The short answer
For an ordinary small or medium business that uses AI and does not offer a high-risk system, one obligation mainly applies: AI literacy, since 2 February 2025. Everyone working with AI has to know what it can do and where it goes wrong. The big deadline for high-risk systems moved with the Digital Omnibus from 2 August 2026 to 2 December 2027.
What changed in July 2026
Many pages still name 2 August 2026 as the big deadline. That is no longer correct. The Digital Omnibus, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026. It moves the obligations for stand-alone high-risk systems under Annex III to 2 December 2027, and those for AI in regulated products under Annex I to 2 August 2028.
What was not postponed: the prohibited practices and the AI literacy duty from February 2025, and the rules for general purpose models from August 2025.
The timeline
| Date | What | Affects you if |
|---|---|---|
| 2 February 2025 | Prohibited AI practices and the AI literacy duty | You use AI. This applies today, to almost everyone |
| 2 August 2025 | Rules for general purpose models | You offer a model yourself. Most small businesses do not |
| 2 August 2026 | Transparency obligations | You let people talk to AI or publish AI-generated content |
| 2 December 2027 | High-risk systems under Annex III | You use AI for recruitment, credit scoring or similar |
| 2 August 2028 | High risk in regulated products under Annex I | You build AI into machinery or medical devices |
AI literacy: the obligation that already applies
Article 4 requires that everyone working with AI inside your organisation has sufficient knowledge of what the system can do and where it goes wrong. There is no certificate attached and no mandatory number of hours. What there has to be is something demonstrable: who was trained, on what, and when.
In practice that is a short session per team, a work instruction next to the work itself, and a list of who attended when. That is not a large project. It is the first thing a supervisor asks about. See AI training for your team.
What a small business sensibly does today
- Write down which AI systems you use and what for. That takes an hour and you need it for everything afterwards.
- Arrange AI literacy and record who was brought up to speed and on what.
- Check whether one of your applications falls under Annex III, for example in recruitment. If so, you have until December 2027.
- Make sure people can tell when they are talking to AI instead of to an employee.
- Record per workflow who approves and when it stops. That is not an AI Act requirement, but it is what you need the moment someone asks how you control it.
This is a practical summary and not legal advice. If classification is in doubt, a lawyer should look at it.
Frequently asked questions
Does the AI Act apply to small companies as well?
Yes, but what applies depends on what you do. If you use ordinary AI tools for office work, the AI literacy duty is the obligation that affects you. High-risk rules only apply to specific uses.
Has the 2 August 2026 deadline lapsed?
For high-risk systems it moved to 2 December 2027 through the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. The transparency obligations and the earlier phases remain.
What exactly is AI literacy?
The requirement that everyone working with AI inside your organisation has sufficient knowledge of the possibilities and the risks. There is no mandatory certificate, but you must be able to show you arranged it.
Do I become high-risk if I use AI for my administration?
Almost never. Administrative preparation falls outside Annex III. Recruitment, credit scoring and comparable decisions about people do fall under it.
