You've been told Brussels postponed the AI Act. Your SMB got no postponement

What exactly happened on July 27

For fifteen days I read headlines like "Europe walks back on AI" and "AI Act moratorium." None of it's true, and that confusion can cost you money.

The Omnibus changed one letter in Article 113 of the AI Act. One. The one that sets when Chapter III, Sections 1, 2, and 3 start to apply: classification, technical requirements, and obligations for high-risk systems. That block, which is expensive to implement, moves to December 2, 2027 for systems in Annex III (employment, biometrics, education, access to essential services) and to August 2, 2028 for AI integrated into products regulated as machinery or elevators.

The rest of the calendar didn't move. Prohibited practices and AI literacy have been mandatory since February 2025. And August 2, 2026 remains the general application date for the regulation.

If you run a workshop with a chatbot on your website, you were never going to be inside Chapter III. What does apply to you is Article 50. And that hasn't shifted a single day.

The three things that now apply if you use AI in your business

Article 50 has five sections. For an SMB that doesn't build models, they boil down to three concrete duties.

Disclose that users are interacting with a machine. If your website has a chatbot, voice assistant, or conversational form, the person must know they're talking to an AI system. It can't be buried in a privacy policy: the information must be clear and presented at first interaction. A line in the widget header is enough, and fixing it takes ten minutes.

Mark synthetic content. If you generate images, text, audio, or video with AI and publish it, the outputs must be marked in a machine-readable format. Here's an important distinction: this obligation falls on the provider of the generative system, not on you for using a third-party tool. If you use ChatGPT or Midjourney, the technical marking is theirs. If you've built your own generator and offer it to customers, it's yours. Generative systems already on the market before August 2 have until December 2, 2026 to comply with marking, under the new Article 111.4. Four months' extension, not an exemption.

Disclose deep fakes. If you publish a video or audio imitating a real person, you must say so. And if you use emotion recognition or biometric categorization—for example, a system that analyzes customer faces in a store—you must inform the people being exposed.

Violating Article 50 is covered under Article 99.4.g: up to €15,000,000 or 3% of global business turnover, whichever is higher. For SMBs the lesser of the two thresholds applies, not the greater.

The cap dropping for SMBs doesn't make it pocket change. And enforcement weighs cooperation and mitigation measures: arriving with the disclosure in place and documented changes the conversation dramatically.

What the Omnibus actually gives you if you're small

It's not all obligations. The regulation finally creates its own definition of SMB within the AI Act (Article 3, point 14 bis) and another for "small mid-sized company" (14 ter), and extends to both advantages that previously applied only to microenterprises.

The AI literacy change deserves its own paragraph. The obligation to train anyone operating AI systems has been live since February 2025, but the new text clarifies that nobody will demand proof of a specific competency level per person. In practice: one internal training session that's documented plus a written procedure for AI use keeps you compliant. You don't need certifications.

Two new prohibitions for December

The Omnibus adds to Article 5 the prohibition of systems designed to generate non-consensual intimate material and child sexual abuse material, effective December 2, 2026. This barely touches most SMBs. If your business manipulates images of people—photography, advertising, avatars—read it carefully, because it also covers systems where that output is foreseeable and reproducible without reasonable safeguards.

What I'd do this week in your company

None of this needs a law firm. It takes an afternoon.

• Inventory. List every AI system you use: chatbot, text generator, call transcription, CV filtering. For each, note the purpose and your role: are you the provider or the deployer? Obligations change by which one you are.
• Check your touchpoints. Website chatbot, automated WhatsApp, voice-synthesized voicemail. All need visible disclosure.
• CV filtering, pay attention. If you use AI to screen candidates, you're in Annex III. It's not mandatory until December 2027, but it's the system that will cost you the most if you arrive late.
• Vendor contracts. A generic "regulatory compliance" clause no longer cuts it. Get in writing who guarantees technical marking and who's liable if it fails.
• Keep evidence. Screenshot the notice, date, version. If asked one day, proof of what you showed and when is worth more than any report.

If you work with vendors who embed AI in factory processes—machine vision for quality control, predictive maintenance—the clarification in Article 6 matters to you: AI that only optimizes performance, automates tasks, or controls quality is not a safety component and falls outside high-risk. Unless its failure could harm someone. Then it goes back in.

Frequently asked questions

Does the Omnibus suspend the AI Act?

No. It only delays Chapter III, Sections 1 to 3, with two dates: December 2, 2027 for Annex III and August 2, 2028 for Annex I. The general application on August 2, 2026 stays intact, including all transparency under Article 50.

I have a chatbot on my website built with a third-party tool. What do I do?

Make sure the person knows they're talking to an AI system from the first message, with clear, accessible text. The technical marking of outputs is the tool provider's job; the visible disclosure is yours. Ask the provider for written confirmation they comply with Article 50.2.

Can a five-person SMB face a €15 million fine?

No. For SMBs and, since the Omnibus, small mid-sized companies, the lesser of the fixed amount and the percentage of turnover applies. It's still a serious, avoidable fine—fixed with half an hour of effort.

Do I need to certify AI training for my staff?

No. The new Article 4 explicitly says the obligation doesn't require guaranteeing a specific AI literacy level for any individual. Proportionate, documented training is sufficient.

I use AI to write my website copy. Do I have to disclose it?

Article 50.4 requires disclosure when publishing AI-generated text on matters of public interest without human editorial review. Commercial copy on your own website, reviewed by you, doesn't fall into that category. If you publish news or unsupervised informational content, it does.

When do I need to worry if I use AI for hiring?

From December 2, 2027 onward the full high-risk regime from Annex III will be enforceable. Conformity assessment can't be rushed in a quarter: if you already use that kind of system, start documenting data, testing, and human oversight now.