This is a general summary, not legal advice; check your obligations with counsel. With that said: after months of negotiation, the EU's Digital Omnibus on AI was published as Regulation (EU) 2026/1744 in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, according to White & Case. It changes the timetable for the AI Act's most demanding requirements.
What moved
- High-risk systems listed in Annex III — the stand-alone use cases such as employment, credit and essential services — now apply from 2 December 2027, instead of 2 August 2026.
- High-risk AI that is a safety component of products covered by existing EU product legislation (Annex I) now applies from 2 August 2028, instead of 2 August 2027.
- Generative-AI watermarking for systems already on the market before 2 August 2026 gets until 2 December 2026.
What didn't move
- The bulk of the Article 50 transparency obligations still apply from 2 August 2026 — people must be told when they are interacting with an AI system, and certain synthetic content must be marked.
- Obligations for general-purpose AI model providers have applied since 2 August 2025, according to Gibson Dunn's summary.
- Prohibited practices remain prohibited, and the omnibus adds new ones, including AI used to generate child sexual abuse material and non-consensual intimate imagery of identifiable people.
Other changes worth knowing
White & Case notes simplified technical documentation and proportionate quality-management requirements for smaller companies, and a shift in the AI-literacy duty from ensuring a sufficient level of literacy to taking measures to support it. The AI Office's supervisory powers also expand over certain systems built on general-purpose models.
A later deadline is not a lighter obligation. It is more time to do the same work properly — and the transparency rules that already apply mean any customer-facing chatbot or voice agent should disclose that it is an AI today.
How to use the extra time
- Inventory your AI systems — what you run, what you buy, which decisions they influence. You can't classify risk for systems you haven't listed.
- Classify against the Act's categories — a short, documented assessment per system, reviewed by someone who can defend it.
- Build the evidence now — audit trails, human-oversight points, data-governance records and evaluation results are slow to retrofit and valuable regardless of the deadline.
- Fix disclosure today — wherever people talk to an AI system, tell them so plainly.
Teams that treat the delay as a reason to wait will find the same work waiting for them in 2027, with less time. Teams that use it to put governance into how they build will find that compliance is mostly a by-product of building reliable systems.