In short

The AI Act delay is not a free pass. Regulation (EU) 2026/1744 moved only the obligations on high-risk systems, to 2 December 2027 and 2 August 2028. Staff AI literacy, transparency on generated content, prohibitions and penalties stay on their original dates, and from 2 August 2026 national authorities can run checks. For an SME the point is not having a register: it is knowing who is accountable for the AI you use every day.

Key points

  • The Digital Omnibus delayed only high-risk systems: Annex III to 2 December 2027, Annex I to 2 August 2028.
  • The AI literacy obligation (art. 4) has applied since 2 February 2025, and from 2 August 2026 there are authorities that can check it.
  • The Omnibus softened the wording: no longer measures to ensure staff competence, but measures to support its development. The obligation stays.
  • From 2 August 2026 the transparency rules of art. 50 apply: whoever publishes deepfakes or AI-generated texts of public interest without human review must disclose it, and whoever provides a chatbot must make clear it is an AI.
  • A tools register and a policy are documents. Governance is deciding who applies them, who keeps them up to date and who answers for them.

For a few weeks now, a comfortable line has been going around: “the AI Act has been delayed”. It is half true. And the wrong half is the one that concerns your company.

If you use ChatGPT, Copilot or a chatbot on your website, you are not developing a high-risk system. You are what the regulation calls a deployer: you use AI for work. And the obligations of those who use AI have not been delayed.

What actually slipped

The Digital Omnibus, published as Regulation (EU) 2026/1744 and in force from 27 July 2026, moved one thing only: the rules on high-risk systems.

Annex III (staff selection, credit, education, biometrics) moves from 2 August 2026 to 2 December 2027. Annex I (AI built into regulated products, such as medical devices or toys) moves to 2 August 2028.

The stated reason is to give standards and support tools time to arrive. It is not an amnesty.

What stays as it is

These stay on their original dates:

  1. Staff AI literacy (art. 4), in force since 2 February 2025.
  2. Prohibitions on banned practices, with a new ban on AI-generated non-consensual sexual content from 2 December 2026.
  3. Transparency (art. 50, from 2 August 2026): AI-generated deepfakes and public-interest texts, without human review, must be disclosed. Whoever provides a chatbot must make clear it is an AI.
  4. Supervision and penalties: from 2 August 2026 national authorities are operational and can check obligations that have applied since 2025 as well.

A nuance on AI literacy

The Omnibus softened the wording of art. 4: no longer “measures to ensure” a sufficient level of competence, but measures “aimed at supporting its development”. The text is less rigid. The duty to do something documentable on training is still there.

The delay removed a deadline for providers of high-risk systems. For those who use AI every day, it removed nothing.

The point the delay does not solve: a register is not governance

Many SMEs will answer this scenario in the quickest way: an AI tools register, a downloaded policy, a one-off course. All useful documents. None of the three says who decides.

The day after you fill in the register, questions remain that no sheet of paper answers:

  • Who approves a new tool before the team uses it?
  • Who updates the register when sales switches on a new plugin?
  • Who validates an output before it reaches a client?
  • Who answers to the owner if something goes wrong?

If the answer is “it depends” or “nobody”, you have documentation. You do not have a system. We cover this also in the operational checklist on AI policy and in the case of shadow AI.

Common mistakes after the delay

  • Putting everything off to December 2027 because “the AI Act has slipped”.
  • Confusing “I am not high-risk” with “I have no obligations”.
  • Running training once and filing the certificate.
  • Handing AI to a supplier and forgetting that the use remains the company’s.

What to do this week

  1. List the AI tools your team really uses, not the ones approved on paper: the method is in the AI tools register.
  2. Mark where AI speaks or produces content towards the outside (chatbot, texts, images): transparency may apply there, to you or to your supplier.
  3. Give a name and surname to whoever answers for AI in the company.
  4. Put a short, repeatable training session in the calendar, with a record of who attended.

If you want to know where you stand, start from the SME diagnostic. To work out how to build the system, there is the For Companies path. The overall picture is in the article on the EU AI Act for SMEs.

Frequently asked questions

Does the AI Act delay also cover SMEs that only use ChatGPT or Copilot?

No, at least not for the part that matters most to them. The delay concerns the obligations on high-risk systems. Staff AI literacy, transparency, prohibitions and penalties stay on their original dates.

What does the AI Act ask of an SME that uses AI but does not develop it?

A business that uses AI for professional purposes (a deployer) must support an adequate level of AI literacy among its staff, meet the transparency obligations on generated content (deepfakes and public-interest texts not reviewed by a person), and avoid prohibited practices.

Do I need an AI tools register for the AI Act?

It is not an obligation on its own. But knowing which tools you use is the starting point for meeting the obligations that already apply, such as staff AI literacy. A one-page register can be built in a week.

Who carries out checks in Italy?

Law 132/2025 (the Italian AI law) designates the national authorities: according to the Up2You summary, ACN (the National Cybersecurity Agency) supervises and sanctions, and AgID (the Agency for Digital Italy) notifies and accredits. Always check the updated text before deciding.

Sources

  1. European Commission - AI Act, regulatory framework and timeline (Omnibus in force from 27 July 2026)
  2. Il Sole 24 ORE - AI Act: supervision and transparency obligations in force from 2 August (28 July 2026)
  3. AI Act Service Desk - Implementation timeline
  4. Up2You - AI Act: what it says and obligations for companies (10 September 2026)

Last updated:

Related articles

AI policy for SMEs: the 7 controls to write, with examples on data, human review, roles and metrics The 7 controls of an AI policy for SMEs: allowed data, human review, responsibility, tracking, bans, metrics and processes. Before you sign an AI proposal: the questions to ask, from the side of whoever pays Got an AI proposal and nothing to compare it with? Ask about a similar case, size, how to explain the spend, and what stays after the contract. AI tools register for an SME: a five-column table you can build in a week, with no blame An AI tools register is a one-page table: tool, who uses it, for what, with which data, who approves it. Here is how to build it in a week.

Next Step

Reading is not enough if the system stays the same.

If this article touches a real source of friction, the useful next step is not consuming more content. It is understanding where you are losing time, control or margin today.

Take the SME diagnostic → See the For Companies path →