EU AI Act Digital Omnibus: what the deferral does not cover

When the EU AI Act Digital Omnibus became law on 27 July 2026, most coverage led with one word: delayed. That reading has led some companies to stand down their compliance work, and it is wrong in an expensive way. The high-risk rules did move to December 2027. But the obligation that touches the widest range of ordinary businesses did not move at all, and it has applied since 2 August 2026.

This article sets out what the Omnibus deferred, what it left alone, and what a business should be doing now. It is a summary for business readers, not legal advice, and a note at the end explains how to treat it.

What the Omnibus is

Formally it is Regulation (EU) 2026/1744. The European Commission proposed it in November 2025 as a simplification package, negotiators reached political agreement on 7 May 2026, and the European Parliament approved it on 16 June 2026 by 423 votes to 57, with 174 abstentions. The Council gave final approval on 29 June 2026. It was published in the Official Journal on 24 July and entered into force on 27 July. It amends the AI Act, the Machinery Regulation and the Basic Aviation Regulation.

It simplifies; it doesn’t repeal. The Act’s risk-based structure, its prohibited practices and its rules for general-purpose AI models all remain. Only parts of the calendar changed.

What was deferred

Three deadlines moved. The reason was practical: the harmonised standards providers need to show conformity weren’t going to be ready for August 2026.

• Stand-alone high-risk systems: 2 December 2027. Annex III covers recruitment and worker management, education, credit scoring, insurance pricing, access to essential services, critical infrastructure and law enforcement. Their obligations, including risk management, technical documentation, human oversight and conformity assessment, now apply from 2 December 2027, a deferral of 16 months.
• AI built into regulated products: 2 August 2028. This covers products already under EU product-safety law, such as medical devices and toys, moved from August 2027.
• Regulatory sandboxes: 2 August 2027. Member states now have until then to set up national sandboxes.

What was not deferred

Article 50, the transparency provision, isn’t a high-risk rule. It applies as a separate layer to any AI system used in the situations it covers, whatever its risk class. The Omnibus left it untouched, so it has applied since 2 August 2026.

Consider who that captures. A company running a customer-service chatbot is in scope. A marketing team publishing AI-generated images is in scope. A recruitment firm using AI to draft outreach is in scope. None of them necessarily runs a high-risk system, so none benefits from the December 2027 date.

Enforcement started the same day. National market surveillance authorities can act on Article 50 breaches, and fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher. The general-purpose AI obligations and the Article 5 prohibitions also stayed on their original timelines; the prohibitions and the AI literacy duty have in fact applied since February 2025.

The four transparency duties

The Commission adopted guidelines on Article 50 on 20 July 2026, so the scope is now reasonably clear. Four situations trigger duties: two for providers, two for deployers.

• Direct interaction (providers). People must be told they are interacting with an AI system, unless that is obvious to a reasonably observant person.
• Marking synthetic content (providers). AI-generated images, audio, video and text must carry machine-readable marking showing they are artificially generated.
• Emotion recognition and biometric categorisation (deployers). The people exposed must be told the system is operating.
• Deepfakes and public-interest text (deployers). Deepfake content must be disclosed, as must AI-generated text published to inform the public on matters of public interest.

The one grace period

The Omnibus made one concession here, and it is narrower than many summaries suggest. Generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2). The Commission’s guidance says content generated before 2 August 2026 doesn’t need to be labelled retroactively. Everything else in Article 50 already applies.

What falls outside

Purely personal, non-professional use is outside these rules. So are systems that only assist with editing without substantially altering the input, such as grammar correction, and certain law-enforcement uses. Open-source systems are not exempt from Article 50.

Six other changes

1. Two new prohibitions. Article 5 now bans AI systems used to generate child sexual abuse material or non-consensual intimate imagery. Providers of systems in scope have until 2 December 2026 to put technical safeguards in place.
2. A softer AI literacy duty. Article 4 used to require organisations to ensure staff had enough AI literacy. It now asks them to take measures to support it. Documented training remains the easiest evidence to produce in an inspection.
3. More powers for the AI Office. Its supervision now covers all AI systems built on general-purpose models from the same company, and systems that are or sit inside very large online platforms and search engines under the Digital Services Act.
4. Registration was not narrowed. The Commission proposed exempting providers who self-assess a system as not high-risk, but that did not survive negotiation. Those systems must still be registered in the EU database, with a lighter burden.
5. A machinery carve-out. AI in products governed by the Machinery Regulation is now outside the direct scope of the high-risk rules, to avoid duplication. Medical devices and toys remain fully in scope.
6. A wider basis for bias testing. Processing special categories of personal data to detect and correct bias is now permitted for providers and deployers of all AI systems, subject to a strict necessity test.

What to do now

If you serve EU customers and use AI in any customer-facing process, work through these four steps. None needs a lawyer to begin.

1. List every customer-facing use of AI. Chatbots, voice agents, AI-assisted email, generated images on your site, synthetic video, AI-written published content.
2. Check that your chatbot identifies itself. A clearly named bot with an obvious interface may already meet the duty. An assistant that reads as human does not.
3. Decide how you label synthetic media you publish, and write it down as policy so the decision survives staff changes.
4. Ask your vendors in writing how they handle Article 50 marking. If you deploy someone else’s model, their gap becomes your problem.

Regulators generally look at whether an organisation made a good-faith effort, so a dated, documented plan is worth considerably more than silence. If you rely on a model that was already on the market before August, note 2 December 2026 in the diary.

Using the extra time for high-risk systems

For companies that genuinely operate Annex III systems, the extra 16 months may sound generous. It isn’t. Building risk management processes, technical documentation and conformity evidence takes most organisations a year of real work, and the obligations themselves did not soften.

Start with an inventory, not a policy. Most organisations can’t yet say which AI systems they run or how each would be classified. Once you know, classification tells you which duties apply and by when. Then build the documentation habit while the stakes are low: teams that start logging model decisions, data sources and human oversight now will find 2027 mostly clerical. Our AI readiness questions cover the governance side in more detail.

If you are based outside the EU

The Act applies to providers and deployers whose AI system’s output is used in the EU, whatever the company’s home jurisdiction. A software firm with European customers, or an agency producing synthetic media for European brands, can be fully in scope.

Where we can help

Most teams that look find three or four customer-facing uses of AI that nobody had catalogued: a support chatbot, a content workflow, something a department adopted without telling IT. Finding them takes an afternoon. Explaining them to a regulator later takes much longer. We help companies map their AI touchpoints and set up a usage policy and documentation, as part of our AI implementation and automation work. You can also book a session to go through yours.

This article summarises publicly available information about Regulation (EU) 2026/1744 and the EU AI Act as at 31 July 2026, with timing updated on 24 October 2026. The Expert Community is a technology and advisory firm, not a law firm, and nothing here is legal advice. Classification under the AI Act depends on specific facts, so please consult qualified counsel before making compliance decisions.