AI Act: Obligations and Deadlines at a Glance, Updated After the Digital Omnibus

The AI Act regulates AI systems according to their risk and applies directly in all Member States. It entered into force on August 1, 2024; its parts apply in stages (Art. 113). The Digital Omnibus Regulation on AI, Regulation (EU) 2026/1744 of July 8, 2026, was published in the Official Journal on July 24, 2026, and entered into force on the third day thereafter, July 27, 2026. Among other things, it revises Art. 4, adds to the prohibitions in Art. 5, postpones the obligations for high-risk AI systems, and extends relief on fines to small mid-cap companies.

Austria: According to the RTR AI Service Center, there is currently no national implementation of the competences yet, neither for the market surveillance authorities nor for the notifying authority. The AI Service Center sees itself as a point of contact and information hub for companies. The Commission's overview (page dated September 7, 2026, accessed October 25, 2026) did not yet name a single point of contact for market surveillance for Austria.

From deployer to provider: Anyone who puts their own name or trademark on a high-risk AI system, substantially modifies it, or changes the intended purpose of an AI system, including a general-purpose AI system, in such a way that it becomes a high-risk AI system, is itself considered a provider with all provider obligations (Art. 25(1)). Review these cases particularly carefully when you adapt AI tools or use them for new purposes.

• a) Subliminal, purposefully manipulative, or deceptive techniques that materially distort behavior and can cause significant harm.
• b) Exploiting vulnerabilities due to age, disability, or a social or economic situation, causing significant harm.
• c) Social scoring of persons that leads to unjustified or unrelated detrimental treatment.
• d) Predicting the risk of a criminal offense based solely on profiling or personality traits.
• e) Facial recognition databases created through untargeted scraping of facial images from the internet or from surveillance footage.
• f) Inferring emotions in the workplace and in educational institutions, except for medical or safety reasons.
• g) Biometric categorization to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation.
• h) Real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions.
• ba) New from December 2, 2026: AI systems that generate or manipulate realistic intimate or sexual depictions of identifiable persons without their explicit consent.
• bb) New from December 2, 2026: AI systems that generate or manipulate child sexual abuse material within the meaning of Directive 2011/93/EU.

Art. 5(1a) narrows the new prohibitions ba and bb: providers are subject to the prohibition if generating such content is the purpose of the system or is foreseeably and reproducibly achievable without significant technical changes and reasonable safeguards are lacking; deployers only if they use the system for this purpose. The Commission's guidelines on the prohibitions of February 4, 2025, are not binding; only the Court of Justice of the EU can provide a binding interpretation.

Annex III names eight areas: biometrics, critical infrastructure, education, employment and workers management, access to essential services, law enforcement, migration, asylum and border control, and administration of justice and democratic processes. Particularly relevant for companies: AI for screening, filtering, and evaluating applications, for decisions on promotion or termination, and for performance evaluation (point 4), as well as for assessing the creditworthiness of natural persons and for pricing in life and health insurance (point 5(b) and (c)). Exception: a system under Annex III is not high-risk if it poses no significant risk and meets one of the four conditions of Art. 6(3), for example if it only performs a narrow procedural task or a preparatory task; with profiling of natural persons, it is always high-risk.

A provider that relies on this exception documents the assessment before the system is placed on the market or put into service, and registers it (Art. 6(4), Art. 49(2)).

• Use the system in accordance with the provider's instructions for use (Art. 26(1)).
• Assign human oversight to persons with the necessary competence, training, and authority (para. 2).
• Check input data, to the extent it is under your control, for relevance to the purpose and representativeness (para. 4).
• Monitor operation; in case of risk, inform the provider and market surveillance and suspend use, report serious incidents without undue delay (para. 5).
• Keep automatically generated logs for at least six months, to the extent they are under your control (para. 6).
• Before use in the workplace, inform workers' representatives and affected employees (para. 7).
• Inform affected persons when the system makes or assists in decisions about them (para. 11).
• Use the provider's information for the data protection impact assessment (para. 9).
• Fundamental rights impact assessment if you, as a deployer, are a body governed by public law or a private entity providing public services (except for critical infrastructure, Annex III point 2), or use AI for creditworthiness or for life and health insurance (Art. 27).

After the amendment by Regulation (EU) 2026/1744, these obligations apply to systems under Annex III from December 2, 2027, and to systems under Annex I from August 2, 2028. Systems placed on the market before then are only covered if their design is significantly changed; systems for public authorities must be brought into compliance by August 2, 2030 (Art. 111(2)).

The information must be provided clearly and distinguishably at the latest at the time of the first interaction or exposure and must be accessible (Art. 50(5)).

Providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. Technical knowledge, experience, education and training, the context of use, and the persons on whom the systems are used must be taken into account. Providers and deployers are not required to guarantee a specific level of literacy (Art. 4(1) as amended by Regulation (EU) 2026/1744). The Commission and the Member States provide support, especially for SMEs; the Commission publishes practical examples (para. 2).

Previously, Art. 4 required measures to ensure, to their best extent, a sufficient level of AI literacy of staff. This goal no longer applies; the measures now support the development of literacy. An internal AI policy with training is an obvious choice (TOMORIS recommendation); the "AI usage policy" download provides a template for this.

For SMEs, including start-ups, the lower of the two amounts applies in each case (para. 6); the same applies to small mid-cap companies for fines under paras. 4 and 5 (para. 6a, new). The Member States lay down the rules on penalties; they take into account the interests of SMEs and small mid-caps (para. 1).

• All AI systems in use and planned recorded, including AI features in existing software and cloud services.
• Your own role determined for each system: deployer, provider, or both; cases under Art. 25(1) reviewed.
• Prohibitions under Art. 5 ruled out, especially emotion recognition in the workplace and, from December 2, 2026, the new prohibitions ba and bb.
• Use in areas under Annex III reviewed, such as applications, performance evaluation, creditworthiness; result documented.
• Transparency under Art. 50 implemented, depending on the role: as a provider, notice for chatbots and machine-readable marking (paras. 1 and 2); as a deployer, information on emotion recognition, labeling of deepfakes and of AI texts on matters of public interest (paras. 3 and 4).
• Measures for AI literacy defined and documented, such as a policy, training, a contact person.
• Instructions for use and information requested from providers that you need for your obligations and the data protection impact assessment.
• Responsibility within the company defined and developments tracked: Commission guidelines, standards, national authorities.