EU AI Act changes complicate compliance efforts

On 2 August 2026, the long-anticipated Artificial Intelligence Act (AI Act) will officially come into effect under Article 113, but businesses face an unexpected hurdle due to changes made just nine days prior. On 24 July, the Official Journal published Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, which took effect on 27 July. Companies that had been preparing for one set of obligations now have less than two weeks to adapt to a revised regulatory landscape.

Adam White, founder of ComplianceSME, emphasises the need for clear compliance pathways, stating that “ComplianceSME builds the compliance systems that answer that question." Each system is designed to assist businesses by covering individual instruments, registering obligations, and guiding personnel through regulatory requirements. The systems also feature a training file that educates staff about the AI Act, enabling them to understand their obligations without prior expertise.

The recent omnibus introduces significant changes, primarily delaying the deadlines for high-risk AI systems. These systems, which affect critical areas such as employment and education, have shifted from a 2 August 2026 compliance date to a new deadline of 2 December 2027. Yet, not all provisions have seen a delay. Transparency duties outlined in Article 50 still kick in on the original date, particularly affecting systems that generate content or interact with individuals.

In terms of updating the legal framework, the omnibus tightens the definition of a safety component in Article 3. This change means that systems designed merely for user assistance or service optimisation are not automatically classified as high-risk based solely on their incorporation into regulated products. The law also eases compliance burdens for small and mid-cap enterprises, which now enjoy some relief previously meant for smaller outfits.

However, the omnibus brings new restrictions. Article 5 outlines the banned practices of the AI Act, which includes two new prohibitions on generating or manipulating intimate images of identifiable individuals and child sexual abuse material without explicit consent. While these measures are detailed, businesses may overlook the specifics surrounding their implementation, particularly since they come into force on 2 December 2026.

A notable alteration is in Article 4, where the requirement for AI literacy among staff has been modified. The previous stringent mandate is now replaced with a duty to support the development of AI literacy. This softening of compliance duties may create confusion at a time when the landscape is becoming more complex.

The changes in the Act are likely to have a more significant impact on SMEs. In contrast to larger companies that have the resources to navigate compliance complexities, small and medium-sized enterprises face considerable challenges. Many may not have access to legal expertise, making the task of determining their obligations and adjusting to new requirements daunting.

ComplianceSME responds to this issue by offering a free assessment to businesses that helps determine their legal obligations, allowing them to focus on what truly affects them rather than wading through excessive regulations. The aim is to streamline the process, especially in the face of regulatory changes that can significantly impact operations.

White concludes that the quick succession of changes illustrates the urgency of maintaining compliance amidst evolving regulations: "The AI Act applies from Sunday. The rules governing it changed on Monday." This presents a steep learning curve for many businesses, which should not require the involvement of extensive legal resources to interpret.