The Digital Omnibus is now in force: what actually changes for SMB AI governance
The Digital Omnibus officially entered into force in late July 2026. What was conditional is now settled, and a new prohibition appears. Here is what it means for French SMBs and mid-sized companies.
Since July 27, 2026, the Digital Omnibus is no longer a hypothesis. Published in the Official Journal of the European Union on July 24, it entered into force three days later. What had been presented since June as "pending Council adoption" is now settled. For business owners who followed this file with reasonable skepticism, the question is no longer whether the delay will happen, but what to do now that it has been confirmed.
The text sets two deadlines. Stand-alone high-risk systems under Annex III, recruitment, credit, biometrics, education, shift from August 2, 2026 to December 2, 2027. For AI embedded in already-regulated products, medical devices, industrial machinery, the delay runs to August 2028. What does not change deserves equal attention: Article 50 transparency obligations, in force since August 2, 2026, general-purpose model rules since August 2025, Article 5 prohibitions since February 2025. The text also introduces something that is not a relaxation at all, an explicit ban on tools generating non-consensual intimate images and child sexual abuse material.
In my recent conversations with business owners, I see the same misreading as after the June vote. Many treat this confirmation as good news that justifies waiting. It is the opposite. The real compliance risk for a French SMB in 2026 does not come from Annex III, it comes from the CNIL. Recruitment is explicitly listed among its priority control themes for 2026, with a stated focus on AI-driven CV screening and candidate scoring. That oversight has no moratorium and no extra delay. It applies now to any company processing candidate data, regardless of size.
This is a pattern I see across most of my engagements. Companies follow European news closely, and miss that their immediate risk is national. An SMB using an ATS with automated scoring, an HR chatbot, or an AI screening tool must document that processing today, independent of any delay to 2027 or 2028. Confusing the European timeline with CNIL priorities is a costly mistake.
With the usage inventory, in week one: mapping actual AI usage, HR included, before asking which text applies on which deadline. A company that does not know what tools its HR teams actually use can neither answer a CNIL inspection nor prepare for 2027. The Digital Omnibus clarified a European calendar. It clarified nothing about what happens inside the tools your teams are using this week. A five-business-day diagnostic shows you exactly where you stand.
Frequently asked questions
Has the Digital Omnibus definitively entered into force?
Yes. The text was published in the Official Journal of the EU on July 24, 2026 and entered into force on July 27, 2026. What was conditional on Council adoption (following Parliament's vote on June 16, 2026) is now settled.
Which deadlines actually change?
Obligations for stand-alone high-risk systems under Annex III (recruitment, credit, biometrics) are pushed to December 2, 2027. For AI embedded in already-regulated products (medical devices, industrial machinery), the delay runs to August 2, 2028.
What stays the same despite this delay?
Article 50 transparency obligations (labeling AI content, disclosing chatbots), general-purpose model obligations in force since August 2025, and the Article 5 prohibitions in force since February 2025. GDPR has applied without interruption throughout.
What is new in this text?
An explicit ban on AI tools generating non-consensual intimate images (nudifiers) and child sexual abuse material, added to Article 5 of the AI Act. This is not a relaxation, it is a tightening on this specific point.
Why does the CNIL remain the most concrete risk for an SMB in 2026?
Because recruitment is explicitly listed among the CNIL's priority control themes for 2026, with a stated focus on AI-driven CV screening and candidate scoring. This oversight applies now, independent of the AI Act timeline.
Does an SMB with no high-risk system need to care about any of this?
Yes, if it runs a customer-facing chatbot, generates marketing visuals with AI, or screens applications with an automated tool. These common uses remain subject to transparency obligations and GDPR regardless of the high-risk system delay.
Does the delay specifically benefit small businesses?
The Digital Omnibus extends certain facilities (regulatory sandboxes, lighter documentation, national support) to companies with fewer than 750 employees. But these facilities concern the form of compliance, not whether it applies.
Where should a company start to clarify this regulatory framework?
The Inventory step, in week one, remains the starting point: without mapping actual AI usage, no company can know whether it is affected by transparency obligations, a CNIL inspection, or the future high-risk regime.