Published on October 14, 2026 · The mitza.es team
If you read that the European AI Regulation is being “postponed”, that's only half true. The so-called Digital Omnibus, an amending regulation agreed in early May 2026 and in force since July 27, has delayed the obligations for high-risk AI systems, but it has left untouched the transparency requirements that have applied since August 2, 2026. For an SME with its own website, that second part is what matters, and it's the one we cover in our article on what changes for your website and your chatbot.
What has been postponed: high-risk systems
The main change affects high-risk AI systems, the ones used in sensitive areas such as recruitment, credit scoring, education or border control:
- Annex III (stand-alone high-risk systems): from August 2, 2026 to December 2, 2027.
- Annex I (AI embedded in regulated products): to August 2, 2028, compared with the August 2, 2027 previously set.
According to Winston Taylor, these dates no longer depend on technical standards and guidance being published: they are now fixed. If your business doesn't develop or use AI in those areas, this postponement barely touches you.
What hasn't moved: Article 50 transparency
Article 50 has not been amended and applies from August 2, 2026, according to Gibson Dunn and Usercentrics. That means you are still required to disclose that an AI is responding when your website uses a chatbot, unless that's obvious from the context, and to clearly indicate when an image, audio or video generated or manipulated with AI appreciably resembles real people, places or events.
There's one nuance with its own date. Machine-readable marking of synthetic content (Article 50.2) is an obligation on the providers of generative systems, not on those who use them. Systems already placed on the market before August 2, 2026 have until December 2, 2026; new ones must comply from the moment they reach the market. In practice, your SME depends on the tool it uses (image, video or voice generator) building in that marking.
Changes that do affect you as a business
- AI literacy (Article 4): still in force since February 2025, but softened. Companies must take measures to support the AI training of their staff, without having to guarantee a specific level for each person.
- New prohibitions: systems that generate non-consensual intimate images (the so-called “nudifiers”) and child sexual abuse material are banned, with a transitional period until December 2, 2026.
- Relief for SMEs and “small mid-caps”: the measures designed for SMEs are extended to companies with fewer than 750 employees and up to €150 million in turnover (or €129 million on the balance sheet), with simplified documentation, according to Orrick.
Timeline at a glance
- February 2, 2025: prohibitions and AI literacy.
- August 2, 2026: Article 50 transparency (chatbots, synthetic content and deepfakes).
- December 2, 2026: end of the marking deadline for generative systems already on the market, and new prohibitions.
- December 2, 2027: Annex III high-risk systems.
- August 2, 2028: Annex I high-risk systems.
What to do in your business now
There's no reason to relax about what's already required. If your website has a chatbot or an assistant on WhatsApp Business, check that it identifies itself as an AI; if you publish AI-generated images or videos that look real, label them; and write down which tools you use and what for, because that list is the basis of any later review. It's also worth keeping the security side in mind: the AEPD has already documented the first breach caused by an autonomous AI agent. If you want us to review which obligations apply in your case, you can request an audit of your website and your AI tools.
See every deadline in our digital compliance calendar for SMEs and freelancers.