Digital Omnibus Explained: Your New EU AI Act Timeline

If you’ve built a compliance plan around 2 August 2026, this post is for you. That date — long treated as the EU AI Act deadline for high-risk systems — has moved. The vehicle for the change is the Digital Omnibus, and the short version is: the high-risk obligations were rescheduled, nothing already in force was delayed — but a good deal of the Act’s content was amended along the way, including some provisions that already apply. Here’s exactly what happened and what it means for your plan.

What the Digital Omnibus Is

The Digital Omnibus on AI is a simplification package proposed by the European Commission and adopted by the European Parliament and the Council. It amends the AI Act — the timing of the high-risk obligations, but also around 40 other provisions — together with the EU regulations on civil aviation safety (2018/1139) and machinery (2023/1230). The key dates:

• 7 May 2026 — a provisional political agreement was reached.
• 13 May 2026 — the Council set out its position.
• 24 July 2026 — published in the Official Journal as Regulation (EU) 2026/1744.
• 27 July 2026 — entered into force.

Updated October 2026: the Omnibus is now law. Since its publication and entry into force in July 2026, the new dates below are binding — they are no longer proposals. Our deadline guide covers the new dates, and the AI Act Explorer now shows the consolidated text with every amended or inserted provision marked.

What Moved

The deferral pushes back the application of the high-risk obligations:

A large part of the reason for the deferral is that the harmonised technical standards (being developed by CEN/CENELEC) that turn the Act’s requirements into concrete, testable criteria are not yet published. Deferring the application date avoids forcing companies to comply with a standard that doesn’t exist yet.

What Did Not Move

This is the part that gets lost in “the deadline was pushed” headlines. Several obligations are already in force, and the Omnibus did not push any of them back:

• Prohibited AI practices (Article 5) — live since February 2025. Unacceptable-risk uses are already banned, with no grace period. The Omnibus did not delay these; it added to them (see below).
• General-purpose AI (GPAI) model obligations — live since August 2025. Providers of GPAI models already carry transparency and documentation duties.
• Transparency obligations (Article 50) — apply from 2 August 2026 as originally scheduled. Systems already on the market before that date have until 2 December 2026 to meet the Article 50(2) marking requirement for AI-generated content.

So if your concern is a prohibited use case, a GPAI model or a transparency duty, your deadline did not move. Only the high-risk application dates were deferred. What some of those obligations require, though, did change — see below.

What Else Changed

The Omnibus is not only a delay. The changes most likely to matter to a provider or deployer:

• Two new prohibitions. Article 5 now also bans AI systems that generate or manipulate non-consensual intimate imagery of identifiable people, or child sexual abuse material. These apply from 2 December 2026 — check your systems against them before then, alongside the existing Article 5 list.
• A softer AI literacy duty. Article 4 used to require providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among staff. It now requires them to take measures to support AI literacy, and states that no specific level has to be guaranteed. The Commission and Member States must support companies, particularly SMEs, with practical examples.
• Using sensitive data to detect bias. The permission to process special categories of personal data for bias detection and correction moves from Article 10(5) into a new Article 4a, and now also covers deployers of high-risk systems and providers and deployers of other AI systems and models — under the same strict conditions.
• Relief for SMEs and small mid-caps. The Act now defines small mid-cap enterprises (SMCs). SMEs and SMCs can file simplified technical documentation, all SMEs (not just microenterprises) can use a simplified quality management system, and SMCs get the lower fine caps SMEs already had. Details in our SME guide.
• A narrower “safety component”. Article 3(14) and new Article 6(1a)–(1c) clarify that systems used solely for user assistance, performance optimisation, efficiency, automation, convenience or non-safety quality control are not safety components, while systems whose failure would endanger health and safety are. That narrows the Annex I route into the high-risk tier.
• Less duplication for regulated products. The Commission can limit specific AI Act requirements where sectoral product law already gives equivalent protection (Article 2(13), delegated acts due by 2 August 2027). A product doesn’t need a third-party conformity assessment just because it contains a high-risk AI system (Article 43), and real-world testing outside sandboxes is extended to Annex I products (Articles 60 and 60a).
• Lighter registration for “not high-risk” Annex III systems. Providers relying on the Article 6(3) exemption register fewer details in the EU database (Annex VIII, Section B).
• FRIA and DPIA can share work. A deployer’s fundamental rights impact assessment may cross-reference or reuse the relevant parts of its GDPR data protection impact assessment (Article 27).
• Codes of practice run by the Commission. For GPAI (Article 56) and AI-content labelling (Article 50(7)), the Commission — not the AI Office — now facilitates the codes and assesses whether following them is adequate, instead of approving them by implementing act.
• Stronger central enforcement. The AI Office becomes exclusively competent for AI systems built on a general-purpose AI model by the same provider or group, and for systems that are or sit inside very large online platforms and search engines (Article 75), with new investigation, commitment and fining powers (Articles 75a–75d).
• Later support deadlines. Each Member State’s first AI regulatory sandbox must be operational by 2 August 2027 instead of 2026, and the Commission’s post-market monitoring template now comes as guidance by 2 September 2027 (Article 72). The AI Office can also run an EU-level sandbox.

Further changes cover notified bodies (a single application and a new code list in Annex XIV), a presumption that systems meeting the Cyber Resilience Act’s cybersecurity requirements comply with Article 15 (Article 42(3)), and the new Machinery Regulation in Annex I.

What It Means for Your Compliance Plan

1. Your effective deadline is now 2 December 2027 (or August 2028 for Annex I-embedded systems). Re-baseline your internal milestones against the real date — but don’t compress the work into the final months. Inventory, classification, and Annex IV documentation are multi-month efforts.

2. Use the runway to do it properly. The extra time exists largely because the standards aren’t final. Companies that complete their AI system inventory and risk classification now will simply map to the harmonised standards when they publish, rather than starting from scratch under time pressure.

3. Don’t let “deferred” become “deprioritised.” Buyers — especially enterprise and public-sector procurement — increasingly require AI Act readiness and ISO 42001 evidence regardless of the statutory date.¹ Compliance is now a commercial gate, not just a legal one. The deferral is an opportunity to turn readiness into a sales advantage.

4. Expect more change — and instrument for it. The Omnibus is itself proof that the timeline can shift. A compliance program that monitors regulatory updates and re-flags your documented systems when dates or standards move is far more durable than a one-off project pinned to a single date.

How Aikraft Handles This

This is exactly the scenario Aikraft’s regulatory-update monitoring is built for. When dates shift — as they just did — or when the harmonised standards publish, your classified systems and documentation are flagged automatically, so your compliance posture stays current without a manual re-audit. You classify and document once, then maintain continuously.

For the full, updated phase-by-phase plan, see our EU AI Act Deadline Guide. To get an initial read on which of your systems are high-risk, take the Aikraft Risk Quiz — under 10 minutes, no signup required.

¹ Küsters & Waber, “AI Act: The clock is ticking,” cepInput No 17, Centrum für Europäische Politik, 2 October 2025, p. 3 — noting that non-EU buyers increasingly demand AI-Act-ready assurances and ISO 42001 evidence as a procurement prerequisite, independent of statutory deadlines.

First published June 2026; updated October 2026 after the Omnibus was published as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. This is a summary, not legal advice — check the Official Journal text for the exact wording.