AI Act timeline after the Omnibus: what applies when

The AI Act, Regulation (EU) 2024/1689, applies in stages, and Regulation (EU) 2026/1744 moved two of them: high-risk obligations under Annex III to 2 December 2027 and those under Annex I to 2 August 2028. Everything else already applies.

The table shows each date with its reference in the consolidated text. For most companies using AI agents in their own processes, three rows matter today: AI literacy, transparency and, where a workflow decides about people, Annex III.

The Commission proposed the Digital Omnibus on AI on 19 November 2025 (COM(2025) 836). The European Parliament adopted it on 16 June 2026 and the Council on 29 June 2026. It was published on 24 July 2026 as Regulation (EU) 2026/1744 and has been in force since 27 July 2026.

The main change concerns the high-risk dates. Instead of 2 August 2026, Annex III now applies from 2 December 2027 and Annex I products from 2 August 2028, as fixed dates regardless of whether harmonised standards are available.

The amendment also brings relief for small and medium-sized enterprises and the newly defined small mid-caps: simplified technical documentation under Art. 11(1), quality management proportionate to company size under Art. 17(2), and lower fine caps under Art. 99(6a). Registration of systems that are not high-risk under Art. 6(3) remains, with fewer data fields.

For industrial companies, the new Art. 6(1a) matters most. AI systems used solely for non-safety purposes, such as user assistance, performance optimisation, service efficiency, automation, convenience or quality control, no longer qualify as safety components. Under paragraph 1b a system still counts as a safety component if its failure or malfunction would endanger health and safety.

The prohibited practices in Art. 5 have applied since 2 February 2025, including manipulative techniques causing significant harm, social scoring and emotion recognition at work. From 2 December 2026, two prohibitions are added: non-consensual intimate deepfakes and the generation of child sexual abuse material.

Annex III itself is unchanged. So are the exception in Art. 6(3) and the duty in Art. 6(4) to document that assessment before a system is placed on the market or put into service. The transparency duties of Art. 50 apply in substance as adopted.

Art. 4 remains a duty for companies. Providers and deployers must take measures to support the AI literacy of their staff and of the people working with AI systems on their behalf. The new wording makes clear that no specific level of literacy has to be guaranteed; the Commission and Member States are to support companies, especially small and medium-sized ones.

Neither Art. 99 nor the German KI-MIG sets a separate fine for Art. 4. It is still worth writing the measures down: who uses which tools, which training goes with them and who decides on questions. A company AI policy is the usual place for this.

Since 2 August 2026, providers must design systems that interact directly with people so that those people know they are dealing with AI, unless this is obvious. The information must be given at the latest at the first interaction (Art. 50(5)). A company that builds its own agent and puts it into service under its own name can be a provider for this purpose.

Under Art. 50(4), deployers must disclose that text is AI-generated when it is published to inform the public on matters of public interest. That does not apply if a person has reviewed the text editorially and holds responsibility for it. Individual customer replies, quotes or complaint decisions are not published to inform the public and fall outside this duty on its wording; how your specific case classifies stays with your compliance function.

A workflow with human release builds this in anyway: the agent drafts, a named person releases. It becomes critical where an agent communicates with customers without release. There, the AI notice belongs in the first message.

A workflow becomes high-risk if it falls into an Annex III area and no exception applies. For operational processes, five areas in the table matter most. An agent that drafts quotes, prepares complaints or checks delivery notes usually belongs to none of them.

Even within one of these areas, under Art. 6(3) a system is not high-risk if it only performs a narrow procedural task, improves the result of a completed human activity, detects patterns without replacing the human assessment absent proper review, or performs a preparatory task. The exception never applies where the system profiles natural persons. The Commission's classification guidelines were published as a draft for consultation in May 2026.

The AI Act check gives a first orientation for a specific workflow in a few minutes. The binding classification stays with your compliance function.

Fine caps are tiered, and for small and medium-sized enterprises the lower of the two amounts applies. For small mid-caps, the lower amount applies to breaches under Art. 99(4) and (5).

Germany's implementing act, the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG), has applied since 29 July 2026. The Bundesnetzagentur is the default market surveillance authority; BaFin covers AI directly linked to regulated financial services, and an independent AI market surveillance chamber covers certain Annex III areas such as biometrics and law enforcement.

The Bundesnetzagentur is also the central contact point. Its KI-Service-Desk offers a self-check called KI-Compliance-Kompass, FAQs and a factsheet for small and medium-sized enterprises. Section 15 KI-MIG adds fines of up to 50,000 euros for specific information duties.

The extra time is no reason to wait, because most obligations require material that is produced while a workflow runs. Five steps cover most companies that use AI agents; the glossary explains the terms.