- Basis
- VO (EU) 2024/1689
- Threshold
- no size threshold
- Penalty
- up to EUR 35 million or 7 % of global turnover
- Source
- DLA Piper zum Digital Omnibus
last checked 12 October 2026 · review cycle monthly
What is required
Prohibited practices and AI literacy already apply. Transparency duties for chatbots and synthetic content follow, high-risk duties for recruitment and credit scoring come last.
What has to be done
- ongoingEnsure AI literacy among staff working with AI, Article 4 of the AI Act, applicable since 2 February 2025.
- ongoingRule out the prohibited practices of Article 5, such as emotion recognition at the workplace and subliminal manipulation.
- one-offInventory the AI systems in use and classify them under the risk categories of the regulation.
- deadline-boundMeet the transparency duties of Article 50: disclosure for chatbots, machine-readable marking of synthetic content and notice for deepfakes.
- deadline-boundFor high-risk systems under Annex III: risk management system, data governance, technical documentation, logging, human oversight, conformity assessment and registration in the EU database.
Stages over time
All companies in scope
- Prohibited practices and AI literacy
- Transparency duties under Article 50
- High-risk duties, Annex III
The Digital Omnibus deferred the Annex III high-risk duties to 2 December 2027.
All companies in scope
- Prohibited practices and AI literacy
- Transparency duties under Article 50
Without high-risk systems only the prohibitions, AI literacy and the transparency duties apply.
Criteria checked
- AI systems in use
- High-risk under Annex III
Check this for your own company
Legal position as of 12 October 2026All nine regimes