Home Insights The EU AI Act After the Digital Omnibus: What Changed and What Didn’t
Governance & regulation
The EU AI Act after the Digital Omnibus: what changed and what didn’t
Last reviewed: 29 September 2026
Key takeaways
- The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and delayed the main high-risk obligations.
- Annex III high-risk obligations now apply from 2 December 2027; obligations for AI in regulated products (Annex I) from 2 August 2028.
- Prohibited practices, general-purpose AI rules and transparency obligations were not deferred. The runway is for building governance, not for waiting.
The Digital Omnibus on AI is an amending regulation that postponed the EU AI Act’s high-risk obligations and made targeted changes to its implementation. It did not change the Act’s risk-based structure. For most organisations, it shifts deadlines; it does not remove work.
What the EU AI Act does
The EU AI Act, in force since 1 August 2024, regulates AI by risk. A small set of practices is prohibited. "High-risk" systems — for example, AI used in recruitment, credit decisions or as safety components of regulated products — must meet requirements on risk management, data governance, documentation, logging, human oversight, accuracy and robustness. Certain systems carry transparency obligations, and providers of general-purpose AI models have their own duties. The Act applies to organisations placing AI on the EU market or using it in the EU, wherever they are based.
What changed
The Omnibus was proposed by the European Commission in November 2025, agreed politically in May 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 — days before the original high-risk deadline of 2 August 2026.
| Obligation | Original date | Date after the Omnibus |
|---|---|---|
| High-risk AI systems listed in Annex III (e.g. employment, credit, education, essential services) | 2 August 2026 | 2 December 2027 |
| High-risk AI embedded in products covered by EU product legislation (Annex I) | 2 August 2027 | 2 August 2028 |
| National AI regulatory sandboxes operational | August 2026 | August 2027 |
The Omnibus also added to the list of prohibited practices, covering AI-generated non-consensual intimate imagery and child sexual abuse material, and amended the wording of the AI literacy provision (Article 4). Check the consolidated text for the current wording.
What did not change
Prohibited practices
have applied since 2 February 2025.
General-purpose AI model obligations
and governance provisions have applied since 2 August 2025.
Transparency obligations (Article 50)
for example, telling people when they interact with AI and marking AI-generated content — have applied since 2 August 2026, with some provisions for systems already on the market applying from 2 December 2026.
The structure of the high-risk regime
risk management, documentation, logging, human oversight, conformity assessment — is unchanged. Only the dates moved.
Why the delay should not slow you down
High-risk compliance is not a document you write in the last quarter. It requires an inventory of AI systems, risk classification, data governance, technical documentation, logging, human oversight design and, for some systems, conformity assessment. Organisations that start in 2027 will be doing it under deadline pressure, alongside India’s DPDP Act, whose full obligations apply from 13 May 2027.
There is also a commercial reason. EU customers are already asking suppliers about AI governance in security reviews and contracts. Evidence of controls is becoming a sales requirement well before it becomes a legal one.
What to do in the next two quarters
1
Build your AI inventory
List every AI system you develop, deploy or buy — including AI features switched on inside your platforms.
2
Classify by risk
Identify anything that may be prohibited, high-risk, subject to transparency duties, or minimal risk.
3
Close transparency gaps now
These obligations already apply.
4
Design controls for high-risk candidates
Start with logging, human oversight and data governance, which take longest.
5
Assign ownership
Name an accountable owner for each system and a forum for decisions.
6
Align with ISO/IEC 42001 and your data-protection programme
so you build one management system, not three.
Know where your AI stands before the regulators ask.
Frequently asked questions
Does the EU AI Act apply to companies outside the EU?
Yes, in many cases. It applies to providers placing AI systems on the EU market and to deployers using them in the EU, and it can apply where an AI system’s output is used in the EU. Non-EU companies with EU customers or operations should assess their exposure.
Is the Digital Omnibus final?
Yes. It was adopted as Regulation (EU) 2026/1744, published on 24 July 2026 and in force from 27 July 2026. The new dates are binding law.
Should we pause our AI governance programme?
No. Several obligations already apply, the high-risk work takes time, and customers increasingly expect evidence of governance. Use the extra time to build controls properly rather than under pressure.
This article summarises regulation for planning purposes and is not legal advice. Consult your legal counsel on how the EU AI Act applies to your organisation.