The Digital Omnibus Explained: The New EU AI Act Timeline, and What It Means for You

For most of 2026, "August 2" was the date every AI compliance conversation revolved around. Then, a few days before it arrived, the date moved. For some obligations.

The Digital Omnibus on AI, formally Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act. It's no longer a proposal or a political deal. It's law.

Since then I've had the same conversation with founders over and over. Half of them think the whole AI Act was postponed. It wasn't. The other half haven't heard about the change at all. Neither group is in a good position. Here's what actually changed, what didn't, and what it means for your roadmap.

How we got here

The original AI Act set 2 August 2026 as the date most high-risk obligations would apply. As that date approached, a practical problem became obvious: the harmonised technical standards that companies are supposed to build against weren't ready, and neither were many of the national authorities meant to supervise them.

The Commission proposed the Digital Omnibus in November 2025 as part of a broader push to simplify EU digital rules. Parliament and Council reached a provisional agreement on 7 May 2026. Parliament approved the text on 16 June, the Council gave its final approval on 29 June, and it was signed on 8 July. Publication followed on 24 July, and it took effect on 27 July, six days before the original deadline.

The new timeline at a glance

What changed

1. Annex III high-risk obligations moved to 2 December 2027

This is the big one. If your AI is high-risk because of what it's used for (recruitment and HR, credit scoring, life and health insurance pricing, education, biometrics, critical infrastructure, access to public services, law enforcement, migration, justice), the full set of high-risk obligations now applies from 2 December 2027.

That covers risk management, data governance, technical documentation, logging, instructions for use, human oversight, accuracy and robustness, quality management, conformity assessment, CE marking and registration for providers, plus the deployer duties under Article 26 and the Fundamental Rights Impact Assessment under Article 27.

The list of Annex III use cases didn't change. Neither did the substance of what you have to do. Only the date.

2. Annex I products moved to 2 August 2028

If your AI is a safety component of a product already regulated by EU product-safety law (medical devices, machinery, toys, vehicles, lifts and similar), the high-risk obligations now apply from 2 August 2028, a year later than planned. These sectors also have to fit AI Act requirements into their existing conformity assessment regimes, which takes longer.

3. A new prohibited practice from 2 December 2026

The Omnibus didn't only delay things. It added a ban. From 2 December 2026, AI systems that generate or manipulate non-consensual intimate images, video or audio ("nudifier" apps), or child sexual abuse material, are prohibited.

For providers, the ban reaches beyond tools built for this purpose. It also covers systems where producing this content is a reasonably foreseeable and reproducible outcome, and the provider hasn't put reasonable and adequate safeguards in place to reliably prevent it. If you offer image, video or voice generation, your safety filters are now a legal requirement, not just a trust-and-safety choice. Breaches sit at the top fine level: up to €35 million or 7% of global turnover.

4. A short grace period for machine-readable marking

Article 50(2) requires providers of generative AI to mark outputs in a machine-readable, detectable way. For generative systems already on the market before 2 August 2026, the Omnibus allows until 2 December 2026 to comply with this marking requirement.

The grace period is narrow. It covers marking only. A system that is both a chatbot and a generator still had to disclose that it's an AI from 2 August 2026. Systems launched after 2 August 2026 get no grace period at all. Content generated before 2 August 2026 doesn't need to be marked retroactively.

5. AI literacy became a softer duty

Article 4 used to require providers and deployers to ensure a sufficient level of AI literacy among their staff. It now requires them to take measures to support AI literacy, and says explicitly that this doesn't mean guaranteeing any specific level for any individual.

Don't drop your training plans. A documented AI literacy programme is still expected, cheap to run, and one of the easiest things to show a customer or regulator. You just won't be judged on whether every employee reached a particular standard.

6. A clearer legal basis for using sensitive data to fix bias

Testing an AI system for bias on ethnicity, health or similar attributes means processing special category personal data, which GDPR heavily restricts. The original Act allowed this narrowly, for providers of high-risk systems. The Omnibus adds Article 4a, which extends the legal basis to providers and deployers of all AI systems and general-purpose models, where it's strictly necessary to detect and correct bias.

The safeguards are strict and cumulative: you must show that synthetic or anonymised data wouldn't do the job, apply technical limits on re-use with state-of-the-art security and pseudonymisation, control and document access, never transmit or transfer the data to other parties, and delete it once the bias is corrected.

7. Lighter paperwork in a few places

• Registration of exempt systems: if you conclude that an Annex III system isn't high-risk under the Article 6(3) exemption, you still register it in the EU database, but with simplified information.
• SMEs and small mid-caps: simplified routes for technical documentation and quality management, previously reserved for SMEs, now extend to small mid-cap companies too.
• Supervision: the AI Office gets a stronger supervisory role, which should mean more consistent enforcement across member states for some systems.

What did not change

This is the part that gets lost in the headlines.

• Article 50 transparency still applied from 2 August 2026. If your product has a chatbot, an AI voice agent, or generates images, audio, video or published text, those obligations are live today. Our Article 50 guide covers them in detail.
• The prohibited practices have applied since February 2025. Emotion recognition at work and in education, social scoring, manipulative techniques and the rest are still banned.
• General-purpose AI model obligations have applied since August 2025, with the Commission's enforcement powers over model providers starting in August 2026.
• The penalty regime is the same. Up to €35 million or 7% for prohibited practices, up to €15 million or 3% for most other breaches, and for SMEs whichever amount is lower.
• The classification rules are the same. Annex III, the Article 6(3) exemption and the profiling clause that closes it all work exactly as before. Our classification guide still applies in full.
• The work is the same. A high-risk system still needs the same documentation, oversight and monitoring. You just have more time to do it.

The guidance has also caught up

Three pieces of Commission guidance landed around the same time, and they matter as much as the dates:

• Draft guidelines on high-risk classification (19 May 2026), covering both routes into high-risk and how the Article 6(3) filter works, with worked examples. Still a draft, but the best signal of how authorities will read borderline cases.
• Code of Practice on marking and labelling AI-generated content (final version, 10 June 2026). Voluntary, but the practical template for meeting Article 50.
• Guidelines on Article 50 transparency obligations (20 July 2026), clarifying who has to disclose what, and when.

What this means for you

If you have a chatbot or generative AI feature: nothing was postponed for you. Article 50 applies now, and machine-readable marking is due by 2 December 2026 at the latest. Close these gaps this quarter.

If you offer image, video or voice generation: review your safeguards against the new ban before 2 December 2026.

If you build high-risk AI (HR tech, credit, insurance, edtech, biometrics): you have until 2 December 2027. Use it. Technical documentation typically takes many months for a small team alongside product work, and enterprise customers are already asking for it in procurement. A sensible plan: foundations in the last quarter of 2026, core documentation in the first half of 2027, operational controls and conformity assessment in the second half.

If you build AI into regulated products: you have until 2 August 2028, but your sector's conformity process is the long pole. Talk to your notified body early.

If you only use AI tools internally: you're mostly a deployer. Check Article 50 for anything customer-facing, keep your AI literacy measures documented, and if you use high-risk tools (for example in hiring), plan for the deployer duties from December 2027.

If you were told "the AI Act got delayed": for most of your obligations, it didn't.

The honest take

The Omnibus is a genuine reprieve for high-risk systems, and a sensible one: asking companies to comply with standards that didn't exist yet was never going to work well. But it's a reprieve, not a cancellation. The deadline is fixed in law now, the guidance is filling in, and the companies that use the next year well will have a real advantage in procurement when December 2027 arrives.

Find out which deadlines apply to your AI systems →

The free classifier tells you your risk tier, your role, and which obligations apply, with dates, in about five minutes. No signup needed.

---

Common questions

Is the Digital Omnibus final, or could the dates still change? It's final. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has applied since 27 July 2026. Changing the dates again would need new legislation.

Did Article 50 get delayed too? No. Article 50 transparency obligations applied from 2 August 2026. The only relief is the grace period to 2 December 2026 for machine-readable marking by generative systems that were already on the market before 2 August 2026.

We already started our high-risk documentation. Should we pause? No. Keep going at a sustainable pace. The documents you've produced still count, and you now have time to make them good rather than just done. Use the Commission's draft classification guidelines to double-check borderline systems.

Does the new ban affect general-purpose image generators? It can. For providers, the ban covers systems where generating such content is a reasonably foreseeable, reproducible outcome without significant modification, and adequate safeguards are missing. Robust safeguards are what keep a general-purpose generator outside the ban.

Where can I read the official text? On EUR-Lex, as Regulation (EU) 2026/1744. The consolidated AI Act text with the Omnibus changes is the version to work from.

---

Run the free classifier →

Related guides:

• Article 50 in Practice: Chatbot Disclosure, AI Content Labels and Watermarking
• The EU AI Act Compliance Checklist: What to Do Now, and What Can Wait
• Is My AI System High-Risk Under the EU AI Act?
• The EU AI Act for HR Tech: A Vertical Guide