The amended regulation is now in the Official Journal, and several numbers repeated in German boardrooms no longer match it.
A managing director of a machinery supplier with 620 employees asks the question every adviser hears first: what are we exposed to? For most of this year, the answer came with two numbers attached. One was a threshold of 500 employees for lighter treatment. The other was August 2026, the date when everything was supposed to become binding. Read the amended regulation line by line instead of the summaries written about it, and neither number holds.
The omnibus amending the AI Act has been published as Regulation (EU) 2026/1744. Its largest change is time. Obligations for high risk systems listed in Annex III now apply from 2 December 2027. Systems embedded in regulated products under Annex I follow on 2 August 2028. The August 2026 date that anchored many compliance roadmaps no longer governs the part companies feared most. Credit scoring, hiring filters and safety components in machinery all fall into these later windows. For a firm whose AI use lives in the office, in sales and in documentation, the high risk chapter is at least fifteen months away, and probably irrelevant.
What applies today is narrower and more ordinary. Article 50 is in force. People must know when they are dealing with an AI system, and synthetic content that could pass for real must be disclosed. Article 4 remains a duty to take measures on AI literacy. It is not a certificate, an exam or a mandatory training provider. It is a question a company must be able to answer with evidence: what did you do so that the people using these systems understand them? Add the prohibitions that have applied since February 2025, which few sales teams or document workflows come anywhere near. For a typical mid-sized business, that is the whole of the live exposure. It is manageable, and it is concrete.
The size question is where most of the confusion sits. The omnibus extends the fine privilege for small and medium enterprises to small mid-cap companies. In practice, the lower of the two possible amounts applies: the percentage of turnover or the fixed sum. The definition comes from Commission Recommendation (EU) 2025/1099 of 21 May 2025. A small mid-cap has fewer than 750 employees and either an annual turnover of no more than €150 million or a balance sheet total of no more than €129 million. The figure 500 appears in neither text. Because the financial test is either one or the other, a company with 620 staff, €180 million in turnover and a €110 million balance sheet qualifies. A company with 700 staff, €200 million in turnover and a €140 million balance sheet does not. Group structures can shift the count, since linked enterprises are not assessed in isolation. "We are Mittelstand" is a feeling. The threshold is arithmetic.
None of this makes the regulation lighter than it is. A lower fine ceiling does not remove an obligation, and a postponed deadline does not stop a customer, an insurer or a works council from asking the questions early. The more uncomfortable finding is about the commentary itself. Much of what circulates was written against drafts from the negotiation, when Parliament and Council positions still differed. When the final text is set against that commentary, some claims turn out to be wrong, and several changes that did make it into the law barely get mentioned. The error cost is not abstract. An adviser who says "500 employees" or "August 2026" in front of a client's lawyer loses credibility for every number that follows, including the correct ones.
The practical move is to put a single page in front of the managing director, six lines long, each line naming the article and its Official Journal reference, and to check the size threshold against the company's own headcount and balance sheet before anyone says the word Mittelstand.
That page is less exciting than a maturity model or a governance framework. It is also the one document that survives a lawyer reading it. The manufacturer with 620 employees may well end up with a short list: transparency where customers meet a chatbot, a documented literacy effort, and a date in late 2027 to watch if a hiring tool ever enters the picture. Whether that short list stays short depends less on Brussels than on what the company decides to build next.