AI Act: a year's reprieve, not a holiday
Updated on 17 October 2026.
What changed this summer
The AI Act (the European regulation on artificial intelligence) has applied in stages since 2024. On 27 July 2026, a revision came into force: Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”. It does three things that concern you:
- it postpones the obligations for high-risk systems, which were due to apply on 2 August 2026;
- it relaxes the obligation to train staff;
- it adds a prohibition: tools that produce intimate images of real people without their consent.
The press spoke of “a year's reprieve”. That is true for a minority of companies. For most SMEs, what concerns them already applies.
The timetable on one page
| When | What | You are concerned if… |
|---|---|---|
| Since February 2025 | Prohibited practices (social scoring, manipulation, emotion recognition in the workplace…) | A tool analyses your employees' mood or emotions, for example during calls or video meetings |
| Since February 2025, reworded in July 2026 | Staff AI literacy | Your teams use ChatGPT, Copilot, Gemini or any other AI tool |
| Since 2 August 2026 | Transparency: chatbots and generated content | You have a chatbot on your website, or you publish realistic AI-generated images, voices or videos |
| 2 December 2026 | Technical marking of content for tools already on the market; new ban on non-consensual intimate images | Mainly tool vendors; for you, choosing compliant tools |
| 2 December 2027 (instead of August 2026) | High risk: recruitment, staff evaluation, credit, education… | You use software that screens applications or evaluates workers |
| 2 August 2028 (instead of August 2027) | High risk in regulated products (machinery, medical devices…) | You manufacture or integrate such products |
What you need to do now
1. Train your team, without bureaucracy
The original text required companies to “ensure” a sufficient level of AI literacy. Since the revision, the obligation is to take measures to support its development: an obligation of means, not of result. For a small business, a proportionate response has three parts:
- a short training session (what the tool does, its typical mistakes, the data never to put into it);
- an AI usage policy (see our AI usage policy article, in French);
- a point of contact who answers questions and keeps the list of tools.
Keep a record: date of the training, participants, version of the policy. That is what you will be asked for in an inspection.
2. Say when it's a machine
Since 2 August 2026:
- a visitor chatting with a chatbot on your website must know they are talking to a machine (one sentence at the top of the window is enough);
- realistic images, voices or videos generated or altered by AI (a fake testimonial, a doctored photo of your premises) must be labelled as such;
- a generated text published to inform the public on a matter of public interest must be labelled too, unless it has been reviewed by a person who takes editorial responsibility for it. A blog post you review and sign is therefore not concerned; an automatically published news feed is.
3. Check that no tool crosses the red line
The prohibited practice most likely to concern an SME is recognising workers' emotions (except for medical or safety reasons). Some call-centre or meeting-analysis software offers this kind of feature: switch it off.
How to use the delay
If you use software that screens CVs, ranks candidates or evaluates your employees' work, you will have obligations from 2 December 2027: use the tool according to the vendor's instructions, entrust its oversight to a competent person, keep the logs, inform workers and candidates. The delay is the time to ask the vendor now: “will your tool be compliant, and what will I need to do on my side?”. A vendor with no answer by late 2026 probably won't have one by late 2027.
For everyone else, the delay changes nothing. The tool inventory and the usage policy remain the right starting point, and they also help with the GDPR (in French), which fully applies to all the personal data you give to an AI.
Who supervises, and what it costs
In Belgium, the 2025-2029 federal government agreement provides for the BIPT (Belgian Institute for Postal Services and Telecommunications) to be the market surveillance authority for the AI Act. The fines laid down in the regulation reach 35 million euros or 7% of worldwide turnover for prohibited practices, and 15 million or 3% for most other breaches. For an SME, the lower of the two amounts applies. For a small business, the main risk is not the fine: it is an incident (customer data in a free tool, an undisclosed deepfake) that damages your customers' trust.
In practice: three options
| Option | What it costs | The risk |
|---|---|---|
| Do nothing | Nothing | AI tools adopted haphazardly, no record of training, an undisclosed chatbot, and a nasty surprise in 2027 if you recruit with an AI tool |
| Do it yourself | Half a day: list of tools, policy, short training, website check | Missing a tool used “on the quiet” or a prohibited feature switched on by default |
| Get support | A few hours of inventory and a training session | The lowest: full inventory, tailored policy, team training, questions for the vendors of your HR software |
Example (illustrative case): a fifteen-person temp agency uses ChatGPT to write its job ads, a chatbot on its website for candidates, and software that automatically ranks incoming CVs. The chatbot didn't say it was a machine: one added sentence fixed that. Training took a morning, and the policy forbids pasting complete CVs into it. For the screening software, the agency wrote to the vendor in October 2026; its answer (compliance planned for mid-2027, with a guide for users) will decide whether it keeps the tool.
For your adviser or IT person
- Text: Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force since 27 July 2026.
- Article 4 (AI literacy): obligation reworded as supporting measures, with no guaranteed individual level.
- Article 50: transparency obligations apply since 2 August 2026; transitional period until 2 December 2026 for content marking (para. 2) by systems already placed on the market; no retroactive marking of content already published.
- High risk: Annex III (recruitment, worker management, credit, education…) on 2 December 2027; Annex I (regulated products) on 2 August 2028.
- New prohibited practices from 2 December 2026: generating realistic intimate images, videos or audio of an identifiable person without their consent, and child sexual abuse material.
- Penalties: Article 99; for SMEs and the new “small mid-caps”, the lower of the percentage or fixed amount.
Test yourself
At ExsIT
The first contact is free: we listen to your needs, then propose an action plan. Inventory of your AI tools (including those adopted spontaneously by the team), usage policy, short documented training, website check, and questions to ask the vendors of your HR software. For detailed legal interpretation, we work alongside your legal adviser.
Sources
CMS. (2026, February 17). AI laws and regulation in Belgium. CMS Expert Guides. https://cms.law/en/int/expert-guides/ai-regulation-scanner/belgium
European Parliament & Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Gerharde, A. (2026, July 30). Digital Omnibus on AI: New deadlines and key amendments to be implemented. COBALT. https://www.cobalt.legal/news-cases/digital-omnibus-on-ai/
Sapuppo, V. G. (2026, July 30). AI literacy: The Digital Omnibus rewrites Article 4 of the AI Act. Law & Technology. https://lawandtechnology.eu/en/ai-literacy-digital-omnibus-article-4-ai-act/