Image: Unsplash.
Status checked October 19, 2026: Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. The Annex III date in it is binding law, and so is the Annex I date.
If the only thing your team heard is "the EU AI Act got delayed", that's half right. The stand-alone high-risk rules did move, by law. Three sets of duties kept their dates, and the Omnibus added two bans on top. Every date in the table was checked against the Official Journal text.
| Event | Date | Status |
|---|---|---|
| Commission proposal (part of the digital omnibus package) | November 19, 2025 | Done |
| Provisional agreement between Parliament and Council negotiators | May 7, 2026 | Done |
| European Parliament vote (423 for, 57 against, 174 abstentions) | June 16, 2026 | Done |
| Council adoption | June 29, 2026 | Done |
| Regulation (EU) 2026/1744 signed | July 8, 2026 | Done |
| Official Journal publication | July 24, 2026 | Done |
| Entry into force | July 27, 2026 | Done |
| Annex III deadline (original) | August 2, 2026 | Replaced |
| New Annex III deadline | December 2, 2027 | Binding law |
| New Annex I deadline | August 2, 2028 | Binding law |
Screenshot: "AI Omnibus enters into force", European Commission, Shaping Europe's digital future, July 27, 2026.
What the Digital Omnibus Changes
Regulation (EU) 2026/1744 makes six changes that matter to small teams:
1. Annex III high-risk deadline: Moves from August 2, 2026 to December 2, 2027, a 16-month extension for stand-alone high-risk AI (hiring, credit, healthcare, education, biometrics, critical infrastructure, border control).
2. Annex I deadline: AI embedded in regulated products (medical devices, machinery, vehicles) moves from August 2, 2027 to August 2, 2028, a one-year extension.
3. Article 50 marking transition, not a general delay: Article 50 applies from August 2, 2026. The Omnibus only gives providers of generative systems placed on the market before August 2, 2026 until December 2, 2026 to meet the Article 50(2) machine-readable marking duty. Chatbot disclosure (people must be told they're interacting with AI unless it's obvious) and deepfake disclosure by deployers apply from August 2, 2026.
4. New prohibitions (December 2, 2026): The Omnibus adds an explicit ban on AI systems that generate non-consensual intimate imagery (NCII) and child sexual abuse material (CSAM), including AI "nudifiers". Compliance required by December 2, 2026. See the nudification ban + watermarking checklist.
5. Small mid-caps get some SME relief: Small mid-cap enterprises (SMCs) are companies that are not SMEs, employ fewer than 750 people and have annual turnover up to €150 million or a balance sheet up to €129 million. They can now use the simplified technical documentation form, get priority access to the EU-level AI regulatory sandbox, and have fines under Article 99(4) and (5) capped at the lower of the percentage or the fixed amount, as SMEs already did.
6. Bias detection with sensitive data: Providers and deployers may process special category data (race, health, sexual orientation) where strictly necessary to detect and correct bias, with safeguards. The legal basis used to cover only providers of high-risk systems; it now also covers other AI systems and models and deployers of high-risk systems.
How the Extension Became Law
Parliament and Council negotiators reached a provisional agreement on May 7, 2026. The final text uses fixed dates: December 2, 2027 for Annex III and August 2, 2028 for Annex I.
The European Parliament approved it on June 16, 2026 by 423 votes to 57, with 174 abstentions, and the Council adopted it on June 29. The regulation is dated July 8, 2026, was published in the Official Journal on July 24 and entered into force on July 27, 2026, the third day after publication.
That was before August 2, 2026, so there was no gap in which the original Annex III date applied.
Screenshot: EUR-Lex record for Regulation (EU) 2026/1744, October 2026. Source: EUR-Lex, Publications Office of the European Union.
GPAI Model Rules Are Already in Force
The GPAI (General Purpose AI) model obligations under Articles 51-56 came into force on August 2, 2025, not 2026. The Digital Omnibus does not affect this. The Commission's enforcement powers for GPAI providers started on August 2, 2026.
If you use Claude, GPT-4, or Gemini as underlying models in your product, this enforcement date is relevant to your providers, it is not directly your obligation as a deployer, but it means your AI vendors are now subject to active Commission supervision.
Image: Pexels, used under the Pexels License.
What To Do Now (6-Point Checklist)
The extension is law. Here is what to do:
- Do not cancel compliance work already in progress. The extension gives you more time, it does not mean the AI Act goes away. High-risk AI deployers still have obligations by December 2027.
- Tell your leadership the new date is binding. Regulation (EU) 2026/1744 is in force, so an August 2026 high-risk sprint is no longer required, but December 2, 2027 is.
- Update your project timelines. If you built an August 2026 deadline into your compliance roadmap, the new target is December 2, 2027 for Annex III systems.
- Do not stop GPAI-related work. The GPAI enforcement date (August 2, 2026) is not affected by the Omnibus. If you use frontier AI models (Claude, GPT-4, Gemini) in your products, your vendors have faced active Commission enforcement since August 2.
- Check the December 2, 2026 dates: the two new bans, and the Article 50(2) marking deadline for generative systems already on the market.
- Request vendor documentation for a December 2027 timeline. If vendors were slow to respond because of the August crunch, re-engage with the new timeline, you may get better documentation with more time.
What the SME and Small Mid-Cap Measures Actually Mean
The Omnibus does not remove obligations for smaller companies. It extends some existing SME relief and brings in small mid-caps:
- Simplified technical documentation: SMEs, including start-ups, and SMCs may provide the Annex IV technical documentation on a simplified form the Commission will publish. Notified bodies must accept it.
- Quality management: all SMEs, not only microenterprises, may meet certain quality management system elements in a simplified way, as long as they have no partner or linked enterprises.
- Fines: for SMCs, fines under Article 99(4) and (5) are capped at the lower of the percentage of turnover or the fixed amount.
Most of this helps providers, the companies that build or sell a high-risk AI system under their own name. If you only deploy a vendor's high-risk system, your Article 26 duties are the same: use it according to the instructions, assign human oversight, keep the logs under your control, and inform workers before using it at work.
How the Extended Timeline Affects Your Compliance Roadmap
The 16-month extension from August 2026 to December 2027 creates three distinct planning scenarios depending on where you are now:
Scenario 1 (you have not started): The extension means December 2027 is your operational deadline for Annex III systems. You have time to plan properly. Priority actions now: classify your AI systems against Annex III categories, identify which if any qualify as high-risk, and request vendor EU AI Act documentation. The GPAI enforcement date (August 2, 2026) is unchanged, so if your product uses a frontier model, your vendors have been under active supervision since August.
Scenario 2 (you are mid-compliance): The extension gives you more runway. Do not stop work, use the additional time to improve quality rather than delay start. Documentation prepared now will be more defensible than documentation assembled under deadline pressure in late 2027.
Scenario 3 (you planned to be ready by August 2026): The extension does not invalidate your work. Keep the documentation current; you'll need it anyway, and you can hand it to customers who ask how you use AI.
What Has Not Changed
Several obligations keep their dates under the Digital Omnibus:
Prohibited AI practices (Article 5): The bans in force since February 2, 2025, including social scoring, real-time remote biometric identification in public spaces for law enforcement (with exceptions), and AI systems that exploit vulnerabilities to distort behaviour, are unchanged. The Omnibus adds two new bans from December 2, 2026 (change 4 above).
GPAI model obligations (Articles 51-56): Came into force August 2, 2025. Commission enforcement powers activate August 2, 2026. Unchanged by the Omnibus.
Transparency obligations (Article 50): Chatbot disclosure (people must be told they're interacting with an AI system unless that's obvious) and deepfake disclosure by deployers apply from August 2, 2026 and weren't moved by the Omnibus. Machine-readable marking under Article 50(2) also applies from August 2, 2026, but generative systems already on the market before that date have until December 2, 2026. See the Article 50 compliance checklist and nudification ban + watermarking checklist for deadline-specific action steps.
GDPR obligations for AI data processing: Entirely separate from the EU AI Act. Not affected by the Omnibus.
For most small teams, the practical list of obligations active now is shorter than the Annex III compliance discussion suggests: prohibited practices (have you deployed anything in Article 5 categories?), GPAI-adjacent obligations (if you use frontier models in a product), and transparency requirements for chatbots and synthetic content. Those are live today. The Annex III high-risk framework, the big compliance project, is what December 2027 governs.
Practitioners have noticed the same gap. Writing about banks that are moving from chatbots to agents that trigger payments, u/Fresh_Spread_9223 in r/AI_Agents put it this way: "So right now there's a gap: firms are deploying agents, and the rules that would clearly govern them aren't in force yet." We agree with the diagnosis but not with waiting: if an agent of yours touches hiring, credit or insurance pricing, start the Annex III classification now, because the deployer duties arrive in one go.
References
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, July 24, 2026
- European Parliament press release, June 16, 2026
- EPRS At a Glance: Digital Omnibus on AI, adoption in plenary, June 8, 2026
- AI Omnibus enters into force, European Commission, July 27, 2026
- The enforcement framework of the AI Act, European Commission
- Related: EU AI Act compliance checklist
Correction (October 13, 2026): An earlier version said the Omnibus delayed Article 50 content labeling and deepfake marking to December 2, 2026, and that chatbots only had to disclose when asked. Only Article 50(2) marking for systems already on the market got until December 2, 2026, and chatbots must disclose unless it's obvious.
Correction (October 19, 2026): An earlier version said the Official Journal published the Omnibus on July 27, 2026; it was published July 24 and entered into force July 27. Parts of the text still called it a provisional agreement, not law. We also gave a December 2025 proposal date (it was November 19, 2025) and two trilogue dates we could not confirm, said the Omnibus does not touch Article 5 (it adds two bans), gave deployers the provider duties of technical documentation and conformity assessment, and described SME exclusions for critical infrastructure, justice, law enforcement and financial institutions that are not in Regulation (EU) 2026/1744.
