On 27 July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force. It is the first amendment to the AI Act since 2024 and its headline change is a delay: obligations for high-risk AI systems now apply from fixed dates in December 2027 and August 2028 rather than August 2026. It is tempting to read this as a pause. It is not. Much of the Act already applies, and one of its most visible obligations started on schedule on 2 August 2026.
What changed
- High-risk deadlines deferred. Stand-alone high-risk systems listed in Annex III, such as those used in employment, credit or education, now face obligations from 2 December 2027. AI embedded in products covered by EU product-safety law under Annex I follows on 2 August 2028.
- Fixed dates. The Commission had proposed a trigger tied to the availability of harmonised standards. The final text uses calendar dates instead, which makes planning easier.
- AI literacy reframed. Article 4 now requires providers and deployers to take measures that support the development of AI literacy, rather than to ensure a sufficient level of it. It is an obligation of effort, not result, but it remains an obligation.
- New prohibitions. Systems that generate non-consensual intimate imagery or child sexual abuse material join the list of prohibited practices from 2 December 2026.
What did not change
The structure of the Act is intact: the risk-based tiers, the distinction between providers and deployers, the conformity-assessment regime for high-risk systems and the separate track for general-purpose AI models. The prohibitions have applied since February 2025, general-purpose AI obligations since August 2025, and the Article 50 transparency duties, including telling people when they are interacting with an AI system and labelling deepfakes, since 2 August 2026.
The dates that matter now
- Already applying: prohibited practices, AI literacy, general-purpose AI obligations, Article 50 transparency.
- 2 December 2026: machine-readable marking of AI-generated content extends to systems already on the market; new prohibitions apply.
- 2 December 2027: high-risk obligations for Annex III systems.
- 2 August 2028: high-risk obligations for Annex I systems.
Five steps to readiness
- Build an inventory. List every AI system you develop, buy, embed or use, including features switched on inside software you already license. You cannot classify what you have not found.
- Establish your role for each system. Provider, deployer, importer or distributor. The same organisation often holds different roles for different systems, and substantially modifying a bought-in system can make you its provider.
- Classify by use, not by technology. Risk under the Act attaches to the purpose a system serves. A language model is minimal risk as a drafting aid and may be high risk when it screens job applicants.
- Assess gaps against the obligations that apply. For high-risk systems that means risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness. For the rest it is mainly transparency and literacy.
- Put governance in place. An AI policy, clear accountabilities, an approval gate for new use cases and supplier due diligence make compliance repeatable instead of a one-off exercise.
Pitfalls we see
- Treating the deferral as a cancellation and stopping preparation. Technical documentation for a high-risk system takes months to assemble properly.
- Overlooking AI that arrives inside third-party products and platforms.
- Forgetting that deployers carry their own obligations, including human oversight and, in some cases, a fundamental-rights impact assessment.
- Classifying the model instead of the use case.
