EU Digital Omnibus 2026: What SMEs need to know
4 min read
The AI part of the Digital Omnibus has been in force since 27 July 2026 and postpones key obligations for high-risk AI. Other AI Act rules already apply, including transparency obligations for certain AI applications. The second part of the digital package, covering data protection and cybersecurity, is still under discussion. For SMEs, the priority is to understand their own applications and their role as providers or deployers.
Key points at a glance
- The AI Omnibus has been adopted. Key high-risk obligations apply from 2 December 2027 or 2 August 2028, depending on the legal category.
- Some AI rules already apply. These include certain transparency obligations in force since 2 August 2026. A limited transitional period applies to a technical marking obligation.
- The rest of the Digital Omnibus follows a separate legislative procedure. The Council adopted its position on data protection, privacy and cyber reporting in October 2026.
Two proposals at different stages
What is the Digital Omnibus? The EU digital package contains two legislative proposals intended to simplify existing digital rules. One amends the AI Act. The other concerns data protection, privacy and cybersecurity, among other areas.
The AI Omnibus has been in force as Regulation (EU) 2026/1744 since 27 July 2026. The AI Act itself entered into force in 2024 and is being applied in stages. The changes concern deadlines and measures to ease requirements for smaller businesses, among other matters.
For the second proposal, the Council set out its negotiating position on 21 October 2026. It intends to negotiate with Parliament once Parliament has adopted its position. The final changes to this part have yet to be determined.
Which deadlines apply to high-risk AI
The key requirements for high-risk systems under Annex III of the AI Act apply from 2 December 2027. Depending on their specific use, these can include systems used for recruitment. For high-risk AI under Article 6(1) in certain regulated products covered by Annex I, the corresponding requirements apply from 2 August 2028.
Classification depends on the intended purpose and the legal conditions. An AI tool is therefore not high-risk solely because it is used in customer service or within a business. Special transitional rules may also apply to systems placed on the market or put into service before the relevant application date. Businesses should assess each case individually.
Which transparency obligations already apply
Transparency obligations for certain AI systems have applied since 2 August 2026. These include, for example, informing people that they are interacting with AI where the legal conditions require it. Labelling obligations apply to certain artificially generated or manipulated content.
A limited transitional period applies to providers of systems placed on the market before 2 August 2026: they must comply with the requirements for machine-readable marking and detectability under Article 50(2) from 2 December 2026. The European Commission explains which obligation is covered by this exception.
What businesses should assess now
An inventory of AI applications in use provides a basis for assessment. Businesses can use it to record the intended purpose, the provider and their own role. They should pay particular attention to applications used in personnel decisions or incorporated into regulated products, for example.
For each use, businesses can then establish which obligations already apply and which will apply later. For purchased systems, provider information on intended use and transparency features can help. Businesses that develop AI systems themselves or offer them under their own name should also assess the obligations placed on providers.
Frequently asked questions
Has the Digital Omnibus already been adopted?
The AI Omnibus has been in force since July 2026. The second part of the digital package, covering other digital rules, is still going through the legislative process.
Do the high-risk deadlines apply to every chatbot?
No. Whether a system is classified as high-risk depends on its intended purpose and the legal criteria. A chatbot may nevertheless be subject to transparency obligations.
Does the AI Omnibus remove all existing obligations?
No. Parts of the AI Act already apply. The postponement particularly affects the key requirements for certain high-risk systems.
Read more on MyBusinessFuture
MyBusinessFutureEU AI Act from August: What SME tech teams need to clarifyMyBusinessFutureCSRD Omnibus for SMEsMyBusinessFutureSME Digital Hubs Overhaul by 2026: What’s Next for Funding?More from the MBF Media Network
Digital ChiefsFrom pilot to production: Three questions for CIOs before a GenAI rolloutcloudmagazinAI inference architecture for the DACH region in 2026Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
