AI Act: what applies to your SME since 2 August 2026, and what the omnibus postponed

2 August 2026 has come and gone, and with it part of the European AI Act's obligations have entered into application. At the same time, the digital omnibus adopted this summer pushed the high-risk chapter back by more than a year. Many SME leaders are left with a sense of fog: deal with it now, or wait? We take stock of what actually applies, what has been postponed, and what it concretely changes for an SME in French-speaking Switzerland.

What has applied since 2 August 2026

For most SMEs, the heart of the matter is Article 50 of the regulation, which deals with transparency. Since 2 August 2026, three obligations are in force for companies that deploy AI towards their customers, job applicants or the public:

• Chatbots must disclose themselves. A conversational assistant on your website, in your app or on the phone must make it clear to the person that they are talking to a machine, unless this is obvious from the context.

• AI-generated content must be marked. Text, images, audio or video produced or manipulated by an AI system must carry a machine-readable marking. Systems placed on the market before 2 August 2026 have until 2 December 2026 for this technical marking, but not for the chatbot disclosure duty.

• Deepfakes and content of public interest must be explicitly labelled. A synthetic video of an executive, a generated visual presented as a photograph, a long-form article written by AI: the reader must be told.

On top of this come older obligations that are easily forgotten: since February 2025, manipulative practices and social scoring are banned, and Article 4 requires companies to ensure a sufficient level of AI literacy among the staff who use these systems. The penalty regime, up to 35 million euros or 7% of worldwide turnover, has been active since August 2025.

What the digital omnibus has postponed

The omnibus regulation, published in the Official Journal of the European Union at the end of July 2026 after the co-legislators' agreement of 7 May, moves two major deadlines. The so-called high-risk systems of Annex III, meaning AI used in recruitment, employee evaluation, credit scoring, access to education or to essential services, will only be subject to their full obligations from 2 December 2027, instead of 2 August 2026. AI embedded in already regulated products (machinery, medical devices, toys) moves from August 2027 to August 2028.

These new dates are fixed: unlike what had been discussed, they no longer depend on the availability of harmonised standards. The omnibus also brings three explicit relief measures for SMEs: simplified technical documentation that notified bodies will have to accept, fines capped at the lower of the two amounts (absolute value or percentage of turnover), and priority access to regulatory sandboxes.

This postponement should be read for what it is: time to prepare, not an exemption. An SME that uses a CV screening tool or a customer scoring engine will need, in December 2027, to be able to document the system, supervise its decisions and inform the people concerned. Sixteen months is short when you first have to inventory what you are using.

What about a Swiss SME?

Switzerland has not transposed the AI Act and will not do so. On 12 February 2025 the Federal Council opted for a sector-specific, technology-neutral approach built on existing law: the revised Data Protection Act, FINMA rules for finance, the Swissmedic framework for health. The Confederation signed the Council of Europe Framework Convention on AI on 27 March 2025 and plans to ratify it by the end of 2026; a consultation on the legislative adjustments is expected around the same time, with entry into force in 2028 at the earliest.

This does not shield SMEs in Romandy from the European regulation, for two reasons. The first is legal: the AI Act applies as soon as an AI system is placed on the Union market or its output is used there. A chatbot available to French or German customers, a tool that qualifies European prospects, a content generation service sold to a client in Lyon: all of this falls within scope. The second is contractual: large European buyers already require compliance guarantees from their Swiss suppliers, often before the texts formally apply. This is what is known as the Brussels effect, and it shows up in tenders long before it shows up in court.

An example: a Geneva accounting firm with 25 staff

Consider a fiduciary firm in Geneva serving Swiss and French clients. It uses an AI assistant on its website to answer routine questions, a tool that drafts tax summaries which staff review before sending, and a candidate pre-screening module inside its HR software. Here is how we would read its situation.

The website chatbot is concerned today: it must state that it is a machine and, since it addresses customers in France, it falls under the AI Act through Article 50. The cost of compliance is marginal: a welcome message, a line in the terms of use, a hand-over procedure to a human. The tax summaries are reviewed and signed by an employee: this is assisted use, not automated decision-making, and the main obligation is staff training (Article 4) and traceability of who validated what. The HR pre-screening module, finally, is a high-risk system under Annex III: the firm has until 2 December 2027 to hold supplier documentation, a formalised human oversight process and clear information for candidates.

Out of three tools, only one requires real work. This is the result we see most often: the inventory halves the perceived burden, because it separates what is assisted, what is automated and what is decisional. According to figures published by Bpifrance in the first half of 2026, a quarter of French SMEs already use AI daily; most of them do not know which category each of their uses falls into, and that is where everything starts.

What we take away

The right answer to the postponement is neither haste nor waiting. We recommend that our clients address four things, in this order: first, an honest inventory of the AI systems in use, including those that teams adopted without saying so; then immediate compliance for transparency uses, chatbots and generated content, which costs little; next, a training plan that documents that staff understand the tools they handle; finally, for the few high-risk uses, a timeline to December 2027 aligned with the solution vendor.

This approach has a merit beyond compliance: it forces the company to put words on what AI actually does in the business, and it is often the first time management has a complete view of it. To see where your SME stands on this path, our AI Barometer 2026 offers a sector diagnosis in a few minutes. And if you would rather talk it through in person, we are in Carouge, a few minutes from the centre of Geneva.