EU AI Act 2026: What Companies Need to Know Now
Reading time:
minutes
Shortly before the next key deadline, the EU has once again amended the AI Act. The Digital Omnibus Regulation entered into force on July 27, 2026. It postpones key obligations for high-risk AI, simplifies certain requirements, and at the same time brings numerous requirements into effect as of August 2, 2026.
For decision-makers, this means more preparation time for certain high-risk systems, but it is not a general all-clear. Transparency obligations, clarification of roles, AI expertise, and the establishment of appropriate governance structures will remain relevant for companies as early as 2026.
What are the key changes in the EU AI Act of 2026?
The AI Act continues to follow a risk-based approach. Prohibited applications, high-risk AI, systems with specific transparency risks, and low-risk applications are subject to different requirements.
The first eight prohibitions on particularly problematic AI practices have been in effect since February 2, 2025. The Digital Omnibus added another prohibition: AI systems that generate non-consensual sexually explicit or intimate content, or depictions of child sexual abuse, will be prohibited as of December 2, 2026.
Rules for providers of general-purpose AI models have been in effect since August 2025.
Starting August 2, 2026, the transparency requirements under Article 50 of the AI Act will take effect. Providers of AI systems intended for direct interaction with natural persons must design the systems in such a way that affected individuals are generally informed that they are interacting with an AI.
Separate notification may be waived if the AI interaction is obvious to an average, reasonably informed, and attentive person, taking into account the context of use.
Providers of systems that generate synthetic audio, image, video, or text content must, as a general rule, label their output in a machine-readable format and make it recognizable as artificially generated or manipulated.
For systems placed on the market before August 2, 2026, a transition period until December 2, 2026, applies exclusively to this technical labeling and identifiability requirement. The remaining transparency requirements generally apply as of August 2, 2026.
In the case of deepfakes and certain AI-generated or manipulated publications on topics of public interest, additional visible disclosure obligations may apply to the publishing organization.
Which deadlines have been postponed?
The comprehensive requirements for high-risk autonomous AI systems under Annex III now apply as of December 2, 2027. Under certain conditions, these may include, for example, systems in the areas of human resources management, education, critical infrastructure, law enforcement, or biometric applications.
For AI systems deemed high-risk under Article 6(1), the requirements take effect on August 2, 2028. These include AI systems that are themselves a regulated product covered by Annex I or a safety component of such a product, provided that the product in question is subject to third-party conformity assessment.
This may apply, among other things, to machinery, elevators, toys, or certain medical devices. However, an AI function does not automatically become high-risk AI simply because it is integrated into a regulated product.
The postponement is intended to allow additional time for harmonized standards, guidelines, and better coordination with existing product and product safety legislation.
What else has been simplified?
Relief measures for small and medium-sized enterprises are being extended in some cases to so-called small mid-caps. In addition, access to regulatory real-world labs is being expanded and supplemented by an EU-wide AI real-world lab.
The requirement for AI competence has also been adjusted, but not eliminated. Providers and operators of AI systems must continue to take measures to support the development of AI competence among their staff and others acting on their behalf.
However, companies are not required to guarantee a uniform or specific level of competence for each individual. What measures are appropriate depends, among other things, on the systems used, the tasks of the employees, and the associated risks.
Further simplifications include, among other things, registration, documentation, and monitoring obligations, as well as the institutional powers of the European AI Office.
What Decisions Do Industrial Companies Need to Make Now?
Companies should not only evaluate individual, well-known AI tools but also build as comprehensive an AI inventory as possible. While such an inventory is not an explicit general requirement of the AI Act under that specific designation, it forms an important foundation for robust AI governance.
For each relevant application, at least the following information should be documented:
• Purpose and scope of use
• Vendor and model used
• Affected user groups
• Data used
• Potential risk class
• Role of the company itself
• Responsibilities and approval processes
• Existing transparency and control measures
Five measures in particular are a priority:
- Identify AI systems and embedded AI functions.
- Clarify the roles of suppliers, operators, importers, and, where applicable, distributors.
- Implement the required transparency disclosures by August 2026.
- Supplement procurement and service contracts with obligations regarding documentation, information, changes, and cooperation.
- Prepare for potential high-risk cases by addressing risk management, data governance, logging, and human oversight.
The Digital Omnibus postpones key high-risk deadlines but does not repeal the EU AI Act. Transparency, clarification of roles, AI expertise, and governance will remain critical in 2026.
Companies should not view the additional time as a reprieve for all measures. They should systematically map their AI landscape now, classify applications, and embed the requirements into procurement, product development, data management, and compliance.
Industrial companies, in particular, benefit from not treating AI governance as an isolated legal project. Integrating it with product data, PIM, MDM, quality management, and DPP structures creates a robust foundation for the legally compliant and economically sound use of AI.
