The European AI Act also applies to companies outside the Union, as soon as their AI systems or their outputs serve European customers. A Tunisian SME that publishes software, works for a European client or sells online in Europe therefore needs to know the timetable.
That timetable changed in summer 2026. This article summarises the dates in force in October 2026 and proposes an action plan. It does not replace the advice of a lawyer.
Key points
- The “digital omnibus” regulation on AI entered into force on 27 July 2026 and postpones the obligations for high-risk systems.
- New dates: 2 December 2027 for Annex III systems, then 2 August 2028 for AI embedded in regulated products.
- The transparency obligations of Article 50 of the AI Act have applied since 2 August 2026.
- Fines reach up to 35 million euros or 7% of worldwide annual turnover for prohibited practices.
AI Act: a timetable revised in summer 2026
The European Parliament and the Council reached a political agreement on 7 May 2026. Parliament approved the text on 16 June 2026, and the Council adopted it on 29 June 2026. The regulation entered into force on 27 July 2026.
The key milestones, as described by the European Commission and the law firms Freshfields and Winston Taylor, are as follows.
- Since 2 February 2025: ban on certain practices and AI literacy obligation.
- Since 2 August 2025: governance rules and obligations for general-purpose AI models.
- Since 2 August 2026: transparency obligations under Article 50.
- From 2 December 2026: end of the grace period for marking content produced by systems already on the market before 2 August 2026, and a new ban on systems that generate intimate images without consent.
- From 2 December 2027: obligations for Annex III high-risk systems (employment, education, credit, critical infrastructure).
- From 2 August 2028: obligations for AI embedded in regulated products, such as medical devices or machinery.
The omnibus moves the dates, but it does not remove the requirements. The obligations for high-risk systems remain those of the original text.
Why a non-European SME falls within scope
Article 2 of the AI Act covers providers that place an AI system on the Union market, wherever they are established. It also covers providers and deployers located in a third country when the output of the system is used in the Union.
Three situations are relevant to a Tunisian SME.
- A software publisher sells an HR tool to a French company that ranks job applications. It then acts as a provider in a field that Annex III classifies as high-risk.
- A service centre deploys a conversational assistant for the end customers of a European brand. The transparency obligations therefore apply.
- An agency uses generative AI to create the visuals of a campaign that a European brand broadcasts. The question of labelling and informing the public arises in this case.
Beyond the text itself, your European clients are writing these requirements into their contracts. A provider that documents its AI uses reassures its client.
What Article 50 of the AI Act requires since August 2026
Article 50 divides obligations between the provider, which designs the system, and the deployer, which uses it in its activity.
- The provider of a conversational system informs people that they are interacting with an AI, unless this is obvious from the context.
- When the system generates text, images, audio or video, its provider marks that content in a machine-readable format.
- The deployer discloses deepfakes as generated or manipulated content.
- A deployer that publishes generated text on a matter of public interest discloses it, unless a human reviews it and holds editorial responsibility.
In practice, three actions cover most cases: a clear notice on the chatbot, labelling of generated visuals, and human review before publication.
AI Act penalties and relief for SMEs
Article 99 sets three ceilings. The first is 35 million euros or 7% of worldwide annual turnover for prohibited practices. The second is 15 million euros or 3% for other obligations, including transparency. The third is 7.5 million euros or 1% for supplying incorrect information. For SMEs and start-ups, however, the ceiling is the lower of the two amounts.
The omnibus also adds relief. According to the European Commission, it extends to small mid-cap companies the simplified requirements that SMEs already enjoy, in particular for technical documentation. It also relaxes the AI literacy obligation. According to the analysis by Winston Taylor, companies are taking steps to develop their teams’ skills, without guaranteeing an individual level.
A five-point action plan and AISYSNEXT’s view
- Inventory your AI uses first: tools, providers, data and recipients of the outputs.
- Classify each use: prohibited, high-risk, subject to transparency duties, or minimal risk.
- Identify your role for each system: provider or deployer.
- Update disclosure notices, contracts and documentation.
- Train the teams that design or use these tools.
AISYSNEXT is not a law firm. Our role is technical: we document the systems we build. From the design stage, we also include disclosure notices and human validation mechanisms. Our AI integration and business application development services work within this framework.
For a specific legal qualification, we recommend consulting a lawyer who specialises in technology law.
Frequently asked questions
Does the AI Act apply to a Tunisian company?
Yes, in two main cases: it places an AI system on the Union market, or the Union uses the output of its system. A company that works only with local clients is in principle outside its scope.
Does the postponement of high-risk rules mean we can wait until 2027?
No. The requirements of the AI Act remain the same, and compliance takes time: documentation, risk management, human oversight. Your European clients will raise the question well before the deadline.
Does internal use of an AI assistant create obligations?
Everyday office use generally falls under minimal risk. Nevertheless, check two points: user training and informing the public when you publish generated content. Then have a lawyer validate your analysis.
Do you develop or use AI for European clients? Contact our expert team to frame the technical side of your project.
