Few regulations in recent years have raised as many questions as the European AI Regulation. In summer 2026, another was added: with an amending regulation, drawn up as part of the so-called digital omnibus, the EU postponed key deadlines. The amendment was published in the Official Journal at the end of July 2026 and entered into force shortly before the original cut-off date of 2 August 2026. This article explains what has changed and what has not.
The timetable at a glance
The AI Act entered into force on 1 August 2024 and has applied in stages since then. After the amendment, the timetable looks like this:
| Since / from | What applies |
|---|---|
| 2 February 2025 | Prohibition of certain AI practices, AI literacy obligation |
| 2 August 2025 | Rules for general-purpose AI models, governance, penalties |
| 2 August 2026 | General application, including transparency obligations for certain AI systems |
| Early December 2026 | End of a short transition period for machine-readable marking of generative systems already offered before August 2026 |
| 2 December 2027 | Obligations for stand-alone high-risk systems under Annex III |
| 2 August 2028 | Obligations for high-risk AI in products already subject to EU product legislation under Annex I |
Originally, the high-risk obligations under Annex III were to apply from August 2026 and those under Annex I from August 2027. The main reason given for the postponement was that harmonised standards and guidelines on which companies are meant to rely were not ready in time.
What else the amendment brings
- AI literacy reworded. The obligation remains but is worded differently. Providers and deployers must take measures to promote the AI literacy of their staff. They no longer have to guarantee a particular level. You should still be able to evidence the measures, for example with training records and usage rules.
- Relief for smaller companies. Simplifications previously reserved for small and medium-sized enterprises, for example regarding technical documentation and quality management, now also apply to small mid-cap companies that have outgrown the SME thresholds.
Who has to do what
The regulation distinguishes mainly between two roles. Providers develop an AI system or have it developed and place it on the market under their own name. Deployers use an AI system under their own authority. Most companies are deployers; many software companies are both.
For deployers, two things already apply today regardless of the risk category: AI literacy measures and transparency in certain cases, for example when content is generated that appears authentic. If high-risk systems are used, for example in recruitment or creditworthiness assessments, further obligations follow from December 2027, including human oversight, logging and informing the people affected.
Providers of high-risk systems face considerably more: risk management throughout the life cycle, requirements for training data, technical documentation, a quality management system, conformity assessment and registration. Experience shows that building this takes more than a year. The time gained is therefore quickly used up.
Supervision in Germany
Under the German act implementing the AI Regulation, passed by the Bundestag and Bundesrat in summer 2026, the Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority. Sector supervisors such as the Federal Financial Supervisory Authority (BaFin) in the financial sector retain responsibilities in their areas. The European Commission’s AI Office remains responsible for general-purpose AI models.
Five steps for the coming months
- Create an AI inventory. Which systems do you use or offer, for what purpose and with which data?
- Determine role and risk category. For each system: provider or deployer; prohibited practice, high risk, transparency obligation or minimal risk. Record the reasoning.
- Evidence AI literacy. Training and usage rules appropriate to the task and the system, with evidence.
- Check transparency. Where do your systems generate content or interact with people? Are notices and marking in place?
- Plan high-risk projects. Work backwards from December 2027 or August 2028 and set milestones. A management system under ISO/IEC 42001 can provide the framework for this.
What this means for you
The postponement only affects the high-risk obligations. Prohibitions, AI literacy and transparency already apply and affect almost every company. Use the extra time to set up your inventory and classification properly. If you provide high-risk systems, start on risk management and documentation now. If in doubt, check the exact dates and transitional rules in the current text of the regulation.
In Sightadel, you keep the AI inventory, document classifications with their reasoning and attach evidence on literacy and transparency. More on the EU AI Act and ISO/IEC 42001 pages. Try it yourself: Try free for 14 days.
As of: 8 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
