One detail keeps getting lost in coverage of the Digital Omnibus: it did not remove high-risk obligations. It moved their start date.
For companies building or using high-risk AI, that distinction — delay, not cancellation — decides whether you can genuinely slow down or should keep building anyway. The answer is usually somewhere in between, and it depends on who your customers are.
Updated for Regulation (EU) 2026/1744, in force since 27 July 2026.
What high-risk obligations were supposed to start in August 2026
Annex III lists the stand-alone high-risk categories. The ones SMEs actually encounter:
- employment — CV screening, candidate ranking, promotion and termination decisions, task allocation
- credit scoring and creditworthiness assessment, plus life and health insurance pricing
- education — admissions, grading, proctoring, allocation to programmes
- access to essential public and private services
- biometrics, critical infrastructure, law enforcement, migration and border control
The duties attached to them: a risk management system across the lifecycle, data governance and bias testing, technical documentation, automatic logging, human oversight design, accuracy and robustness targets, conformity assessment, CE marking, and registration in the EU database.
What the Omnibus actually did
EU AI Act application dates after the Digital Omnibus on AI (Regulation (EU) 2026/1744).
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited AI practices are banned (Art. 5) | Unchanged |
| 2 February 2025 | AI literacy obligation applies (supervision from 3 August 2026) (Art. 4) | Unchanged |
| 2 August 2025 | General-purpose AI model rules and governance apply (Art. 51–55) | Unchanged |
| 2 August 2026 | Transparency duties apply — not deferred by the Omnibus (Art. 50) | Unchanged |
| 2 December 2026 | Machine-readable marking of synthetic output for generative systems placed on the market before 2 August 2026 (Art. 50(2)) | New |
| 2 December 2026 | Two new prohibitions apply (non-consensual intimate imagery, AI-generated CSAM) (Art. 5) | New |
| 2 August 2027 | National AI regulatory sandboxes must be operational (Art. 57)Previously 2 August 2026 | Deferred |
| 2 December 2027 | Stand-alone high-risk AI obligations (Annex III) apply (Annex III)Previously 2 August 2026 | Deferred |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I) applies (Annex I)Previously 2 August 2027 | Deferred |
Annex III high-risk systems now apply from 2 December 2027, and high-risk AI embedded as a safety component in products already covered by sectoral law (machinery, medical devices, lifts, toys, vehicles) from 2 August 2028.
The reason was practical rather than political: the harmonised standards that let a company demonstrate conformity were not going to be published in time. Requiring conformity against standards that do not exist is not a compliance regime, it is a lottery.
Delay, not cancellation — and why the wording changed
The Commission's November 2025 proposal made the new dates conditional on a decision confirming standards were ready. That version is the one most secondary sources still describe, and it is out of date.
Parliament and Council rejected conditionality and converted the backstops into fixed application dates. That is better news than it sounds: you can plan against a calendar instead of against a Commission decision that might land at any point. But it also means there is no scenario where the obligations quietly disappear. They are in the text, with a date attached.
What is not delayed
- Prohibited practices — in force since 2 February 2025, plus two new prohibitions from 2 December 2026.
- AI literacy — in force since 2 February 2025, supervised from 3 August 2026.
- General-purpose AI model obligations and governance — in force since 2 August 2025.
- Article 50 transparency — applies 2 August 2026, unchanged. See Article 50 in practice.
- The risk-based framework itself — classification logic, roles and definitions are unchanged.
What this means for specific company types
SaaS companies with embedded AI features
Most SaaS AI features are limited risk, so the delay changes little — your August 2026 work is disclosure and content labelling. The exception is when your feature is used to screen, score or rank people; then you are inside Annex III and December 2027 is your date. More in EU AI Act for SaaS companies.
HR and hiring tech
Employment is squarely Annex III, so you gained roughly sixteen months. You will not gain them back in sales cycles: enterprise HR buyers already ask for bias testing and human-oversight documentation in procurement. Build to the original standard. See AI Act for HR companies.
Financial services and credit scoring
Creditworthiness assessment and insurance pricing are Annex III, and much of what the Act asks for overlaps with model-risk governance supervisors already expect. The delay is a scheduling change, not a reprieve. See high-risk AI explained.
How to plan when a deadline moves
- Treat the delay as a buffer, not a discount. Same scope of work, more calendar to do it in.
- Keep the inventory and classification work on the original schedule. It is cheap, it never expires, and it answers customer questionnaires today.
- Follow the standards work. CEN-CENELEC JTC 21 output is what will define "good enough" in practice.
- Track primary sources. The Official Journal and the Commission's AI Act pages, not headlines — most of the confusion in this area comes from articles describing the November 2025 proposal as if it were the final text.
FAQ
Does the Omnibus delay all EU AI Act rules?
No. Only the high-risk regime and the sandbox deadline moved. Prohibitions, AI literacy, general-purpose AI rules and Article 50 transparency were not deferred.
What happens to companies that already started high-risk compliance work?
Nothing is wasted — the substantive requirements are unchanged. You now have more time to complete conformity assessment and to wait for harmonised standards rather than guessing at them.
Is 2 December 2027 a confirmed date?
Yes. It is a fixed application date in an adopted regulation, not a conditional trigger. Changing it again would require a further amendment.
Where can I track the AI Act as it develops?
The Official Journal for legal text, the Commission's AI Act pages for guidance and templates, and CEN-CENELEC JTC 21 for standards progress. Our timeline page tracks the dates.
Where to go next
Read what the Omnibus changed in full, check whether your system is high-risk, or see every date in the EU AI Act timeline.
Indicative guidance only — not legal advice. ActNavigator provides guidance based on the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744.