The EU AI Act: New prohibitions and transparency take effect and what is yet to come

Article 113 of the EU AI Act designates 2 August 2026 as the general application date for all provisions not otherwise specially timed. While the most anticipated element – the high-risk AI framework – has been deferred (see below), a substantial body of rules nevertheless becomes applicable on this date:

• Transparency obligations: Providers must disclose when a user is interacting with an AI system and ensure that synthetic content is labelled as artificially generated or manipulated. Deployers of emotion recognition, biometric categorisation, and deepfake systems are also subject to disclosure duties. A transitional grace period until 2 December 2026 applies solely for machine-readable marking of systems already on the market before 2 August 2026. New systems must comply from day one.

• Standards and conformity assessment framework: The legal framework for harmonised standards, conformity assessment procedures, and EU database registration becomes applicable, laying the procedural groundwork for the high-risk regime taking effect in 2027/2028.

• Regulatory sandboxes: Innovation-support measures, including the regulatory sandbox framework, become applicable (though EU Member States have until 2 August 2027 to operationalise at least one national sandbox).

• Market surveillance and EU database: The EU database for high-risk AI systems, market surveillance procedures, and safeguard clauses is launched. The revised rules confer exclusive competence on the AI Office for AI systems built on general-purpose AI models where the model and system share the same provider, and for systems integrated into very large online platforms or search engines under the Digital Services Act.

• AI Office enforcement powers (inserted by the AI Omnibus): the AI Office's expanded investigative and enforcement powers – including requests for information, on-site inspections, decisions on non-compliance, and a five-year limitation period – are applicable. These extend to access to AI systems, premises, records and data, preservation orders, commitments, fines and periodic penalty payments, all subject to the Charter of Fundamental Rights of the European Union compliance, rights of defence, access to the file, confidentiality safeguards and CJEU review. Concrete takeaways: the five-year limitation period should shape document retention and litigation-hold protocols for technical documentation, logs and investigation materials.

• AI literacy: The AI Omnibus rewrote the AI literacy obligation from a duty to “ensure” a sufficient level of AI literacy into a duty to “take measures to support the development of” AI literacy – an obligation of means rather than result, but still binding on every provider and deployer. Concrete takeaways: Companies should maintain evidence of compliance, such as an AI inventory, training records, and an internal AI policy.

The most significant change introduced by the AI Omnibus is the deferral of the classification and requirements for high-risk AI systems and the obligations for providers, deployers, and other actors in the AI value chain. Originally scheduled for 2 August 2026, these provisions are now split:

• December 2027 (Annex III systems): Systems classified as high-risk under Article 6(2) and Annex III EU AI Act (stand-alone use-case categories such as biometric identification, employment, law enforcement and administration of justice) will become subject to the full high-risk regime from 2 December 2027.

• August 2028 (Annex I systems): Systems classified as high-risk under Article 6(1) and Annex I EU AI Act (AI as safety components in products regulated under EU product-safety harmonisation legislation such as medical devices and toys) will become subject to the full high-risk regime from 2 August 2028.

The AI Omnibus extends several measures previously reserved for micro, small and medium-sized enterprise (“SME”) to small mid-cap companies (“SMC”), providing broader proportionate treatment.

• SMEs are enterprises that employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million.

• SMCs are enterprises that do not qualify as SMEs but employ fewer than 750 persons and have an annual turnover not exceeding EUR 150 million or an annual balance sheet total not exceeding EUR 129 million.

Notably, this means a simplified technical documentation form for high-risk AI systems, proportionate quality management system requirements, reduced caps on administrative fines, and priority access to AI regulatory sandboxes. In addition, the AI Omnibus introduces an EU-level regulatory sandbox alongside the national sandboxes, expanding opportunities for supervised testing. These measures are particularly relevant for fintech companies and smaller financial institutions deploying AI-based systems for credit assessment, fraud detection, or customer on-boarding, which may qualify as high-risk once those provisions take effect.

The EU AI Act's territorial and extraterritorial scope, as set out in Article 2, continues to apply to Swiss companies in two scenarios: (i) providers placing AI systems or GPAI models on the EU market, regardless of establishment; and (ii) situations where an AI system's output is used within the EU[1].

Key action items include:

• Companies offering consumer-facing generative AI functionality accessible to EU users should screen their product features before 2 December 2026.

• The deferral of high-risk obligations to 2 December 2027, respectively 2 August 2028 provides additional lead time for companies developing AI in sensitive domains – such as credit scoring, anti-money-laundering (AML) screening, and customer risk profiling. For financial institutions acting as provides, this means that AI-powered chatbots, virtual assistants, and robo-advisory tools accessible to EU clients must as of 2 Auguste 2026 comply with the transparency obligations, even if the high-risk conformity assessment for credit-scoring or AML models is deferred (see chapter 2 above).

• Non-EU GPAI providers active in the EU market continue to require an EU-based authorised representative. The AI Office's expanded investigative powers now provide a stronger enforcement mechanism.

• The AI Office's exclusive competence under the revised Article 75(1) of the EU AI Act covers AI systems built on general-purpose AI models where the model and the system are developed by the same provider or by providers forming part of the same undertaking. For operators falling within this scope, the competent authority for enforcement purposes is the AI Office, not the national market surveillance authority. Companies should verify whether they fall within this perimeter.

• SMCs now benefit from a partial alignment with the reduced penalty treatment afforded to SMEs: certain fines are capped at the lower of the specified percentage or fixed amount for small mid-cap companies. However, this partial alignment does not extend to the most severe penalty including the new non-consensual deepfake ban discussed.

• More broadly, the AI Omnibus extends to SMCs several measures previously reserved for SMEs, in particular simplified technical documentation for high-risk AI system and proportionate quality-management-system requirements.

• The amending Regulation also creates an EU-level regulatory sandbox, particularly relevant for fintechs and smaller financial institutions deploying high-risk AI systems for credit assessment, fraud detection or customer on-boarding.

[1] For further information on the geographical implications of the AI Act please refer to our Legal Insight published on 2 August 2025

The EU AI Act's phased implementation continues well beyond 2026. The upcoming key milestones are: