The EU AI Act in one lesson, including the Digital Omnibus

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is the first broad AI law, and it reaches SAP programs in two ways: through the AI features SAP and other vendors ship, and through the AI you build or configure yourself. It entered into force on 1 August 2024 with obligations phased in over several years. In July 2026 the EU amended it with the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved the high-risk deadlines. This lesson gives you the structure, the roles and the current dates, checked against the Official Journal text. It is not legal advice.

Four risk tiers

Prohibited practices (Article 5)Banned outright, for example social scoring, manipulative techniques causing harm, and emotion recognition at work or school (with narrow exceptions).

High-risk systems (Article 6, Annexes I and III)Allowed with strict duties: risk management, data governance, documentation, logging, human oversight, accuracy and robustness.

Transparency duties (Article 50)People must know when they deal with an AI system, and AI-generated or manipulated content must be marked or disclosed.

Minimal riskMost business AI. No specific duties beyond AI literacy, though good practice still applies.

The AI Act sorts AI systems by risk; most SAP business AI lands in the bottom two tiers, but not all of it.

The Sign-Off Table · thesignofftable.com/academy/sap-ai-301

Separate rules cover general-purpose AI (GPAI) models, the large models behind most generative features. Those duties fall on model providers, not on SAP customers who use a feature built on a model.

Roles: provider or deployer

Your obligations depend on your role for a given system. The provider develops an AI system (or has it developed) and places it on the market or puts it into service under its own name. The deployer uses an AI system under its authority in a professional activity. When SAP ships an AI feature in SAP SuccessFactors or SAP S/4HANA, SAP is normally the provider and your company is the deployer. When your team builds an agent in Joule Studio or an app on the generative AI hub, your company may be the provider of that system. You can also become a provider of a high-risk system by putting your name on it, substantially modifying it, or changing its intended purpose so that it becomes high-risk (Article 25).

Duty	Provider of a high-risk system	Deployer of a high-risk system
Risk management, data governance, technical documentation	Yes	No, but must use the system per instructions
Conformity assessment, CE marking, EU database registration	Yes	Public-sector deployers register their use
Human oversight	Design the system so it can be overseen	Assign competent, trained people with authority to oversee
Logs	Enable automatic logging	Keep logs under its control for at least six months
Input data	Data governance for training data	Make sure input data is relevant and representative
Inform people	Instructions for use	Inform workers' representatives and affected workers before use at work; inform people subject to decisions
Fundamental rights impact assessment (Article 27)	No	Public bodies, private entities providing public services, and deployers of credit scoring and life or health insurance systems

Who does what for a high-risk system (simplified from Articles 16, 26 and 27).

Does the Act apply to you at all?

The Act applies to providers placing AI systems on the EU market, to deployers located in the EU, and to providers and deployers outside the EU where the system's output is used in the EU. Contoso Motor Co. has no EU entities: it operates in the US and, after Wave 2, in Mexico. Its counsel concluded that most of the Act doesn't apply directly, but Contoso adopted the Act's high-risk controls as its internal benchmark, alongside the NIST AI Risk Management Framework, because its AI vendors build to the Act and because a planned European distributor would bring it into scope. That is a common position for non-EU SAP customers, and it is the stance this course follows.

The dates after the Digital Omnibus

Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026 (the third day after publication). Its key change for SAP programs: the high-risk requirements in Chapter III, Sections 1 to 3, now apply from 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III (the "standalone" use cases such as employment and credit scoring), and from 2 August 2028 for systems that are high-risk under Article 6(1) and Annex I (AI in regulated products such as machinery). The original date for both was 2 August 2026.

The AI Act's staged dates, as amended by the Digital Omnibus (Regulation (EU) 2026/1744).

The Sign-Off Table · thesignofftable.com/academy/sap-ai-301

What	Date	Source
Prohibited practices (Article 5) and AI literacy (Article 4)	2 February 2025	Original Article 113
GPAI model obligations, governance, penalties framework	2 August 2025	Original Article 113
General date of application, including Article 50 transparency	2 August 2026	Original Article 113
Two new prohibitions: non-consensual intimate imagery and child sexual abuse material generated by AI	2 December 2026	Omnibus, amended Article 113(a)
Article 50(2) marking for generative systems already on the market before 2 August 2026	2 December 2026	Omnibus, new Article 111(4)
High-risk duties for Annex III systems	2 December 2027	Omnibus, amended Article 113(c)(i)
High-risk duties for Annex I systems	2 August 2028	Omnibus, amended Article 113(c)(ii)
High-risk systems used by public authorities, already on the market	2 August 2030	Article 111(2) as amended

Application dates checked against the Official Journal text of Regulation (EU) 2026/1744.

Other omnibus changes worth knowing

AI literacy softened. Article 4 now requires providers and deployers to take measures to support AI literacy of their staff and others operating AI on their behalf, taking context into account, and says it doesn't require guaranteeing any individual's level. Training still matters; the duty is about reasonable measures.
Systems already in use. Under amended Article 111(2), high-risk systems placed on the market or put into service before the Chapter III date are covered only if their design changes significantly after that date (public-authority systems must comply by 2 August 2030).
Lighter paperwork for smaller firms. Simplified technical documentation extends from SMEs to small mid-caps, and the AI Office will publish a questionnaire template to simplify fundamental rights impact assessments, which may cross-reference a GDPR data protection impact assessment.

What would you do?

Contoso's planned European distributor will use a chat assistant on its customer portal from March 2027, and HR wants an AI applicant-ranking feature for the same entity from January 2028. Grace asks which AI Act duties the program must plan for, and when. What is the most accurate answer?

Key points