Home · Insights · Commentary
The EU AI Act now: what a small business must do after the 2026 changes
The AI Act's dates moved in July 2026, which has led some owners to assume it no longer matters. It does. Here is what changed, what did not, and the short list a small business should work through.
What changed in July 2026
The EU AI Act was passed in 2024, and its dates have since moved. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026. It amends the original Act. We explain the Act itself in the EU AI Act in plain English. This post covers only what moved and what a small business should do about it. We are not lawyers, and this is not legal advice.
| What | Before | Now |
|---|---|---|
| High-risk systems listed in Annex III (for example some uses in hiring, credit, education) | Applied from 2 August 2026 | Delayed to 2 December 2027 |
| High-risk AI built into regulated products (Annex I) | 2 August 2027 | 2 August 2028 |
| AI literacy duty (Article 4) | Ensure, to the best extent, a sufficient level of literacy | Take measures to support the development of AI literacy |
| Transparency duties (Article 50), including telling people they are talking to AI | Scheduled for 2 August 2026 | Still 2 August 2026 for the duty to tell people they are dealing with AI. A transitional date of 2 December 2026 applies to machine-readable marking of synthetic content from systems already on the market |
The transparency rules are more nuanced than one row can show. Read the summary of the omnibus on euaiact.com, which checks its text against EUR-Lex, and the official text itself before you rely on a date.
What a small business should do now
- Tell people when they are talking to an AI. If you run a chatbot or an AI voice line, say so clearly at the start. It costs nothing and the duty to tell people they are dealing with AI was not moved.
- List the AI you use. A one-page list: the tool, what it is used for, what data goes in. This is the foundation for everything else and takes an hour.
- Check you are not in a high-risk use. The Annex III list covers areas like recruitment, credit and education. If you use AI to screen job applicants or decide who gets a service, you are closer to the line than most.
- Keep your team informed. The literacy duty is softer than it was, but people who use AI at work should know what it is for and what not to paste into it.
- Check your data position separately. The GDPR is a different law and did not change. See data privacy and AI for a European business.
What not to do
Do not read a delay as a cancellation. The dates moved; the obligations did not disappear. And do not buy a compliance product on the strength of a fear. For a small business using ordinary tools on ordinary tasks, the work is a short list, some plain wording on your website, and keeping it current.
As part of our work on AI compliance questions for Mallorca businesses we build that list with the owner and leave it somewhere they can update.
Sources, checked 9 October 2026
- euaiact.com, Digital Omnibus on AI: Regulation (EU) 2026/1744, in force 27 July 2026.