The EU AI Act after the Digital Omnibus: what was postponed and what a small business must do now

What happened

Regulation (EU) 2026/1744 of 8 July 2026, known as the Digital Omnibus on AI, amends the EU Artificial Intelligence Act. It was published in the Official Journal on 24 July and came into force on 27 July 2026, days before the AI Act's big application date: 2 August 2026.

Its aim is to simplify and give more time to those facing the heaviest obligations. But it doesn't delay everything.

The calendar as it now stands

The Omnibus also adds a new prohibition: systems designed to generate non-consensual intimate images or child sexual abuse material.

What was not postponed: transparency

For a small business using AI with customers, this is the part that matters. Since 2 August 2026:

• If an AI system talks with people, they must know they're talking to an AI, unless it's obvious. The notice must come at the latest at the first interaction. This covers website chatbots, WhatsApp assistants, agents answering email and voices answering the phone.
• Generated or manipulated images, audio or video that look real (deepfakes) must be disclosed as such.
• AI-generated text published to inform the public on matters of public interest must also be identified, unless it has gone through human review and someone takes editorial responsibility.

In addition, those who develop content-generating systems must mark the output technically so it can be detected. For generative systems already on the market before August, the Omnibus gives a short transition period for that technical marking. The disclosure duties, by contrast, have no extension.

Transparency breaches can be fined up to €15 million or 3% of worldwide turnover. For SMEs the lower of the two applies, but it's still a serious figure.

Training staff is still mandatory, with nuances

Article 4 required ensuring "a sufficient level of AI literacy" among those using these systems in the business. The Omnibus rewrites it: it now requires taking measures towards that, without guaranteeing a specific level for each person. It moves from an obligation of result to one of means.

In practice, it's worth being able to show three things:

1. An inventory of the AI tools in use and what for.
2. Role-specific training, with dates: someone supervising an agent doesn't need the same as someone drafting with an assistant.
3. A short internal policy: which data is never entered, what is always reviewed and whom to ask.

The regulation also asks the Commission and Member States to give SMEs particular support with this.

What was postponed: high-risk

Annex III high-risk systems are those that decide or significantly influence people's lives: selecting candidates, evaluating or dismissing workers, granting credit, deciding access to essential services or education. Their obligations (risk management, technical documentation, logging, human oversight) move from 2 August 2026 to 2 December 2027.

This matters to employment law firms, accounting firms handling payroll and HR, and HR departments using AI to screen CVs or evaluate staff. A system that only prepares information for a person to decide may fall outside, but each case needs analysing. More time is no reason to wait: designing for real human oversight can start now.

Checklist for a small business

• Inventory. Which AI tools do you use, and who uses them?
• AI disclosure. Does your chatbot, WhatsApp assistant or email agent say it's an AI in the first message?
• Generated content. Do you label generated images and videos that look real?
• Training. Is there role-specific, dated training and an internal policy?
• High-risk. Do you use AI to select, evaluate or decide about people? If so, start preparing for 2027.
• Human oversight. Do actions with consequences go through a person? We explain how in supervising AI agents.
• GDPR. The AI Act doesn't replace the GDPR: legal basis, information and automated decisions still apply.

How we handle it in a digital employee

The digital employees we build introduce themselves as AI when they talk to customers or third parties, ask for human approval before any action with consequences and keep a record of what they do. It isn't just compliance: it's what makes them trustworthy. We go through the other risks (errors, data, costs) in AI agents in business: risks, GDPR and the AI Act.

In Spain, the AI Act supervisory authority is AESIA, and the national law setting out sanctions is still going through parliament. This article is for information: for a specific case, consult a legal adviser and check the consolidated text of the regulation.