The EU AI Act's high-risk obligations no longer apply from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 — six days before the old deadline — and moved standalone high-risk systems to 2 December 2027 and product-embedded AI to 2 August 2028. Transparency duties, AI literacy and the prohibitions were not delayed.
This is what moved, what did not, and what a business deploying AI should do with the extra sixteen months.
What is the Digital Omnibus on AI?
It is an amending regulation that changes the EU AI Act's timetable and eases several of its obligations, particularly for smaller companies. It was signed on 8 July 2026, published in the Official Journal on 24 July, and entered into force three days later. It amends the Act rather than replacing it.
The Commission proposed it in November 2025 as part of a wider simplification package. Parliament adopted its position on 16 June 2026 and the Council on 29 June, according to the regulation's own recitals. The proposal had tied the new dates to the availability of technical standards; the final law uses fixed dates instead, which removes one source of uncertainty.
This is a summary for planning, not legal advice. Where an obligation would change what you build or buy, confirm it against the text with counsel.
Which deadlines moved, and to when?
The core high-risk obligations moved. Systems listed in Annex III — employment, credit scoring, education, essential services and similar — now apply from 2 December 2027. AI that is a safety component of products already covered by EU product law, under Annex I, now applies from 2 August 2028.
| Obligation | Original date | Date after the Omnibus |
|---|---|---|
| Annex III high-risk systems | 2 August 2026 | 2 December 2027 |
| Annex I product-embedded AI | 2 August 2027 | 2 August 2028 |
| Synthetic-content marking, systems already on market | 2 August 2026 | 2 December 2026 |
| New bans on intimate imagery and CSAM generation | — | 2 December 2026 |
| National AI regulatory sandboxes | 2 August 2026 | 2 August 2027 |
The high-risk deferral covers Chapter III, Sections 1 to 3. Section 3 contains the deployer duties in Article 26 and the fundamental rights impact assessment in Article 27, so on our reading of the structure, deployers' high-risk obligations moved with the providers'.
There is also a grandfathering rule. A high-risk system placed on the market before its application date is caught only if it is significantly changed afterwards — except for systems used by public authorities, which must comply by 2 August 2030 regardless.
What still applies today?
Most of the Act that touches day-to-day AI use. The prohibited practices have applied since February 2025, general-purpose AI model duties since August 2025, and the Article 50 transparency obligations since 2 August 2026. The AI literacy duty on providers and deployers also remains, in a softened form.
Article 50 transparency was not deferred. Since 2 August 2026, people must be told when they are talking to an AI system; providers of generative systems must mark synthetic output in a machine-readable way; and deployers must disclose deepfakes and AI-generated text published to inform the public.
The one concession is narrow. Providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement in Article 50(2). New systems had no grace period, and the deployer labelling duty in Article 50(4) was never deferred.
The Commission has published the supporting material. Its Article 50 guidelines were adopted on 20 July 2026, and the Code of Practice on AI-generated content was finalised on 10 June, with about 190 organisations signed by the end of July.
Did the AI literacy obligation survive?
Yes, softened but still binding on companies. Article 4 now requires providers and deployers to "take measures to support the development of AI literacy" among staff who operate or use AI systems, and adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".
The change moves the duty from an outcome to an effort. You no longer need to prove that every employee reached a standard; you do need to show what you did. A training record, usage guidance and named owners for each tool are the practical evidence.
That is the cheapest obligation in the Act to meet and the easiest to evidence. It is also the one most companies have done least about. Our AI enablement and training work is built to leave exactly that record behind.
What else did the Omnibus change?
It extended relief to smaller firms, kept but simplified registration for systems a provider assesses as not high-risk, created a legal basis for using sensitive data to detect bias, and gave the Commission's AI Office direct supervisory powers over certain systems built on general-purpose models.
Small mid-caps join SMEs in getting relief. Simplified technical documentation, a proportionate quality management system, and fines capped at the lower of the fixed amount or turnover percentage — previously an SME-only concession — now extend to small mid-cap companies for most breaches.
Registration of "not high-risk" Annex III systems remains. Some coverage has described this as an exemption; it is not. Providers relying on the Article 6(3) derogation must still register, in simplified form, and document their assessment for authorities on request.
Bias detection gets a lawful basis. A new Article 4a allows processing of special category data to detect and correct bias, under strict conditions: pseudonymisation, access controls, no onward transfer, and deletion afterwards. It permits the work; it does not require it.
The fundamental rights impact assessment can lean on the DPIA. Deployers may cross-refer to an existing GDPR data protection impact assessment, and the AI Office will publish a questionnaire template and tool to complete it.
How big are the penalties?
Unchanged at the top. Prohibited practices carry fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaches of operator duties — including deployer obligations and Article 50 transparency — carry up to €15 million or 3%. Supplying misleading information to authorities carries up to €7.5 million or 1%.
Those ceilings are set by Article 99 of the original Act. The Omnibus left them in place but told member states to weigh the economic viability of SMEs and small mid-caps when setting penalties, alongside the lower-of cap above.
Are companies actually ready?
Not yet, and the delay was partly an admission of that. The most recent large survey, by German industry body Bitkom, found 37% of companies with 20 or more employees expect to be affected as deployers — up from 23% a year earlier — and 89% of those affected or unsure expect high implementation effort.
The Bitkom survey of 603 companies was published on 14 September 2026. A further 34% were still checking whether the Act applies to them at all, and affected firms expected to run an average of 2.1 high-risk systems.
The Commission is behind too. Its guidelines on classifying high-risk systems, legally due in February 2026, were still in draft as of this writing. Classifying your systems now means doing it without final guidance — which is a reason to record your reasoning carefully, not a reason to wait.
What should a business do with the extra time?
Use it to build the inventory and evidence that take longest, not to pause. The companies that will be ready in December 2027 are the ones that know today which AI systems they run, which of them touch an Annex III use, and who is accountable for each.
A practical order of work:
- Meet what already applies. Chatbot disclosure, deepfake and AI-text labelling, AI literacy measures, and a check that nothing you run is a prohibited practice.
- Inventory every AI system, including features inside SaaS tools you bought. Shadow AI is the most common gap.
- Classify each against Annex III and record the reasoning, especially where you conclude a system is not high-risk.
- Design human oversight and logging into the systems likely to be high-risk now, while it is an engineering choice rather than a retrofit.
- Ask your vendors what they will provide as providers, and what will be left to you as a deployer.
Financial services firms should treat step three as urgent: creditworthiness assessment is named in Annex III, so it falls under the December 2027 date. Healthcare AI that qualifies as a medical device is high-risk through Annex I instead, on the August 2028 date.
For agents connected to business systems, the same approval and audit-log design that the Act will require is also simply good security; we covered it in what to check before connecting an agent to your systems.
The short version
The high-risk deadline moved to December 2027 and August 2028, with fixed dates rather than conditions. Transparency labelling, AI literacy and the prohibitions did not move, and they apply now. Registration, bias-testing and impact assessments were simplified rather than removed.
The extra time is most valuable to the companies that spend it building an inventory and evidence trail. That is what our AI governance and assurance practice delivers: every system counted, tiered and evidenced, ready for a regulator, customer or insurer to ask.