EU AI Act Obligations and Dates After the Digital Omnibus

Providers placing AI systems on the EU market wherever they are established, deployers located in the EU, and providers and deployers in third countries where the system's output is used in the EU. Most regulated firms are deployers: they license a system and put it to work. A firm that substantially modifies a system or markets it under its own name can take on provider obligations.

Annex III names the uses treated as high-risk. Point 5(b) covers AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud. Point 5(c) covers risk assessment and pricing in relation to natural persons in life and health insurance. Point 4 covers recruitment, selection, promotion, termination, task allocation, and performance monitoring.

• Article 5, the prohibited practices. The Omnibus added a prohibition on AI systems that generate non-consensual intimate imagery and child sexual abuse material, which applies from 2 December 2026.
• Article 4, AI literacy. As amended by the Omnibus, providers and deployers take measures to support the development of AI literacy among their staff and the people operating AI on their behalf; the original wording required a sufficient level of literacy.

• Chapter V, the obligations on providers of general-purpose AI models (Article 53 among them), together with the governance chapter and the penalties chapter.
• Article 99 sets the fine ceilings: up to EUR 35 million or 7% of total worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other infringements, whichever is higher in each case.

2 August 2026 is the Act's general application date, and the Omnibus kept it. Article 50 applies from that date: providers of systems that interact directly with natural persons must ensure those persons are informed they are interacting with an AI system (Article 50(1)); providers of systems generating synthetic audio, image, video, or text must mark outputs in a machine-readable format and make them detectable as artificially generated (Article 50(2)); deployers of systems that generate deep fakes must disclose that the content was artificially generated or manipulated (Article 50(4)).

One transitional rule: systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2).

Before the Omnibus, the obligations for Annex III high-risk systems applied from 2 August 2026, and those for high-risk systems embedded in products covered by the Union harmonisation legislation in Annex I from 2 August 2027. The Omnibus moved them to 2 December 2027 and 2 August 2028 respectively. For a deployer of a credit-scoring, insurance-pricing, or employment system, the duties arriving on 2 December 2027 are:

• Article 26(1): take appropriate technical and organisational measures to use the system in accordance with the provider's instructions for use.
• Article 26(2): assign human oversight to natural persons who have the necessary competence, training, authority, and support.
• Article 26(5): monitor the system's operation on the basis of the instructions for use, inform the provider of risks identified, and report serious incidents to the provider and the market surveillance authorities.
• Article 26(6): keep the logs the system automatically generates, to the extent they are under the deployer's control, for a period appropriate to the intended purpose and of at least six months, unless Union or national law provides otherwise.
• Article 26(7): before putting a high-risk system into service at a workplace, inform workers' representatives and the affected workers.
• Article 27: carry out a fundamental rights impact assessment before first use. It applies to bodies governed by public law, private entities providing public services, and deployers of the Annex III point 5(b) and 5(c) systems, which is to say lenders and life and health insurers.
• Article 12 requires the system itself to technically allow the automatic recording of events over its lifetime; the provider builds it, and the deployer keeps what it produces.

• National AI regulatory sandboxes must be established by 2 August 2027.
• The provisions permitting the processing of special categories of personal data for bias detection and correction extend to all AI systems rather than only high-risk ones.