When must high-risk AI systems comply with the requirements?

Systems under Annex III, such as biometrics, education, credit scoring and recruitment and selection, do not need to comply until 2 December 2027, sixteen months later than originally planned. AI in regulated products under Annex I, such as machinery and medical devices, has until 2 August 2028.

Has the Article 4 AI literacy obligation been relaxed as well?

The wording has been softened into a best-efforts obligation rather than an obligation of result, but the responsibility stays with organisations. Article 4 has applied since 2 February 2025 and is not among the articles listed as directly subject to fines.

Is there already Dutch supervision of the AI Act?

The Regulation itself has been largely applicable since 2 August 2026 and applies directly, in the Netherlands too. However, the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) was not yet in force on that date, although the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) and the RDI (Dutch Authority for Digital Infrastructure) have already been designated as coordinating supervisory authorities.

What else has changed in the omnibus package?

The deadline for national AI regulatory sandboxes moves to 2 August 2027, certain SME exemptions are extended to what are known as small mid-caps, and a new prohibition is added on AI systems for generating non-consensual intimate imagery. Meanwhile, the Article 50 transparency obligations apply from 2 August 2026 as planned.

What would SMEs be wise to do now?

Establish which AI your organisation uses and whether it includes high-risk applications, see to the AI literacy of employees who work with AI and record what you have done, and adopt a short AI usage policy. That way you have an answer ready when a regulator, auditor or customer asks for it.

CompliancePublished 6 July 20264 min readLast updated 27 July 2026

EU AI Act simplified in 2026: what really changes for SMEs?

Short answer

The AI Act has not been postponed and has not been fundamentally relaxed. The omnibus package, in force since 27 July 2026 as Regulation (EU) 2026/1744, moves the high-risk deadlines to 2 December 2027 and 2 August 2028 and softens Article 4 into a best-efforts obligation. The prohibited practices and the obligations that already apply remain in place.

Has the AI Act been postponed or relaxed? Dutch SMEs are asking that question in large numbers right now, and the short answer is: a little of both, but much less than the headlines suggest. The omnibus package moves a number of deadlines and simplifies some rules, but the core of the Regulation remains in place. The European Parliament voted in favour on 16 June 2026, the Council gave its final green light on 29 June, the package was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and it entered into force on 27 July 2026. It is therefore no longer a proposal but the law in force. This is what has actually changed, what has stayed the same, and what has been asked of you since 2 August 2026.

On this page

Has the AI Act been postponed or relaxed in 2026?
What exactly does the omnibus package change?
Does the Article 4 AI literacy obligation change?
Where has Dutch supervision got to since 2 August 2026?
What is the sensible course for SMEs now?

Has the AI Act been postponed or relaxed in 2026?

No. The AI Act has not been postponed as a whole, nor has it been fundamentally relaxed. What is happening: the omnibus agreement moves the deadlines for high-risk AI systems, eases some administrative obligations and softens the wording in places, including that of the AI literacy provision. The prohibited practices, the rules for general-purpose AI models and the obligations that already apply remain in force. Anyone who reads the news coverage as 'the AI Act is not going ahead' is therefore drawing the wrong conclusion.

What exactly does the omnibus package change?

The main changes in the agreement, based on the Council's press release and the first legal analyses:

High-risk AI systems under Annex III (including biometrics, education, credit scoring and recruitment and selection) do not have to meet the requirements until 2 December 2027, sixteen months later than the original date of 2 August 2026; AI in regulated products under Annex I (such as machinery and medical devices) not until 2 August 2028.
The Article 50 transparency obligations apply from 2 August 2026 as planned. Only the machine-readable marking of AI-generated content (Article 50(2)) has a transition period until 2 December 2026, and only for systems that were already on the EU market before 2 August 2026. This is an obligation for providers of generative AI, not for companies that use such tools.
The deadline for national AI regulatory sandboxes moves to 2 August 2027.
Certain exemptions for SMEs are extended to what are known as small mid-caps, and a number of administrative requirements are eased in limited cases.
A new prohibition is added on AI systems for generating non-consensual intimate imagery.

Does the Article 4 AI literacy obligation change?

The wording has been softened, but the responsibility stays with organisations. Providers and deployers of AI systems must take measures to support the development of AI literacy among their staff. In addition, the European Commission and the Member States are given an explicit role in promoting AI literacy, for example through training opportunities and information material. Also new is the clarification that no guaranteed level of knowledge per individual is required: it is a best-efforts obligation, not an obligation of result. What has not changed: Article 4 is not among the articles listed as directly subject to fines. Anyone who claims that from 2 August 2026 you risk a fine of €15 million because you have not provided AI training is getting far ahead of the facts.

In practice, little changes. Article 4 has applied since 2 February 2025, and 'demonstrable' remains the key word: if you can show who was trained, in what and when, for example after a targeted training day, you are well aligned with what the softened text asks.

Where has Dutch supervision got to since 2 August 2026?

The Regulation applies; the national machinery is lagging behind. Since 2 August 2026 the AI Act has been largely applicable, and it applies directly, in the Netherlands too. The omnibus package changes nothing about that: the postponed deadlines concern high-risk systems, not the supervisory structure and not the obligations that already apply. What is lagging behind is the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act). It was out for consultation in spring 2026, then went to the Raad van State (Council of State) for an advisory opinion, and was not yet in force on 2 August 2026. In that act, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) and the RDI (Dutch Authority for Digital Infrastructure) are designated as coordinating supervisory authorities, alongside sector regulators such as the NVWA (Netherlands Food and Consumer Product Safety Authority), the Nederlandse Arbeidsinspectie (Netherlands Labour Authority), the ILT (Human Environment and Transport Inspectorate) and the AFM (Dutch Authority for the Financial Markets). In practical terms: the rules apply, but the Dutch enforcement toolkit is not yet complete.

What is the sensible course for SMEs now?

The sober conclusion: if you neither build nor deploy high-risk systems, the omnibus agreement mainly confirms that the basic obligations stay as they were. Three steps that make sense in this half of the year:

Establish which AI your organisation uses and whether any of those applications fall under the high-risk categories; for the latter, you now have until December 2027 or August 2028 respectively.
See to the AI literacy of employees who work with AI and record what you have done; that obligation has applied since February 2025 and remains in place under the agreement.
Adopt a short AI usage policy, so that you have an answer ready when a regulator, auditor or customer asks for it. Since 2 August 2026 that has become a real question.

Sources

Frequently asked questions

Has the AI Act been postponed or relaxed in 2026?: Not as a whole and not fundamentally. The omnibus agreement moves deadlines for high-risk AI systems, eases some administrative obligations and softens the wording in places, but the prohibited practices, the rules for general-purpose AI models and the obligations that already apply remain in force.
When must high-risk AI systems comply with the requirements?: Systems under Annex III, such as biometrics, education, credit scoring and recruitment and selection, do not need to comply until 2 December 2027, sixteen months later than originally planned. AI in regulated products under Annex I, such as machinery and medical devices, has until 2 August 2028.
Has the Article 4 AI literacy obligation been relaxed as well?: The wording has been softened into a best-efforts obligation rather than an obligation of result, but the responsibility stays with organisations. Article 4 has applied since 2 February 2025 and is not among the articles listed as directly subject to fines.
Is there already Dutch supervision of the AI Act?: The Regulation itself has been largely applicable since 2 August 2026 and applies directly, in the Netherlands too. However, the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) was not yet in force on that date, although the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) and the RDI (Dutch Authority for Digital Infrastructure) have already been designated as coordinating supervisory authorities.
What else has changed in the omnibus package?: The deadline for national AI regulatory sandboxes moves to 2 August 2027, certain SME exemptions are extended to what are known as small mid-caps, and a new prohibition is added on AI systems for generating non-consensual intimate imagery. Meanwhile, the Article 50 transparency obligations apply from 2 August 2026 as planned.
What would SMEs be wise to do now?: Establish which AI your organisation uses and whether it includes high-risk applications, see to the AI literacy of employees who work with AI and record what you have done, and adopt a short AI usage policy. That way you have an answer ready when a regulator, auditor or customer asks for it.

This article is for information only and is not legal advice. Market prices and schemes mentioned are indications as of the publication date; check current conditions with the official sources. Translated from the Dutch original.