The right question is not “How many days are left?” The right question is “Which duties apply now, which have a later statutory application date, and what evidence should we build before then?”
Current law and provision-specific dates
Confirmed current-law deadlines
- The original Article 5 prohibited practices: applied from 2 February 2025; the specified new Regulation (EU) 2026/1744 provisions apply from 2 December 2026.
- Article 4 AI literacy: applied from 2 February 2025.
- GPAI obligations: applied from 2 August 2025.
- Article 50 generally applied from 2 August 2026; the narrow Article 111(4) transition covers only certain Article 50(2) systems.
- Relevant Article 6(2)/Annex III high-risk provisions: 2 December 2027.
Later statutory dates to plan for
- Regulation (EU) 2026/1744 shifts the relevant high-risk application dates.
- Article 6(2)/Annex III provisions apply from 2 December 2027.
- Article 6(1)/Annex I product-integrated provisions apply from 2 August 2028.
- Keep these later dates separate from duties that already apply.
The rational operating model is simple: run your programme against the consolidated law while recording the application date for each route.
The 5-step action plan for SMEs
1. Build your AI inventory. Record every system you build, deploy, or procure, including embedded AI features inside third-party software. Shadow AI is still the easiest way to fail this law by accident.
2. Classify each system. Separate prohibited, high-risk, transparency-relevant, GPAI-related, and minimal-risk use cases. Do not dump everything into one “AI” bucket.
3. Screen Article 5 and Article 4 first. Article 4 and the original Article 5 prohibitions already apply; the specified new Article 5 provisions apply from 2 December 2026. These routes are the fastest way to identify immediate legal exposure or avoidable operational weakness.
4. Prioritise Annex III and Article 50 workstreams. High-risk evidence, documentation, and transparency design should run as parallel tracks, not sequential afterthoughts.
5. Centralise documentation. Regulators will inspect evidence before they admire architecture diagrams. If a control is not evidenced, it is weak. If a decision is not documented, it will be attacked.
What regulators are likely to inspect first
- Visible prohibited-practice exposure.
- Whether you can classify your systems coherently.
- Whether documentation exists for systems you call high-risk or transparency-relevant.
- Whether staff dealing with AI have any defensible literacy measures at all.
What this means for SMEs with limited budget
Do not wait for perfect standards. Do not wait for final codes. Do not wait for the Omnibus to “save” you. Inventory, classification, literacy, prohibited-practice screening, ownership, and evidence collection are good investments under every scenario.
For the statutory sequence, read the current application-date timeline. For first-pass triage, use the 2-minute quick quiz and the 12-question Compliance Checker.
About the author: Abhishek G Sharma is the founder of Move78. He holds ISO 42001 Lead Auditor, CISA, CISM, CRISC, and CEH certifications. He brings over 20 years of practitioner experience in cybersecurity, AI governance, and enterprise risk management.
Disclaimer: This analysis is for educational purposes only and does not constitute legal advice. Consult qualified counsel for binding compliance decisions. Last updated: 2 September 2026.