The bad news first: the law you read last year is no longer that law
The AI Act — officially Regulation (EU) 2024/1689 — was amended in 43 places in the summer of 2026. The amending law is Regulation (EU) 2026/1744, commonly called the Digital Omnibus on AI: it was adopted on 8 July 2026, published on 24 July, and entered into force on 27 July.
This is not a minor technical touch-up. It postponed, it softened, and it introduced two new prohibitions.
The timetable as it stands today
| Date | What starts to apply | Status |
|---|---|---|
| 2 February 2025 | Prohibited practices and the AI literacy obligation | in force |
| 2 August 2025 | Rules for general-purpose models, governance, the penalty regime | in force |
| 2 August 2026 | The start of general application — this is where the transparency rules sit | in force, six weeks now |
| 2 December 2026 | Two new prohibited practices; and the grace period for machine-readable marking runs out for systems already on the market | coming |
| 2 August 2027 | Compliance deadline for earlier general-purpose models; national sandboxes | coming |
| 2 December 2027 | Requirements for high-risk systems (the ones under Annex III) | postponed |
| 2 August 2028 | Requirements for high-risk systems (those embedded in products) | postponed |
What was postponed — and what was not
| Obligation | Original date | New date |
|---|---|---|
| High-risk systems, Annex III | 2 Aug 2026 | 2 Dec 2027 |
| High-risk systems, embedded in a product | 2 Aug 2027 | 2 Aug 2028 |
| Setting up regulatory sandboxes | 2 Aug 2026 | 2 Aug 2027 |
And what was not postponed: Article 50, meaning the transparency obligations. These have been live since 2 August 2026. There is exactly one concession: systems placed on the market before 2 August 2026 have until 2 December 2026 to introduce machine-readable marking. Chatbot disclosure and deepfake labelling, by contrast, are mandatory from 2 August with no grace period at all.
Provider or deployer? Everything hangs on this
The Regulation knows two roles, and your obligations depend on which one you are in.
You are a deployer if you use an AI system under your own responsibility in your professional activity. Private, non-professional use falls outside this.
You are a provider if you develop an AI system, or if you place a system on the market or put it into service under your own name or trademark. You do not have to train a model for this — it is enough to put your brand on somebody else's service and pass it on. And being free of charge does not exempt you: the text of the Regulation says "for payment or free of charge" alike.
The practical consequence most people fail to work out: if a branded chatbot runs on your own website, then in that relationship you are quite probably a provider — and the disclosure duty in Article 50(1) is yours.
What applies today to a ten-person company
Assuming you use AI tools but do not develop anything and do not pass anything on under your own name:
| Obligation | Since | Fineable? |
|---|---|---|
| Breaching the prohibited practices — for example emotion recognition at the workplace | 2 Feb 2025 | yes, in the highest band |
| Supporting AI literacy among your staff | 2 Feb 2025 | not listed in any EU fining band |
| Chatbot disclosure: the visitor gets to know they are talking to a machine | 2 Aug 2026 | yes |
| Labelling a deepfake when you publish it | 2 Aug 2026 | yes |
| Labelling AI text on a matter of public interest, where there was no human editorial check | 2 Aug 2026 | yes |
| Disclosure for an emotion recognition or biometric categorisation system | 2 Aug 2026 | yes |
And what does NOT apply to you today: the entire chapter on high-risk systems — risk management system, data governance, technical documentation, logging, human oversight, accuracy requirements. None of it bites until December 2027 or August 2028. The rules on general-purpose models, meanwhile, apply to the model provider, not to you.
Worth saying out loud, because many consultants suggest the opposite: the AI Act prescribes no general "AI usage register", you do not have to appoint an AI officer, and you do not have to register in any EU database. Registration in the EU database falls on providers of high-risk systems.
One exception that does catch a lot of small businesses: if you use an AI system for recruitment, employee evaluation or creditworthiness assessment, that is a high-risk category under Annex III. From December 2027 the full chapter applies to it — better to know that now than then.
The two new prohibitions that start in December
The Digital Omnibus did not only postpone. It introduced two new prohibited practices, with effect from 2 December 2026: an AI system that creates or manipulates realistic intimate content of a real person without their consent is prohibited, and so is producing or manipulating sexual content depicting children.
The prohibition is conditional: it bites if producing such content is the system's intended purpose, or if, because of the way it is built, this is "reasonably foreseeable and reproducible" without appropriate safeguards. For a deployer, only intentional use falls under it.
This prohibition sits in the highest fining band. And it is not theoretical: in February 2026 the Irish data protection authority opened a large-scale inquiry into exactly this kind of behaviour by a social platform's generative feature — under the GDPR, before the AI Act prohibition even takes effect.
The fines — and the rule that protects small businesses
| What for | EU ceiling | What lands in this band |
|---|---|---|
| Prohibited practices | 35 million euros or 7% of global annual turnover, whichever is higher | emotion recognition at the workplace, social scoring, untargeted scraping of facial images |
| Breach of most other duties, among them the transparency obligations | 15 million euros or 3%, whichever is higher | an unlabelled deepfake, a chatbot that hides that it is a machine |
| Misleading the authority | 7.5 million euros or 1% | incorrect or incomplete information handed over during an inspection |
And the sentence most summaries leave out: for an SME, startups included, the ceiling is the lower of the two figures, not the higher one. At a company with 2 million euros of annual turnover, 7% is 140,000 euros, not 35 million. Member states also have to take the interests of SMEs and their economic viability into account when setting a penalty.
The deadline for actually paying a fine is national and differs from country to country — in Hungary, for example, it is 30 days.
National enforcement: who is the authority?
In most countries, not the data protection authority. That is the most common mistake, and it is wrong in almost every member state.
Designating the roles was a national job, and the EU deadline was 2 August 2025. Not everyone met it, and the gap is not in the same place everywhere: in some countries the authority exists but the penalty regime does not, and in others it is the other way round. Two concrete cases side by side — open the one that applies to you:
Hungary — the authority exists, and it is not the data protection office
Under section 1 of Government Decree 344/2025 (X. 31.), the government placed the market surveillance authority and the single point of contact with the minister responsible for enterprise development, and the notifying authority with the national accreditation body.
The frame comes from Act LXXV of 2025, which entered into force on 1 December 2025 — the regulatory sandbox part on 2 August 2026. The EU deadline was 2 August: Hungary was three to four months late, but it did finish the designation.
Two details that decide real cases. The authority's exclusive competence does not cover consumer matters (section 5(2)). Its territorial reach, on the other hand, is wide: the act covers providers and deployers from third countries too, whenever the output of the system is used in Hungary.
The act also created a national AI council, which has no decision-making power: it makes proposals and may issue recommendations. A fine, once imposed, has to be paid within 30 days.
Spain — the EU's first AI agency, without the designation
In 2023 Spain became the first EU country to set up a dedicated AI supervisory agency: AESIA, seated in A Coruña, under Real Decreto 729/2023. On paper it was ahead of everyone else.
The formal designation under Article 70 of the Regulation, however, is still not finished. Both the designation and the national penalty regime sit in a bill that, in September 2026, is still in the amendment stage in the Congress — the amendment deadline has been extended three times so far.
That has a very practical consequence: AESIA cannot impose AI Act fines today, because under Spanish law an offence can only be created by a norm of statutory rank, and there is none yet. The data protection authority, on the other hand, is already fining under the GDPR and is waiting for nothing.
If the bill passes, supervision will be decentralised: which authority you deal with will depend on the use case — AESIA, the data protection authority, the central bank, the securities and the insurance supervisor, and the judiciary's own body all get a share. And one common misunderstanding: the mandatory AI officer and the AI register in the bill apply to the public sector only, not to private companies.
Three common misunderstandings
"They postponed the whole thing to 2027." No. The high-risk chapter was postponed. The dates for prohibited practices, AI literacy, the general-purpose model rules and — the part that touches most companies — the transparency obligations did not move.
"As an SME I am exempt." There is no company-size threshold. What there is: simplified technical documentation and simplified quality management for providers, plus the lower fining ceiling. The obligations themselves are identical.
"My data protection authority will be the one checking me." Not for enforcing the AI Act, in most member states. The data protection authority supervises the GDPR — which, quite independently of all this, applies at full strength to every use of AI. What you may upload at all is covered in detail by the GDPR and AI, question by question.
What to take away
If you use AI but pass nothing on under your own name, four things touch you today: the prohibited practices, supporting AI literacy, and — if you publish in public or run a chatbot — the labelling and disclosure duties.
The authority is a national one and is usually not your data protection regulator, the fining ceiling for an SME is the lower figure, and you do not have to deal with the high-risk chapter until December 2027 — unless you use AI for recruitment or employee evaluation.
The practical side of the labelling duties — what, where and how, together with the EU icon set — is unpacked in labelling AI content, step by step. And the AI literacy obligation can be met with four in-house sessions: the training plan sets out what the law asks for and what it does not.
And because this area moves every quarter: the dates above reflect the state of play on 13 September 2026.