EU AI Act Weekly Radar: Enforcement is live, the Digital Omnibus is reshaping implementation, and Brussels is leaning into adoption

The EU AI Act story this week is not about a single new rule. It is about the shape of implementation becoming clearer.

Across this week’s updates, three themes stand out for legal, product, and governance teams:

1. Enforcement is already active for some obligations, especially transparency duties and obligations connected to general-purpose AI.
2. The Digital Omnibus is now an important implementation variable, with reported changes aimed at reducing burdens for SMEs and small mid-caps, expanding sandbox access, clarifying governance, and adjusting parts of the high-risk timeline.
3. The European Commission is signaling that AI Act implementation should support deployment and innovation, not only formal compliance.

For lextrace readers, the practical takeaway is straightforward: if your program has been waiting for the later high-risk compliance milestones before mobilizing, this week’s signals suggest that approach is increasingly hard to defend.

Enforcement is no longer hypothetical

The clearest compliance message this week comes from DWF’s 20 August regulatory roundup, *What’s changing next? Regulatory developments and legal change*. DWF says AI Act enforcement is already live for transparency duties and general-purpose AI obligations. The same roundup also notes that the Digital Omnibus is now in force.

That matters because many internal AI governance programs have treated the AI Act as a future-state regulation, especially where an organization is still assessing whether its systems fall into the high-risk framework under Article 6 and Annex III. This week’s reporting points in the opposite direction: some obligations are already part of the live operating environment, even while other parts of the Act continue to phase in.

From a governance perspective, that changes the sequencing. Teams should not think only in terms of a later high-risk deadline. They should also be asking whether they already have:

• a reliable inventory of systems that may trigger transparency obligations;
• a working view on whether any internal or third-party stack intersects with general-purpose AI obligations;
• clear ownership between legal, product, procurement, and technical teams for evidence collection and implementation.

The significance here is less about one newly revealed rule and more about posture. The market is moving from interpretation mode to operational mode.

The Digital Omnibus looks set to reshape implementation planning

The other major development in the DWF roundup is the description of the Digital Omnibus as already in force, alongside several implementation effects. According to DWF, the Omnibus includes:

• reduced burdens for SMEs and small mid-caps;
• expanded sandbox access;
• clarified governance;
• updated high-risk timing; and
• a new prohibition tied to non-consensual intimate content.

For lextrace readers, the first-order implication is that AI Act compliance planning may now need recalibration by company size, deployment profile, and market role.

If the Omnibus is indeed reducing burdens for SMEs and small mid-caps, that could materially affect how smaller providers and deployers structure their readiness programs. A lighter path does not remove obligations, but it can change the evidence burden, budget assumptions, and sequencing of controls.

Expanded sandbox access is equally important. It suggests that the EU is still trying to preserve an implementation model in which experimentation and supervised deployment remain available, rather than forcing firms to choose between innovation and compliance. That becomes especially relevant for startups and scaleups working in regulated or sensitive sectors.

The reference to clarified governance is also notable. Many organizations have struggled not only with substantive duties but with institutional questions: who supervises what, how guidance interacts with enforcement, and how to operationalize accountability across provider and deployer roles. Any governance clarification can have outsized practical impact because it reduces decision friction.

Finally, the mention of updated high-risk timing reinforces an important planning point: timeline assumptions should be treated as live inputs, not fixed background. If your roadmap still relies on earlier milestone logic without checking post-Omnibus positioning, it may now be stale.

Why this matters for Article 6 and Annex III assessments

Even though this week’s source set does not provide new technical guidance on Article 6 or Annex III classification, it still affects how those assessments should be run.

Article 6 and Annex III questions often sit at the center of AI Act scoping because they determine whether a system enters the high-risk regime. But organizations can mis-handle that exercise in two ways:

• by treating classification as a one-off legal memo; or
• by delaying it until closer to later implementation deadlines.

This week’s enforcement and Omnibus signals argue for a more iterative approach.

If transparency and GPAI-related duties are already active, and if the Omnibus has changed timing and burden assumptions, then Article 6 and Annex III analysis should be connected to a broader operational map that includes:

• current obligations already in force;
• likely future high-risk status;
• organization role mapping across provider, deployer, and supplier relationships; and
• sector-specific deployment plans.

In other words, high-risk classification should be part of a living compliance architecture, not a standalone checkbox.

The Commission is keeping the AI Pact in play as a preparation channel

A second Commission signal this week comes from the refreshed AI Pact page. According to the European Commission, the Pact continues to position voluntary pledges around AI governance strategy, mapping likely high-risk systems, and AI literacy. The source summary also says the page now reflects the Pact’s role as a practical preparation channel for companies of any size ahead of later high-risk obligations.

That is an important policy signal.

The AI Pact has often been viewed as softer than the hard-law machinery of the AI Act itself. But in practical terms, the Pact appears to be presented as a bridge between today’s enforceable obligations and tomorrow’s more extensive implementation demands. For organizations still building their control environment, that can make the Pact relevant beyond public signaling.

Three areas stand out:

1. Governance strategy

The Commission’s continued framing around governance strategy suggests firms should be able to explain not just what systems they use, but how AI oversight is embedded into management processes.

2. Mapping likely high-risk systems

This is particularly relevant for teams still sorting through Article 6 and Annex III exposure. A disciplined “likely high-risk” mapping exercise can help organizations prioritize budget, documentation, vendor diligence, and technical testing before later obligations bite.

3. AI literacy

AI literacy remains one of the most operationally useful concepts in implementation because it connects legal requirements to actual workforce behavior. If an organization’s product, procurement, compliance, and frontline teams do not understand how AI systems are classified and governed, formal policy maturity will not translate into real compliance.

For SMEs and startups, the AI Pact may therefore function as a lower-friction readiness mechanism, especially if Omnibus changes are indeed intended to reduce burden while preserving accountability.

The Commission is also framing implementation through adoption, not only restriction

The third item this week is the Commission’s Apply AI Summit update. The published details include a dedicated session on “The AI Act and innovation” as well as sector sessions covering healthcare, manufacturing, media, mobility, cybersecurity, and public administration.

This matters because event design is often a policy signal in its own right. The Commission is not presenting the AI Act solely as a compliance perimeter. It is linking implementation to:

• adoption,
• startup support, and
• real-world deployment.

That is strategically important for companies that have been reading the AI Act mainly through a risk-avoidance lens. The Commission appears to be reinforcing a parallel message: implementation should make trustworthy deployment more scalable, particularly in sector settings where uptake has been uneven or compliance concerns have slowed rollout.

For product leaders, this is a reminder that AI governance programs should be built to enable launches, procurement, and cross-border operations, not merely to generate internal approvals.

A practical read of this week’s signals

Taken together, this week’s updates suggest the EU AI Act is entering a more mature implementation phase defined by two simultaneous forces.

The first is hardening enforcement reality. At least some obligations are already live, and market actors can no longer rely on a purely future-oriented reading of the regulation.

The second is institutional smoothing. Through the Digital Omnibus, the AI Pact, and Commission-facing innovation programming, the EU appears to be trying to make implementation more usable for companies, especially smaller ones and those moving toward sector deployment.

That combination has real consequences:

For providers

Providers should assume that governance, documentation, and system classification work needs to be active now, not deferred. They should also watch closely for any Omnibus-driven changes that alter burden allocation or timing assumptions.

For deployers

Deployers should not assume the heavy lifting belongs only to upstream vendors. Transparency-related responsibilities, internal AI use cases, and procurement decisions can all create present-tense exposure.

For SMEs and startups

The most encouraging signal this week is that EU institutions appear sensitive to implementation burden. Reduced burdens, broader sandbox access, and practical preparation channels could make compliance more navigable. But “more navigable” is not the same as optional. Early structure still matters.

For boards and senior management

The governance conversation should now move beyond “when does this fully apply?” toward “which obligations apply now, which systems may become high-risk later, and what evidence do we need in each phase?”

What lextrace readers should watch next

Based on this week’s developments, the next important questions are likely to be operational rather than abstract:

• How will organizations update their implementation roadmaps after the Digital Omnibus changes described by DWF?
• Will the Commission continue to use the AI Pact as a practical staging area for readiness, especially around likely high-risk system mapping and literacy?
• How much of the innovation-facing messaging seen in the Apply AI Summit will translate into usable support for deployment, especially in regulated sectors?
• How quickly will firms convert general awareness of “AI Act enforcement” into role-specific controls for providers, deployers, and GPAI-adjacent functions?

This week does not answer all of those questions. But it does make one point much clearer: the EU AI Act is no longer just a horizon issue. It is now a live compliance and operating framework, while Brussels simultaneously works to make that framework more deployment-oriented and more workable for smaller market participants.

For many organizations, that means the right response is neither panic nor delay. It is disciplined reprioritization: confirm which obligations are already live, revisit high-risk mapping, and align governance work with the EU’s increasingly visible implementation channels described by DWF, the European Commission’s AI Pact page, and the Commission’s Apply AI Summit update.