AurValdEU AI Act readiness — updated for the 2026 Digital Omnibus.
The Digital Omnibus on AI moved the main high-risk deadlines to December 2027 and August 2028. That is more time, not a reason to stop. We help you find out which of your AI systems are in scope and build the evidence you'll need — as part of your AI architecture, not as a separate paperwork exercise.
Last reviewed 2 October 2026. General information, not legal advice.
What applies, and when.
The EU AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).
| Date | What applies | Status |
|---|---|---|
| 2 Feb 2025 | Prohibited AI practices banned. AI literacy duty (Article 4) applies. | In force |
| 2 Aug 2025 | Obligations for providers of general-purpose AI (GPAI) models. Governance and penalty regime. | In force |
| 27 Jul 2026 | Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force: high-risk deadlines moved, AI literacy wording softened, SME relief extended to small mid-caps, two new prohibited practices added. | In force |
| 2 Aug 2026 | Transparency obligations (Article 50) — e.g. telling people they are interacting with AI. AI Office enforcement powers for GPAI. Grace period to 2 Dec 2026 for marking AI-generated content from systems already on the market. | In force |
| 2 Dec 2027 | High-risk obligations for stand-alone systems listed in Annex III — including recruitment and HR, creditworthiness and credit scoring, and life and health insurance pricing. | Next deadline |
| 2 Aug 2028 | High-risk obligations for AI embedded in products regulated under Annex I (for example machinery or medical devices). | Upcoming |
High-risk uses common in the mid-market
- Recruitment and HR — screening CVs, ranking candidates, decisions on promotion, termination or task allocation.
- Credit — assessing the creditworthiness or credit score of individuals (fraud detection is excluded).
- Insurance — risk assessment and pricing for life and health insurance.
- Other Annex III areas — access to essential services, education, biometrics and critical infrastructure.
Your role matters. Most mid-market organisations are deployers — they use an AI system someone else built. But substantially modifying a system, or putting your own name on it, can make you a provider, with far heavier obligations.
Not high-risk? You may still have transparency duties — for example for chatbots or AI-generated content — and should be able to show the measures you've taken on staff AI literacy.
Readiness built into your architecture.
We treat the AI Act as a design constraint alongside cost and capability: what you must evidence shapes what you build, and what you build shapes what compliance costs to maintain.
Inventory & classification
List every AI system you build, buy or embed; confirm your role (provider or deployer) for each; classify by risk; flag anything prohibited; size the gap.
Readiness build
Risk management, data governance, human oversight and logging designed into the architecture; technical documentation structure; transparency notices; AI literacy measures; supplier due diligence.
Ongoing assurance
Keep the inventory and evidence current as systems change, track guidance and standards, and answer customer due-diligence questionnaires.
What you get
- An AI system register with role and risk class for each system
- A gap assessment against the obligations that apply to you
- Oversight, logging and documentation designs your engineers can build
- A plan aligned to the 2027 and 2028 deadlines
What we don't do
- Give legal advice or legal opinions — we work alongside your lawyers or DPO
- Certify compliance or act as a notified body
- Sell compliance software
The AurVald AI Act readiness checklist
Sixteen questions to answer before the December 2027 deadline. The full toolkit, with guidance for each question, is a free download.
Inventory & classification
- We have an inventory of every AI system we develop, buy or embed in our products.
- For each system we know our role: provider, deployer, importer or distributor.
- Each system is classified by risk: prohibited, high-risk, transparency-only or minimal.
- We have confirmed that none of our systems falls under a prohibited practice.
Governance — applies to everyone
- A named person is accountable for AI Act readiness.
- We have taken measures to build AI literacy among staff who use or oversee AI.
- People are told when they interact with an AI system, and AI-generated content is labelled where required.
- Contracts with AI suppliers give us the information we need to meet our own obligations.
High-risk systems — if you have any
- A risk management process is documented for each high-risk system.
- Training and input data are governed for quality, relevance and bias.
- Technical documentation follows the structure in Annex IV.
- Systems record events automatically (Article 12), and as a deployer we keep logs for at least six months.
- Human oversight is designed in, and the people doing it are trained and able to intervene.
- Post-market monitoring and serious-incident reporting are in place.
- Where we are the provider, conformity assessment, declaration of conformity, CE marking and registration are planned.
- Our plan is aligned to the 2 December 2027 and 2 August 2028 deadlines.
Frequently asked
Did the Digital Omnibus delay the EU AI Act?
Partly. It moved the high-risk obligations to 2 December 2027 for stand-alone (Annex III) systems and 2 August 2028 for AI in regulated products (Annex I). Prohibitions, GPAI obligations and the transparency rules were not postponed.
Does the AI Act apply to companies outside the EU?
Yes, if you place AI systems on the EU market or their output is used in the EU.
We only use tools like ChatGPT or Copilot. Are we affected?
Usually not as high-risk, but it depends on what you use them for. Using a general-purpose model to screen job applicants, for example, can make that use high-risk. Transparency duties and AI-literacy measures still apply.
What are the penalties?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches. For SMEs and small mid-caps the lower of the two amounts applies.
Is this legal advice?
No. We provide technical and governance expertise and work alongside your legal counsel or DPO, who should confirm legal interpretations.
Sources: Regulation (EU) 2024/1689 (EUR-Lex); European Commission — AI Act; Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ 24 July 2026.
Find out where you stand.
A two-week inventory and classification gives you the map — whether the next steps happen with us or with your existing advisors.