AI Act and Digital Omnibus: What Changes for Companies

The AI Act, Regulation (EU) 2024/1689, is the first comprehensive European legislation on artificial intelligence. Its rules apply in stages, and in 2026 the timetable was amended by the Digital Omnibus on AI. For a company that uses or is assessing AI tools, the practical question is simple: what already applies today, what has been postponed and what should be done now?

In this article we summarise the main dates, clarify what does not change and propose five practical steps for SMEs.

Legislation is evolving: check the official sources.

What is already in force

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal of the European Union on 24 July 2026 and has been in force since 27 July 2026. It amends the AI Act mainly by changing its timetable and introducing some simplifications.

Some parts of the AI Act already apply:

• Prohibited practices: the bans apply from 2 February 2025.
• Transparency: from 2 August 2026 the transparency obligations apply, including informing people who interact with an AI system.
• Authorities: from 2 August 2026 the powers of the authorities also apply.

In short, the updated timetable looks like this:

What has been postponed

The most significant change in the Digital Omnibus concerns high-risk systems, for which the AI Act sets the most demanding obligations:

• obligations for Annex III high-risk systems move from 2 August 2026 to 2 December 2027;
• those for Annex I systems move to 2 August 2028.

The Digital Omnibus has also made the approach to AI literacy more flexible, meaning the skills organisations must promote among those who use these systems, and provides simplifications for SMEs.

However, the postponement should not be read as a free-for-all. The extra time is for preparing: those who develop or use systems that could fall into the high-risk category have the chance to get organised calmly, instead of chasing the deadline. To find out whether a system falls into these categories, refer to the text of the regulation and its annexes.

What does not change: transparency

The transparency obligations apply from 2 August 2026. They include the obligation to inform people who interact with an AI system. This affects many companies, including those that do not develop AI but use it, for example in an assistant that answers customers or employees.

In practice, if people in your organisation interact with an AI system, it is worth checking now how they are informed and documenting the choices made. It is a simple step that reduces the risk of misunderstandings with users and workers.

A good exercise is to ask, for each tool in use, whether people know they are dealing with an AI system. If the answer is not certain, it is worth adding a clear message in the interface or in the documentation provided to users.

Penalties

The AI Act provides for significant penalties:

• up to €35 million or 7% of turnover for prohibited practices;
• up to €15 million or 3% of turnover for breaches of other obligations.

For the amount applicable in a specific case and the specific rules for SMEs, always refer to the official text of the regulation.

What to do now: 5 steps for SMEs

1. Take an inventory of AI tools

List all the AI tools used in the company, including those adopted independently by individual departments: writing assistants, chatbots, AI features built into software already in use. For each, note who uses it, what for and with what data.

2. Classify the risk

For each tool, assess which AI Act risk category it might fall into. Most everyday uses will not be high risk, but it is important to know for sure, especially if AI is used in sensitive areas such as staff management.

3. Define a usage policy

Set clear rules: which tools are authorised, what data can be entered, who can use them and how results must be checked. A written policy is also a good starting point for AI literacy. For a sample table of contents, read our guide on AI at work, privacy and the GDPR.

4. Inform users and workers

Check how people who interact with an AI system are informed. In Italy, in the workplace, Law 132/2025 on AI requires employers to inform workers about the use of AI systems.

5. Choose providers with contractual guarantees

Many obligations depend on how the provider handles data. Before adopting a tool, check where the data is stored, whether it is used to train models and what guarantees are put in writing in the contract.

These five steps do not require large investments and can be carried out gradually. The benefit is twofold: the company prepares for the AI Act deadlines and, at the same time, gains a clear view of how artificial intelligence is used internally, reducing risks and unauthorised use. It is advisable to assign coordination to one person or a small working group, who keeps the inventory up to date and follows how the legislation evolves.

How ThorIA helps

ThorIA, Thorsoft's business AI, was designed with these points in mind:

• data in the EU, on certified servers in Milan, Italy;
• no training on customer data: data is never used to train models;
• customisation on business processes, handled by the Thorsoft team;
• DPIA available on request;
• ISO 27001, ISO 27017 and ISO 27018 certifications.

Thorsoft classifies ThorIA in the AI Act's limited-risk category. Each organisation remains responsible for assessing how it uses the tool within its own processes.

F.A.Q. - Frequently asked questions

Legislation is evolving: check the official sources. General information only, not legal advice: always check the current legislation.