have applied since 2 August 2026. The Omnibus added one narrow grace period: providers of AI systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) marking duty. Nothing else in Article 50 got extra time.

Two new prohibitions from 2 December 2026

Article 5 has banned certain AI practices since 2 February 2025. From 2 December 2026 the Omnibus adds two more: AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts or sexual activity without their explicit consent, and AI systems that generate child sexual abuse material.

Fines: what changed and what did not

Article 99 of the AI Act keeps the same maximum amounts:

Prohibited AI practices: up to €35 million or 7% of global annual turnover, whichever is higher.
Listed operator obligations (Articles 16, 22, 23, 24, 26, 31, 33, 34 and 50, and now Article 25(2) and (4)): up to €15 million or 3% of global annual turnover.
Supplying incorrect or misleading information to authorities: up to €7.5 million or 1% of global annual turnover.

SMEs, including start-ups, face the lower of the two figures. New since the Omnibus: small mid-cap enterprises also get the lower figure, but only for the €15 million and €7.5 million tiers, not for prohibited practices. For an SME or small mid-cap with €20 million in revenue, 3% still means €600,000. The GDPR enforcement record shows that regulators do fine SMEs, not just multinationals.

The Act sets no fine specifically for Article 4. But the amended Article 99(1) lets Member States lay down penalties, "which may also include administrative fines, warnings and non-monetary measures, applicable to any infringement".

Who enforces this in the Netherlands

In the Netherlands, supervision runs through existing regulators by sector (see the Commission's list of national AI authorities). The Autoriteit Persoonsgegevens (AP), already the country's coordinating supervisor for algorithms, is central for AI that processes personal data, which covers most HR tools. The AP has handed out GDPR fines exceeding €750,000 against Dutch organisations. Expect the same pattern here: early investigations, a public example or two, then settled enforcement activity.

What an SME should do now: a 90-day checklist

Ninety days gives you a defensible position on the duties that already apply, and a head start on the high-risk rules.

Week 1 to 4: Map your AI systems and your role. List every tool your company uses that automates or significantly influences a decision about a person, including ATS platforms, performance management software, scheduling tools, and customer service chatbots. Classify each one against Annex III, and note whether you are the provider or (as most SMEs are) the deployer.

Week 5 to 6: Request documentation from vendors. Ask for instructions for use and technical documentation in writing, and ask how they handle Article 50. If a vendor cannot provide it, that is a compliance risk sitting in your supply chain.

Week 7 to 8: Run your AI literacy measures. Identify every staff member who works with an AI system. Deliver a short, documented session covering what the system does, its known limitations, and the process for human review. Keep attendance records.

Week 9 to 10: Check your transparency notices. Article 50 disclosures, such as telling people they are talking to a chatbot, already apply. If you use AI in hiring or performance management, prepare plain-language disclosures for candidates and employees too.

Week 11 to 12: Plan for December 2027. For each high-risk system, document a human oversight procedure and assign a named responsible person. Article 14 requires that high-risk AI systems be designed and used so that humans can effectively oversee them.

Final two weeks: Internal review and gap log. Document what you have done, what gaps remain, and your plan to close them.

The one thing most companies skip

Most SMEs focus on the AI tools themselves and forget about internal governance. Appointing a named compliance lead for AI, even if that person is also the COO or HR Director, creates accountability. Without a named owner, documentation stalls, training gets deprioritised, and vendor follow-up falls through the gaps.

The dates have moved, but supervision has started. Start the mapping exercise this week, request vendor documentation by the end of the month, and deliver your first AI literacy session now.

Not sure where your company stands? Run the free 2-minute compliance check at comply.khairos.ai to get a prioritised list of actions based on the AI tools you actually use.