What changed
The Digital Omnibus on AI is now law. It amends the EU AI Act and entered into force in July 2026 after publication in the Official Journal. The headline change is timing. Obligations for stand-alone high-risk systems, the Annex III categories that include recruitment, credit scoring and education, now apply from 2 December 2027 rather than 2 August 2026. High-risk AI embedded in products covered by Annex I, such as medical devices, moves to 2 August 2028.
What did not change
The Article 50 transparency duties were not postponed. They have applied since 2 August 2026. The only relief is narrow: systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2). The Omnibus also adds new prohibitions on AI that generates non-consensual intimate imagery or child sexual abuse material, with technical safeguards required by 2 December 2026.
Some changes widen obligations rather than narrowing them. Providers who decide their Annex III system is not high-risk still have to register it in the EU database, with a lighter set of information. The legal basis for processing special category data to detect and correct bias now extends beyond high-risk providers to providers and deployers of any AI system, under a strict necessity test.
Why the delay is shorter than it looks
For a team that has a recruitment screening tool or a credit decision model in the EU market, the high-risk regime asks for a risk management system, data governance, technical documentation, logging, human oversight design, accuracy and robustness testing, and a quality management system. None of that is a document you write in a quarter. Most of it depends on decisions made early in the system's design: what gets logged, who can override an output, how training data is selected and recorded.
Fourteen extra months is useful if it is spent building those foundations into the product. It is not useful if it is spent waiting for harmonised standards to settle before anyone starts.
What we would do with the time
- Confirm which systems are in scope, including systems you have self-assessed out of high-risk, since those still need registration.
- Check Article 50 now. If you ship a chatbot, a generative feature or synthetic media into the EU, the transparency duties are already live.
- Pick one high-risk candidate system and run it through the requirements end to end. The gaps you find will tell you more than a portfolio-wide questionnaire.
- Use the bias-detection data provision deliberately. Write down the necessity case before processing anything.
For UK teams the same logic applies to anything sold or used in the EU. The UK has not adopted an equivalent regime, but EU customers will ask for evidence regardless of where the provider sits.
If you need to work out which of your AI systems these dates actually touch, and what to do first, that is the kind of question we work through in the AI Opportunity and Governance Sprint.