In the summer of 2026 a wave went through the headlines: “the EU is delaying its AI rules”. A good number of business owners exhaled and closed the tab. That was premature: what was postponed is the part that barely touched small businesses. The part that does touch them arrives on 2 August.
What happened
On 24 July 2026 Regulation 2026/1744 — the Digital Omnibus — was published in the Official Journal of the EU. It amends the AI Act and enters into force on 27 July 2026.
The document pushes back the deadlines for high-risk systems. That is a separate category: AI in recruitment, credit scoring, education, law enforcement, border control, and AI embedded in regulated products such as medical devices and industrial machinery.
A chat widget on a website, a generator for product descriptions and an assistant answering delivery questions are not in that category.
The transparency obligations under Article 50 apply from 2 August 2026. The Digital Omnibus did not move that date.
The dates that are live now
| Obligation | From | Who it applies to |
|---|---|---|
| Prohibited practices (Article 5) | 2 February 2025 | everyone |
| Disclosing an AI interlocutor, marking deepfakes (Article 50) | 2 August 2026 | anyone with a bot or AI content |
| Machine-readable content marking for systems on the market before 2 August 2026 | 2 December 2026 | providers of such systems |
| New prohibitions added by the Omnibus | 2 December 2026 | everyone |
| High-risk systems, Annex III | 2 December 2027 | recruitment, scoring, education and the like |
| High-risk systems, Annex I | 2 August 2028 | AI inside regulated products |
The Annex III date used to be 2 August 2026 and the Annex I date 2 August 2027. Those are the two that moved.
Why both common reactions are wrong
Panic usually sounds like this: “the AI Act demands certification, audits and documentation, and I have a bot on my site — I cannot cope with that.” The requirements for high-risk systems are genuinely heavy: a risk management system, technical documentation, human oversight, registration in an EU database. But they are addressed to a specific list of uses. A chat widget is not on that list.
Complacency sounds different: “the deadlines moved to 2027, so there is time.” For Article 50, time runs out on 2 August 2026. There is no reprieve for anyone, including one-person companies — the article contains no turnover or headcount threshold.
What a small business should do
For an ordinary website the practical workload is small and comes down to three checks.
- Find all the AI you have. Site chat, a Telegram or WhatsApp bot, an autoresponder, a description generator, an image tool. Make a list — it is usually shorter than you expect.
- Check the disclosure. Every system that interacts directly with a person must announce itself before its first reply. What that looks like in the interface is covered in “Got a chatbot on your site? From 2 August it has to introduce itself”.
- Check your content. If you publish AI-generated images or video, find out whether your tool applies a machine-readable marker. For text that has been through your own editing, separate marking is generally not required.
If you use no AI anywhere — no bot, no generator, no assistant — Article 50 does not currently apply to you. That is a normal and common position, and there is nothing you need to adopt for the sake of compliance.
The three questions people ask most
“I only use AI internally, for drafts and correspondence. Does this touch me?” Article 50 addresses systems that interact with people or whose output is published. A tool you use yourself and whose output you edit before publishing is a different situation. If you edit the text and take responsibility for the publication, separate marking is generally not required.
“My bot comes from a third-party service. Is that their problem or mine?” The regulation addresses the disclosure duty to the provider of the system. But checking that the disclosure is visible on your site and in your visitors’ language falls to you — simply because it is your site people will look at. If you renamed the bot and present it as your own service, the role may shift; that is a question for a lawyer.
“What if I am not in the EU at all?” The regulation attaches not to where your company is registered but to where the system’s output is used. A site aimed at European customers is in scope regardless of where you run it from. For anyone selling into the EU from outside it, that is the key sentence in this article.
About the fines
A breach of Article 50 sits in the middle tier: up to €15 million or up to 3% of annual worldwide turnover, whichever is higher. For small and medium enterprises Article 99(6) inverts the rule: whichever is lower applies. On top of that, the authority must take the operator’s size into account when deciding the penalty.
The “up to €35 million” figure that also circulates relates to the prohibited practices in Article 5 — a different part of the regulation.
What to read next
The AI Act is not the only thing touching a European website in 2026. Accessibility requirements live in a separate law with their own exemptions: see “A €100,000 fine for an inaccessible site: who it hits and who it does not”.
If you would like someone to walk through your site and produce the list of what needs fixing, have a look at the Digital Growth Audit.
This is technical preparation of a website, not legal advice. For how the rules apply to your particular case, talk to a lawyer.
Sources
- Regulation (EU) 2026/1744 — Digital Omnibus, Official Journal, 24 July 2026
- Council of the EU: press release on final adoption, 29 June 2026
- Regulation (EU) 2024/1689, Article 113 — entry into force and application
- Regulation (EU) 2024/1689, Article 99 — penalties
- Gibson Dunn: analysis of the postponed Digital Omnibus deadlines
Checked on 26 July 2026.