EU AI Act: the Digital Omnibus is in force, here are the deadlines for high-risk AI

The Digital Omnibus on AI is no longer a provisional deal. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. That makes the first package of amendments to the EU AI Act final, and the new deadlines for high-risk AI apply with certainty. The word delay is only accurate for part of the regulation. Other obligations continue as before.

From agreement to law

On 7 May 2026 the Council, the European Parliament and the European Commission reached a provisional agreement. After formal adoption came publication on 24 July and entry into force three days later. If your planning is still based on the agreement or on one of the earlier proposals, it is time to update it. The text of the regulation is the source, not the news coverage of the past months.

The new deadlines for high-risk AI

The Omnibus works in two tracks. For standalone high-risk AI systems under Annex III, such as applications for recruitment, credit assessment and biometrics, the requirements apply from 2 December 2027. For high-risk AI built into products under Annex I, such as medical devices and machinery, the date is 2 August 2028. Originally the regulation set 2 August 2026 for both categories.

What you do with those dates depends on your role. A provider of an Annex III system must have the risk management system, the technical documentation, the data requirements and human oversight in place on time. An organization that only uses such systems has its own list of duties as a deployer. Both roles start with the same question: which AI do we use and which category does it fall into. Note that an organization can hold both roles, for instance when you modify a purchased model or offer it under your own name. In that case the provider duties apply to you.

What has not been postponed

The ban on certain AI practices has applied since 2 February 2025 and the obligations for general-purpose AI models since 2 August 2025. The transparency obligations of Article 50 still apply from 2 August 2026. For the marking of synthetic content (Article 50(2)) a transition period has been built in: systems placed on the market before 2 August 2026 must comply by 2 December 2026 at the latest. Systems placed on the market after that date must be able to do it from the start.

Article 4 on AI literacy has not gone away either, but it has been relaxed. Providers and deployers no longer have to guarantee that their staff reach a certain level. They must take measures that support AI literacy. What that looks like in practice is covered in our article on AI literacy under Article 4.

What else has changed

The Omnibus does more than move dates. The list of prohibited practices now includes AI systems that generate non-consensual sexually explicit or intimate content, and systems for creating or manipulating child sexual abuse material. The relief for SMEs now also covers small mid-caps, with simplified documentation and more proportionate requirements for the quality management system. Special categories of personal data may be processed to detect bias, provided this is strictly necessary. And the AI Office gets broader supervisory powers, including over certain systems of general-purpose model providers and over AI in very large online platforms.

One clarification that is often missed: AI that only assists users or optimizes performance, without creating a health or safety risk, is not automatically treated as a safety component and therefore as high-risk. That can change the classification of some systems, so it is worth testing your existing classification again.

Why a delay is not a pause

After 2 December 2027 a provider of high-risk AI has no extra year, and the requirements have not become lighter. The measures the regulation asks for largely overlap with what an AI management system under ISO 42001 already sets up. That standard is not a harmonised standard and therefore gives no presumption of conformity, but the governance underneath it does count. How to build such a system is covered in our roadmap for ISO 42001.

What to do now

Start with an inventory of all AI systems, including AI features in supplier software. Determine the risk category and your role for each system, because without those two you do not know which deadline applies to you. Our explanation of risk classification under the EU AI Act walks through that step. Then check whether the changes to Articles 4 and 50 have been reflected in your policy and product documentation. Record the date and the version of the regulation on which you based your choices. In a review by an auditor or regulator, that shows what basis you worked from. The AI Act file also remains in motion, as guidance and standards are still being published that fill in the requirements further.

How Secure Audit can help

We help organizations determine their position under the EU AI Act, classify AI systems and build a plan based on the final dates. More about our approach is on the compliance page. Contact us for a conversation about your AI Act position.