EU AI Act deadlines after the Digital Omnibus vote: which obligations already apply, which were postponed, the AI literacy duty, risk categories, fines and a concrete action plan for business.
At the end of June, the EU Council gave its final approval to postponing several EU AI Act deadlines. Some organisations drew the wrong conclusion: that there is "plenty of time left". The reality is different. The strictest requirements were pushed back, but several obligations that matter most for your day-to-day operations already apply.
The headlines after the "Digital Omnibus" vote sounded reassuring: high-risk AI requirements postponed. For business leaders, that is easy to read as "we can wait". But only the specific, most complex obligations were delayed. The entire regulatory logic, the prohibitions and the employee-related duties are in force right now and received no postponement at all.
One important caveat up front: the Council approved the changed deadlines, but the new dates only become legally binding once the text is published in the EU Official Journal. In practice they are already treated as the planning baseline, but formally this is still a "pending" stage.
The AI Act does not take effect in one step but in phases. This is exactly where most of the confusion comes from, so here are the key dates in chronological order:
2025-02-02: Prohibited practices and AI literacy (in force). Unacceptable-risk practices (e.g. social scoring) are banned. The duty to ensure employee AI literacy (Article 4) took effect.
2025-08-02: General-purpose AI models, GPAI (in force). Obligations for GPAI providers: documentation, copyright policy, training data summaries. For systemic-risk models: adversarial testing and cybersecurity.
2026-08-02: Transparency, governance and supervision (approaching). Transparency duties towards users (chatbots, labelling of AI content). National supervisory authorities (in Lithuania, the RRT) receive full powers and a fining mechanism. AI literacy enforcement genuinely kicks in.
2026-12-02: Technical "watermarking" and new prohibited practices (approaching). Machine-readable labelling of AI content for systems already on the market. New prohibitions added: nudification tools and AI-generated CSAM.
2027-12-02: High-risk systems (standalone). Annex III systems: recruitment, creditworthiness, education, law enforcement and others. Postponed from 2026-08-02.
2028-08-02: High-risk systems (embedded in products). Annex I systems: AI in medical devices, machinery and other regulated products.
In short: only the most complex part, full compliance for high-risk systems, moved to 2027-2028. The prohibitions, GPAI rules, transparency duties and AI literacy apply earlier and were not postponed.
The AI Act is built on a risk pyramid: the greater the potential harm, the more obligations apply. This logic has been in place from the start and the Omnibus did not change it.
Practices banned outright on the EU market. Fines of up to €35 million or 7% of global turnover.
Allowed only after achieving compliance: risk management, data quality, documentation, human oversight, cybersecurity. Takes effect 2027-2028.
Information duties: telling people they are interacting with AI; labelling AI-generated content. From 2026-08-02.
Most systems (spam filters, recommendation engines). No mandatory requirements. By the Commission's estimate, about 85% of all AI systems.
Most "risky-sounding" AI uses in HR or finance are actually high-risk, meaning they are permitted with compliance. The circle of fully prohibited practices is narrower, but that is precisely where organisations step in without noticing. The most common cases by function:
HR / People. Prohibited: emotion recognition of employees in the workplace (analysis of faces, voice, "engagement"). Allowed with compliance: CV screening and candidate ranking. That is high risk, not a prohibition.
Marketing and sales. Prohibited: manipulative techniques or exploitation of vulnerable groups (children, the elderly, the financially vulnerable) causing significant harm. Allowed: standard personalised targeting, recommendations, A/B testing.
Finance and credit. Prohibited: social scoring, meaning evaluating a person based on unrelated behavioural data leading to unfavourable treatment in another context. Allowed with compliance: creditworthiness assessment and insurance pricing (high risk).
Security and premises. Prohibited: mass scraping of faces from the internet or CCTV for recognition databases; biometric categorisation of visitors by sensitive traits (origin, religion).
Audit and fraud prevention. Prohibited: predicting a person's "criminality" based purely on profiling. Allowed: fraud detection based on objective transaction patterns and facts.
The takeaway for leadership: the prohibitions typically bite in three places: emotion recognition aimed at employees, deriving sensitive traits from biometrics, and social scoring or pure profiling. Almost everything else in recruitment, finance or marketing is not banned but high-risk. It is possible, but requires compliance.
If an organisation gives employees AI tools (Copilot, ChatGPT, tools embedded in CRM or design systems), it is subject to the Article 4 duty to ensure employee AI literacy. This obligation has applied since 2025-02-02 and, unlike the high-risk requirements, was not postponed. Contrary to earlier fears, the Omnibus did not soften it: the duty for organisations remained in the final text, and in Lithuania its supervision falls to the Communications Regulatory Authority (RRT), with enforcement genuinely starting from 2026-08-02.
Important: the law does not require any "state certificate". No such regime exists in the EU. It requires being able to demonstrate that the organisation took proportionate, role-appropriate measures. Training completion certificates are valuable not as an official credential but as evidence in a compliance file.
The AI Act's own cybersecurity and risk management requirements for high-risk systems only take effect in 2027-2028. But that does not make cyber risk management a future concern. For many organisations it is mandatory right now through other legislation: NIS2 (in force in Lithuania since 2024-10-18), DORA for the financial sector (since 2025-01-17) and Article 32 of the GDPR. The AI Act adds AI-specific threats to this baseline, such as model poisoning and adversarial attacks, but it does not create the cybersecurity duty from scratch.
It is increasingly said that the AI Act is holding back European competitiveness. That is a real and fairly strong critique. It is what prompted the Omnibus in the first place. Critics (often citing the Draghi competitiveness report) argue that the compliance burden hits SMEs disproportionately, that ex ante requirements slow product launches, and that data rules make model training harder compared with the US and China.
On the other hand, the argument is not universally accepted. Clear rules can increase trust and thereby accelerate adoption; a single EU regime replaces 27 national ones and reduces fragmentation; and a significant share of economists believe Europe's main obstacles are not legal but investment- and infrastructure-related. So softening regulation alone would not solve the problem. From a business standpoint, it is more useful to treat this debate not as "for or against the Act" but as the basis for realistic planning.
The fastest first step for most organisations: a clear AI usage policy for employees. Use the free AI Officer AI Policy Generator. The document takes 5 minutes to generate.
Need help with your AI inventory, risk classification or AI literacy training? Get in touch. We carry out AI audits and help organisations prepare for EU AI Act compliance.
This article is prepared for informational purposes and is not legal advice. Specific obligations depend on your organisation's AI systems and the context of their use. Dates reflect the "Digital Omnibus" version approved by the EU Council on 29 June 2026; the final dates become legally binding upon publication in the EU Official Journal.