The EU AI Act after the Digital Omnibus: what moved, and what did not
The amending regulation adopted in mid-2026 pushed back the high-risk obligations. It did not pause the Act. Prohibitions, general-purpose AI duties and most transparency obligations are already in application. The extra time is only useful if it is spent building governance.
- Published
- September 30, 2026
- Reading time
- 9 minutes
- Written by
- MarkTillson AI Governance Practice
When the European Commission proposed its “Digital Omnibus” package in November 2025, some commentary described it as a pause of the AI Act. It was never that, and the version that became law in 2026 is not that either. The amending regulation, approved by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 and published in the Official Journal in July, moves the dates on which the high-risk obligations apply. Most of the rest of the Act continues on its original timetable.
This note sets out the timeline as amended, what that means for organizations at different stages, and why we advise clients to treat the deferral as time to build governance rather than time to wait.
The timeline as amended
| Obligation | Applies from | Status in late 2026 |
|---|---|---|
| Prohibited AI practices (Article 5) | 2 February 2025 | In application |
| AI literacy (Article 4) | 2 February 2025 | Applied from this date; the omnibus proposals addressed how this duty is framed, so confirm the amended wording for your role |
| General-purpose AI model obligations; governance and penalties framework | 2 August 2025 | In application |
| Transparency obligations for certain AI systems (Article 50) | 2 August 2026 | In application, with a transitional period to 2 December 2026 for machine-readable marking of AI-generated content by systems placed on the market before 2 August 2026 |
| High-risk AI systems listed in Annex III (stand-alone uses such as employment, creditworthiness, education and access to essential services) | 2 December 2027 (previously 2 August 2026) | Deferred |
| High-risk AI systems that are safety components of products covered by Annex I legislation | 2 August 2028 (previously 2 August 2027) | Deferred |
The amendments also adjust other provisions, including measures intended to ease the burden on smaller companies. This note concentrates on the changes that drive planning. For any specific article, work from the consolidated text in the Official Journal rather than secondary summaries.
Why the dates moved
The high-risk regime depends on harmonized European standards, which give providers a presumption of conformity, and on national authorities and notified bodies being ready to supervise. Standardization work under CEN-CENELEC has taken longer than the Act originally assumed. Applying detailed technical obligations before the standards that explain how to meet them would have created legal uncertainty for providers and supervisors alike. The deferral is best understood as aligning the legal deadline with the availability of that infrastructure.
What did not move
Prohibitions
The practices banned by Article 5, among them certain manipulative techniques, social scoring and specified uses of biometric systems, have been prohibited since February 2025. Organizations should already have checked that none of their systems falls into these categories, and should repeat the check whenever a new use case is proposed.
General-purpose AI
Providers of general-purpose AI models have carried their obligations since August 2025: technical documentation, information for downstream providers, a copyright policy and a training-content summary, with further duties for models with systemic risk. Most of our clients are not model providers, but they are downstream users, and the information those providers must now supply is a useful input to their own risk assessments.
Transparency
Article 50 transparency duties apply now. In broad terms, people must be told when they are interacting with an AI system unless it is obvious, synthetic content must be marked in a machine-readable way, and deepfakes and certain AI-generated text published to inform the public must be disclosed. For many enterprises, these are the obligations that touch the most products, from customer-service assistants to content-generation features and marketing tools. They were not deferred.
An organization deploying an AI system for creditworthiness assessment or recruitment screening now has until December 2027 before the high-risk requirements apply. That is roughly fourteen months. Risk management systems, data governance, technical documentation, logging, human oversight and post-market monitoring are not things that can be produced in the last quarter.
What to do with the extra time
1. Build and maintain an AI inventory
Every obligation in the Act depends on knowing which AI systems you provide or deploy, for what purpose and with what data. An inventory that records purpose, role (provider or deployer), risk classification, data sources, model suppliers and owners is the foundation for everything else. It is also the first artifact an ISO/IEC 42001 auditor will ask to see.
2. Classify against Annex III now
Classification is a legal-technical judgment that benefits from time: some systems will clearly fall within Annex III, others will turn on how the system is used, and some may qualify for the exception for systems that do not pose a significant risk. Making these decisions early, with reasoning recorded, avoids rushed conclusions later.
3. Stand up the management system
The high-risk requirements for risk management, quality management, documentation and monitoring are management-system obligations in all but name. ISO/IEC 42001 provides a certifiable structure for exactly this kind of system, and its implementation work maps closely onto what the Act will require. It is not, by itself, a harmonized standard under the Act, so it does not confer a presumption of conformity. It does give an organization a working governance system to which Act-specific requirements can be added.
4. Address transparency obligations that already apply
Review customer-facing AI features for Article 50 disclosures and content marking now, particularly for systems first placed on the market after 2 August 2026, which receive no transitional period for marking.
5. Prepare the evidence regulators and customers will request
Enterprise buyers are not waiting for the deadlines. AI governance questionnaires are already a routine part of procurement in financial services and healthcare. A documented inventory, risk assessment and oversight model answers most of them.
A note for financial services
Creditworthiness assessment and credit scoring of natural persons, and risk assessment and pricing for life and health insurance, appear among the Annex III use cases. Financial institutions should expect their existing supervisors to take an interest, and should consider how AI governance connects with model risk management, operational resilience under DORA and outsourcing arrangements for third-party AI services. Treating AI governance as a separate silo will create duplicated controls and gaps between them.
Key takeaways
- Only the high-risk dates moved: Annex III to 2 December 2027, Annex I products to 2 August 2028.
- Prohibitions, GPAI duties and Article 50 transparency already apply.
- The inventory and classification come first; everything else depends on them.
- ISO/IEC 42001 is a strong foundation but not, on its own, a presumption of conformity.
- Work from the Official Journal text when planning against specific articles.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 4, 5, 50 and 113, and Annexes I and III.
- Amending regulation on the simplification of the implementation of harmonized rules on artificial intelligence (Digital Omnibus on AI), adopted June 2026 and published in the Official Journal in July 2026.
- European Commission, Digital Omnibus proposals, November 2025.
Our EU AI Act readiness work starts with the inventory and classification, then builds the management system around them. Fourteen months is enough time if you start now. Speak to our AI governance team.
