A raw-text count of the Omnibus regulation shows the compliance dates most advisers quote no longer exist.
Six lines. That is what survives once you read Regulation (EU) 2026/1744 in the original Official Journal text rather than in the summaries circulating through German consultancies. Six lines, each with an article number and a Journal reference, that answer what a managing director in Bochum or Bremerhaven actually wants to know when the subject of AI regulation comes up: what applies to me, today, in my company, with the people I have.
The count matters because the summaries got it wrong in a specific and expensive way. Three answers that have been standard in the German advisory market for most of this year are now demonstrably false against the raw text. The first is the August 2026 cut-off, repeated in webinars, slide decks and LinkedIn posts as the moment high-risk obligations bite. They do not bite then. High-risk duties under the amended framework land in December 2027, which is fifteen months of runway that many companies have been told they do not have. The second is the employee threshold. The figure of 500 staff circulates as though it were a statutory line; it is not the line that determines which penalty band a company falls into. The third is the assumption that nothing applies yet. Article 50, the transparency duty, applies now. Article 4, the obligation to ensure sufficient AI literacy among staff who operate these systems, applies as a duty to take measures, not as a suggestion to consider training at some point.
What a mid-sized manufacturer actually owes today
Take the typical case, because the typical case is where the money is. A company with four hundred employees using a language model to draft sales correspondence, summarise tender documents and maintain technical documentation. No autonomous decision-making, no biometrics, no credit scoring, nothing that touches Annex III. In the conversations I have had this year, that company has been told one of two things: either that it is in the clear until 2027, or that it faces an August 2026 wall it cannot possibly clear.
Both are wrong, and the correct answer is more useful than either. That company has a live obligation under Article 50 to disclose where output is machine-generated in contexts where a person could reasonably mistake it for human work. It has a live obligation under Article 4 to ensure the people using these tools understand what they are using. And it has no high-risk obligation at all, now or in December 2027, unless its use case moves into a listed category. The practical burden today is documentation and a half-day of training, not a compliance programme.
The size question works the same way. The penalty structure distinguishes between undertakings by reference to headcount and balance sheet total, not by the vibe of the business. A small mid-cap company that qualifies pays the lower of the two applicable amounts in an enforcement scenario. This is a material difference in exposure, and it turns on numbers a company already has in its annual accounts. It does not turn on whether anyone in the room thinks of the firm as Mittelstand.
Why the wrong date costs the room
There is a version of this problem that is purely commercial. A consultant walks into a meeting, says August 2026, and the client's lawyer, who has read the amending regulation, says that date no longer applies. Everything said after that moment is discounted. The specific claim was checkable and the consultant did not check it, which tells the room something about every claim that follows.
That dynamic is worth sitting with, because it describes a general condition of AI advisory work in 2026 rather than a single regulatory quirk. The field moves faster than the material most advisers are working from, and the gap between a secondary summary and a primary text is where credibility leaks out. The Omnibus is an unusually clean example: the changes are dated, published, and countable. Four amendments that the circulating summaries simply did not contain were sitting in the Journal text the whole time, available to anyone willing to read a regulation in the form the legislature actually passed it.
The practical move is to build one page for each client that lists what applies to that company today, with the article number and the Official Journal citation on every line, and to check the size threshold against the client's actual headcount and balance sheet total before the page leaves your desk.
That page is small, which is the point. Six lines that a managing director can read in ninety seconds and act on, against a market full of forty-slide decks that are wrong about the date on slide four. The advantage is not depth of analysis. It is having read the thing.
The part that stays uncertain
None of this makes the framework settled. December 2027 is far enough out that further amendment is plausible, and the German implementing architecture, the question of which authority does what, is still being assembled. A company that builds its compliance posture around today's text should expect to revise it. The honest framing is that the current text gives you fifteen months of clarity, not permanent ground.
What it does give you is the ability to answer the question without hedging. The managing director asks what he is exposed to. You say: these two articles now, this one in December 2027, this penalty band given your numbers, here are the citations. Then the conversation can move to the thing he actually needs, which is whether the work is worth doing at all.
Most of the market cannot get past the first question.