Digital Omnibus: the AI Act Delay That Makes 2026 Busier, Not Quieter

On 29 June the Council of the EU gave the Digital Omnibus its final approval. Most of the coverage read it as a reprieve. The AI Act’s high-risk obligations, the heaviest part of the regime, were due to apply this August. They now land in late 2027 and 2028. Sixteen months of runway, for organisations that were never going to be ready in time.

The trouble is that the calendar governing the next eighteen months barely moved. In two places it got tighter.

What the Digital Omnibus actually changed

The Digital Omnibus, part of the Omnibus VII simplification agenda, resets the application dates for high-risk systems. Annex III lists the stand-alone high-risk cases: employment, education, biometrics, access to essential services. Those now apply from 2 December 2027. Annex I covers AI inside regulated products, from lifts to medical devices, and that tier moves to 2 August 2028.

The Council framed the vote as a step towards a more competitive single market. On the surface, that is what it delivers: time.

Beneath the surface, the reset is narrower than the headline suggests. The AI Act keeps its architecture. Its risk tiers, its governance structure and its core obligations all stay intact. What shifted is the moment the heaviest tier starts to bite, not whether it does.

Why the dates slipped

This deferral reads less as a political concession than an admission. The harmonised standards that make high-risk compliance workable were not ready, and CEN and CENELEC are still drafting them. Many member states had also not yet named the authorities that will enforce the rules. So the co-legislators stopped tying the start date to standards that keep slipping, and fixed a calendar date instead.

That single move matters more than it looks. A firm date now replaces a conditional one, so read the new deadlines as genuine rather than rolling. For planning, the Digital Omnibus turns a moving target into a fixed one. That is the rare piece of hard certainty in the package.

What the Digital Omnibus did not move

The relief story breaks down here. Three obligations that organisations already feel stayed exactly where they were. Two more fall due in 2026, well before the high-risk runway opens.

• Article 4 AI literacy has applied since February 2025. The Digital Omnibus does not touch it, so your staff still need a defensible level of competence now.
• Article 50 transparency obligations apply from 2 August 2026. The date most people attach to the AI Act is still live.
• Watermarking of AI-generated content, for systems already on the market, falls due by 2 December 2026. The grace period dropped from six months to three, so this arrived sooner, not later.
• A new prohibition on AI that generates non-consensual intimate imagery and child sexual abuse material takes force from December 2026. Brussels added it to the Act rather than deferring it.

Four of those five items sit in 2026. The one piece of real relief is the high-risk regime. That is the tier most organisations had the least chance of meeting anyway.

The trap in the word “delay”

A board hears that the AI Act has slipped to 2027, and quietly moves the file down the agenda. That is the predictable misreading, and heading it off is a governance lead’s job this quarter. The operational scrutiny that defines 2026 did not pause. If anything, the Digital Omnibus tightened the near-term cluster. It also removed the one deadline loud enough to keep the topic in the room.

The simplifications underneath the delay

Time was not the only thing the Digital Omnibus handed out. Exemptions that already cover small and medium enterprises now reach small mid-caps too. The legal basis for processing special-category data to detect and correct bias also widens. It now covers all AI systems and general-purpose models, not just high-risk providers. The EDPB and EDPS had asked for that necessity test.

The AI Office gains a reinforced supervisory role. One quieter change deserves a flag. Providers must register high-risk systems in the EU database even where they judge those systems exempt. The benefit of the doubt now comes with a paper trail.

What this means for the next two quarters

Use the runway to 2027, but do not treat it as breathing room. The high-risk documentation, the risk-management system and the conformity work all take real time to build. Each is closer to a year than a quarter. The standards you will lean on may not surface until late 2026. Starting the classification now is the only way the longer deadline becomes an advantage rather than a cliff. None of that matches the Digital Omnibus sales pitch, yet it is what the next two quarters quietly require.

Classification is also where the gap bites hardest. The Commission still owes the Article 6 high-risk guidance that tells you which systems sit in scope. The Digital Omnibus did not deliver it. Until that guidance lands, your inventory rests on the draft criteria, enough to begin but not to finish.

A deferral is not a dismissal.

Where this leaves you

The Digital Omnibus is now law, give or take its publication in the Official Journal. It takes force three days after that. So the useful response is not to celebrate the 2027 dates. Map the 2026 ones first, because regulators will test those while everyone else reads the headline. Future Prep is tracking each date as the final text lands. The near-term calendar is the one to build against.