30 September 2026 -eBuilder supplies virtual CISO-services to a prominent international law firm. 21 September 2026 -eBuilder signs an agreement with a medtech company for MDR/SOC, Security Awareness and Identity Protection services. 15 September 2026 -eBuilder signs an agreement with two Swedish transportation companies for Complorer Security Awareness Training Services 11 August 2026 -eBuilder signs an agreement with a local government for NIS2-hotline services 8 April 2026 -eBuilder signs an agreement for MDR/SOC with a hotel business. 13 March 2026 -eBuilder signs an agreement for SOC-operations with a Swedish municipality. 2 March 2026 -Large international steel company chooses eBuilders Complorer for cybersecurity training. 2 March 2026 -Large international steel company chooses eBuilder as supplier for Penetration testing.
Company News

What Applies Under the EU AI Act From August 2026 and What Moved

Jude Perera
November 4, 2026 9 min read

Key Takeaways

  • Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is law, not a proposal.
  • Annex III high-risk obligations now apply from 2 December 2027. High-risk AI in products covered by Annex I follows on 2 August 2028.
  • Article 50 transparency duties for chatbots and deepfakes have applied since 2 August 2026. Generative systems already on the market before that date have until 2 December 2026 to add machine-readable marking.
  • New prohibitions on AI that generates non-consensual intimate imagery or child sexual abuse material apply from 2 December 2026.
  • In Sweden PTS, IMY, Finansinspektionen, Läkemedelsverket and Swedac hold interim AI Act assignments until 31 December 2026.
  • Fines reach EUR 35 million or 7% of worldwide turnover for prohibited practices and EUR 15 million or 3% for breaches of Article 50.

The Deadline Moved for High-Risk AI but Not for Transparency

For two years European AI compliance plans were built around one date. On 2 August 2026 the EU AI Act’s high-risk rules for recruitment, credit scoring and critical infrastructure were due to apply. On 27 July 2026, six days earlier, Regulation (EU) 2026/1744 entered into force and moved those rules to December 2027. So if you are a CISO or legal counsel asking what applies under the EU AI Act from August 2026, the answer is more than most calendars show. The high-risk deadline moved. Transparency did not.

The reason is a mismatch between what was delayed and what was ready. The Commission proposed the Digital Omnibus on AI on 19 November 2025 because the harmonised standards high-risk providers need were not finished. The Omnibus answered that with a fixed calendar. Transparency had no such gap. The Commission published its final Code of Practice on the transparency of AI-generated content on 10 June 2026 and its Article 50 guidelines on 20 July 2026, so that duty went live on schedule.

What is the Digital Omnibus on AI?

The Digital Omnibus on AI is Regulation (EU) 2026/1744, an amending regulation dated 8 July 2026 that changes when and how parts of the EU AI Act apply. It fixes new dates for high-risk obligations, adds two prohibitions, softens the AI literacy duty and widens the AI Office’s supervisory powers. It leaves the Act’s risk framework intact.

Provisional agreement came on 7 May 2026 and the Council adopted the text on 29 June. Published in the Official Journal on 24 July 2026, it entered into force three days later rather than the usual twenty because the original deadline was so close.

The amended Article 113 now carries the dates. Chapter III obligations for systems that are high-risk under Article 6(2) and Annex III, such as AI used in employment, education, credit scoring or critical infrastructure, apply from 2 December 2027. Systems that are high-risk under Article 6(1) as safety components of products covered by Annex I, such as medical devices, follow from 2 August 2028.

A Swedish company screening CVs with AI is therefore in Annex III territory from 2 December 2027. If the same company runs a customer chatbot, the disclosure duty for that chatbot has applied since 2 August 2026.

The Dates That Matter After the Omnibus

2 February 2025Prohibited practices and the AI literacy duty apply.
2 August 2025General-purpose AI model obligations, governance and the penalty framework apply.
27 July 2026Regulation (EU) 2026/1744 enters into force.
2 August 2026Article 50 transparency and the rest of the Act apply unless dated otherwise.
2 December 2026New prohibitions apply. Marking deadline for generative systems placed on the market before 2 August 2026.
2 December 2027High-risk obligations apply to Annex III systems.
2 August 2028High-risk obligations apply to Annex I systems.
2 August 2030Legacy high-risk systems used by public authorities must comply.

What Still Applies From 2 August 2026

Providers must design systems that interact with people so those people know they are dealing with AI, unless that is obvious. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed.

Deployers who publish deepfakes must disclose that the content is artificially generated or manipulated. The same applies to AI-generated text published to inform the public on matters of public interest, unless it has had human review and someone holds editorial responsibility.

Providers of generative systems must also mark outputs in a machine-readable format. Under the new Article 111(4), systems placed on the market before 2 August 2026 have until 2 December 2026. Systems placed on the market from that date get no grace period.

Article 4 on AI literacy has applied since 2 February 2025. The Omnibus softened it, so providers and deployers must now take measures to support a sufficient level of AI literacy among staff rather than ensure it. Keep a record of those measures.

Who Must Comply and in Which Role

Obligations attach to roles. A provider develops an AI system or has one developed and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. Many organisations are both, building one system and licensing another.

The role can change. Under Article 25 a deployer becomes the provider of a high-risk system if it puts its own name on that system, makes a substantial modification to it or changes another system’s intended purpose so that it becomes high-risk. The Act also reaches organisations outside the EU where a system’s output is used in the EU.

Who Carries Which Duty Today

  • Providers : Article 50(1) and 50(2) design and marking duties now and Annex III conformity work from December 2027.
  • Deployers : Article 50(3) and 50(4) disclosure duties and Article 4 literacy measures now and Article 26 high-risk obligations from December 2027.
  • Model providers : General-purpose AI model obligations since August 2025, with Commission fines from August 2026.

The EU AI Act for Swedish Companies

The AI Act applies directly in Sweden, but each Member State must name the authorities that enforce it. In a decision published on 12 June 2026 (Fi2026/01365) the government gave PTS, IMY, Finansinspektionen, Läkemedelsverket and Swedac interim assignments as national competent authorities. They run until 31 December 2026 while supplementary legislation based on the SOU 2025:101 inquiry is prepared.

PTS is the single point of contact, carries market surveillance for certain prohibited practices and high-risk systems and must set up a national regulatory sandbox. IMY, formerly Datainspektionen, confirmed on 15 June 2026 that its remit covers AI used in areas including law enforcement and credit assessment. Läkemedelsverket covers high-risk AI in medical devices and in vitro diagnostics. Watch for the permanent arrangement after 31 December 2026.

What to Do Now and Before the Next Two Deadlines

Inventory every AI system you provide or deploy and record your role for each. Check every customer-facing chatbot and every piece of published synthetic media against Article 50 now.

By 2 December 2026 generative systems placed on the market before 2 August 2026 need machine-readable marking. Providers of image, video or audio generation also need safeguards against the two new Article 5 prohibitions, which reach a provider when such output is reasonably foreseeable and adequate safeguards are missing. Deployers are caught when they use a system for that purpose.

Use 2027 to build the Annex III evidence. That means risk management, data governance, technical documentation, logging, human oversight and the Article 15 controls, plus a fundamental rights impact assessment where Article 27 requires one.

Legacy Systems and Significant Changes in Design

Article 111(2) brings high-risk systems placed on the market before the Chapter III date into scope only if they later undergo significant changes in their design. Systems intended for use by public authorities must comply by 2 August 2030 regardless.

That test uses different words from the Article 25 concept of substantial modification. How the two relate is still being interpreted, so record design changes against both.

Major Risk and Attack Types Behind the Rules

Several AI Act duties are security controls in practice. Article 15 requires high-risk systems to resist attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities. It names the attacks. They are data poisoning, model poisoning through pre-trained components, adversarial examples or model evasion, confidentiality attacks and model flaws.

Prompt injection, where crafted input overrides a model’s instructions, is the closest everyday relative of those evasion attacks and targets the same chatbots Article 50 covers. Deepfakes are the other live risk.

The Arup Deepfake Video Call

In January 2024 a finance employee in Arup’s Hong Kong office joined a video call with what appeared to be the company’s chief financial officer and colleagues. All of them were deepfakes. He made 15 transfers totalling HK$200 million, about US$25.6 million, to five bank accounts. Arup confirmed in May 2024 that it was the victim and said its financial stability and internal systems were not affected.

Article 50 labelling binds lawful deployers and would not have stopped criminals. A mandatory callback on a known number before any unusual payment would have.

Penalties for Non-Compliance

The fine ceilings in Article 99 did not move. Each is the higher of a fixed sum or a share of worldwide annual turnover. For SMEs, including start-ups, the lower of the two applies. The Omnibus extends that to small mid-caps for the two lower bands.

Member States lay down the detailed penalty rules. In Sweden those sit with the supplementary legislation proposed in SOU 2025:101.

The Fine Bands in Article 99

Prohibited practices under Article 5 carry fines of up to EUR 35 million or 7% of worldwide annual turnover. Breaches of most other obligations, including Article 50 transparency and deployer duties, carry up to EUR 15 million or 3%. Supplying incorrect or misleading information to authorities carries up to EUR 7.5 million or 1%.

How to Maintain Compliance and Secure Your AI

Review the AI inventory every quarter, because a new feature can move a system into Annex III.

Test every chatbot and generative feature against Article 50 before release. Confirm that the disclosure appears and outputs carry their marking.

Record the AI literacy measures you take, who received them and when.

Test models the way Article 15 expects attackers to approach them, including prompt injection, data poisoning and model evasion.

Write AI Act roles and marking duties into supplier contracts. Watch for harmonised standards and the Swedish legislation that replaces the interim assignments.

Three Dates Now Drive the Plan

The Digital Omnibus gave high-risk providers and deployers sixteen more months. It gave transparency nothing and added a December deadline that many calendars still miss. Check Article 50 coverage now, close the marking gap and the new prohibitions by 2 December 2026 and use 2027 to build the Annex III evidence that conformity will demand.

Frequently Asked Questions

What applies under the EU AI Act from 2 August 2026?

Article 50 transparency duties apply from 2 August 2026, including chatbot disclosure and deepfake labelling. The Commission can also fine general-purpose AI model providers from that date. Prohibitions and AI literacy have applied since February 2025. Annex III high-risk obligations moved to 2 December 2027 and Annex I obligations to 2 August 2028.

Has the Digital Omnibus on AI been adopted?

Yes. It was adopted as Regulation (EU) 2026/1744, dated 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Its dates are binding law rather than a proposal, so compliance plans should follow the amended Article 113.

Am I a provider or a deployer under the AI Act?

You are a provider if you develop an AI system or have one developed and place it on the market under your own name. You are a deployer if you use an AI system under your own authority at work. Many organisations are both. Article 25 can also turn a deployer into a provider.

Which authority supervises the AI Act in Sweden?

Five authorities hold interim assignments until 31 December 2026. PTS is the single point of contact and sets up the regulatory sandbox. IMY covers areas including law enforcement and credit assessment and Läkemedelsverket covers medical devices. Finansinspektionen and Swedac complete the group while supplementary Swedish legislation is prepared.

To test and monitor the AI systems in your inventory, see eBuilder Security’s AI Security and AIDR service.

This post is also available in: Svenska

Related Articles

All articles