The EU AI Act is the world’s first broad law for artificial intelligence, and 2026 was the year it moved from theory to real deadlines. It also changed: in July 2026 the EU adopted the “Digital Omnibus on AI”, which pushed back the biggest high-risk rules but kept the transparency rules on schedule. If you sell to European customers, use AI chatbots on your website, or publish AI-generated content, here is what changed and what to do now. This is a practical summary, not legal advice.
Why a US or Asian business should care
Like GDPR, the AI Act applies based on where the AI is used, not where your company is based. If your website chatbot talks to people in the EU, or your software is used by EU customers, parts of the law can apply to you. The European Commission’s official AI Act overview is the best starting point.
The AI Act timeline after the 2026 changes
The Digital Omnibus on AI (Regulation (EU) 2026/1744) was published on 24 July 2026 and entered into force on 27 July 2026, according to Legal 500. The key dates now look like this:
- February 2025: Bans on “unacceptable risk” AI (such as social scoring and manipulative systems) and the AI literacy duty started.
- August 2025: Rules for general-purpose AI model providers started.
- 2 August 2026: Transparency rules apply. People must be told when they are interacting with AI, and deepfakes must be labeled.
- 2 December 2026: A grace period ends for machine-readable marking of AI-generated content from systems already on the market. New bans on AI that generates non-consensual intimate imagery also apply.
- 2 December 2027: Stand-alone high-risk systems (Annex III), such as AI used in hiring, credit scoring and education, must comply. This was moved from August 2026.
- 2 August 2028: High-risk AI built into regulated products (Annex I), such as medical devices and vehicles, must comply.
Law firm Gibson Dunn notes that the deferral does not change the Act’s core structure. The deadline moved; the obligations did not disappear.
What changed in the Digital Omnibus
- Fixed later dates for high-risk rules instead of a conditional trigger.
- A softer AI literacy duty: companies must support staff AI literacy rather than guarantee a specific level.
- New bans on “nudifier” apps and AI-generated child sexual abuse material.
- Less overlap for AI inside products already covered by sector rules, such as machinery.
- Stronger powers for the EU AI Office over some general-purpose AI systems and large platforms.
What most small businesses need to do now
Most small businesses are “deployers”: they use AI tools rather than build them. For them, the transparency rules are the most relevant today.
- Label your chatbot. If a visitor chats with an AI assistant on your site, say so clearly at the start, for example “You’re chatting with our AI assistant.”
- Label synthetic media. AI-generated images, voices or videos that could be mistaken for real people or events should be disclosed.
- Keep an AI inventory. List every AI tool you use, what data it touches and who is responsible for it.
- Check hiring tools. AI that screens CVs or ranks candidates is high-risk under Annex III. You have until December 2027, but vendors will start asking questions sooner.
- Train your team. A short internal guide on safe AI use covers the literacy expectation and reduces mistakes.
- Ask vendors for documentation. Reputable AI providers now publish AI Act compliance information.
What this means for your website
From a website point of view, the practical changes are small but important: a clear AI disclosure in chat widgets, labels on AI-generated media, and an updated privacy policy that mentions AI tools and data processing. If you use AI for lead follow-up, as described in my post on AI agents for lead follow-up, make sure messages are honest about being automated.
Need a chatbot or automation set up with the right disclosures from day one? My AI automation service builds this in by default.
FAQ
Was the EU AI Act delayed in 2026?
Partly. The Digital Omnibus moved the high-risk deadlines to December 2027 and August 2028, but transparency rules still applied from 2 August 2026.
Does the EU AI Act apply to companies outside Europe?
Yes, if your AI system is placed on the EU market or its output is used in the EU, for example a chatbot serving EU visitors.
Do I need to label AI chatbots on my website?
Yes. Under the transparency rules, people must be informed when they interact with an AI system unless it is obvious from the context.
What counts as high-risk AI?
Examples include AI used in hiring, credit decisions, education, critical infrastructure and law enforcement, plus AI in regulated products like medical devices.
What are the penalties under the AI Act?
Fines depend on the breach and company size, with the highest tiers reserved for prohibited practices. Check the official text or a lawyer for your situation.
