# The AI Omnibus: what moved, what didn't

> The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and pushed back the EU AI Act's high-risk rules: to 2 December 2027 for Annex III use cases and to 2 August 2028 for AI embedded in Annex I products. Prohibitions, AI literacy, general-purpose AI rules and Article 50 transparency duties did not move. Use the extra time for inventory and documentation.

URL: https://corrplus.net/blog/eu-ai-act-digital-omnibus-delay/
Updated: 2026-11-06
Corrplus Team

## What is the Digital Omnibus on AI, and when did it take effect?

The Digital Omnibus on AI, often shortened to the AI Omnibus, amends the [EU AI Act](/glossary/eu-ai-act/) (Regulation (EU) 2024/1689). The European Commission proposed it on 19 November 2025, the co-legislators reached political agreement on 7 May 2026, and, according to the Commission, it entered into force on 27 July 2026. It was published in the Official Journal as Regulation (EU) 2026/1744.

The Omnibus does not rewrite the Act. The risk-based structure, the roles (provider, deployer, importer, distributor) and the territorial scope stay as they were. The main change is the date on which the high-risk obligations apply. It also adds two prohibitions and softens or clarifies a handful of other provisions.

Nothing in the Omnibus changes when a company outside the EU is caught by the Act. We covered that question in [Does the EU AI Act apply to non-EU companies?](/blog/eu-ai-act-non-eu-companies/). This article focuses on the new timeline and on what to do with the time it buys.

## What was delayed?

The delay covers the core compliance obligations for high-risk AI systems: risk management, data governance, technical documentation, record-keeping, human oversight and conformity assessment.

- **Annex III use cases.** Stand-alone systems used in areas such as biometrics, education, employment and access to essential services, including assessing the creditworthiness of individuals. These rules were due to apply on 2 August 2026, the Act's general application date. The new date is **2 December 2027**.
- **Annex I products.** AI systems that are a safety component of a product covered by EU harmonisation legislation, such as lifts, toys or medical devices. The previous date was 2 August 2027. The new date is **2 August 2028**.

According to the FAQ published by AKOS, Slovenia's national regulator, the Omnibus also moves the Machinery Directive (2006/42/EC) from Section A to Section B of Annex I, and lets the Commission use implementing acts to limit how the Act applies in areas covered by Section A sectoral legislation. What that means for a given machine depends on the product; review it with the team that prepares your technical file and with your legal counsel.

## What did not move?

The delay touches the high-risk timeline only. These obligations already apply or started on schedule:

- **Prohibited practices**, such as manipulative techniques and social scoring, have applied since 2 February 2025.
- **AI literacy (Article 4)** has applied since 2 February 2025. According to the Commission's Q&A, the duty still sits with providers and deployers after the Omnibus, but no specific or "sufficient" level of literacy is required any more. Supervision by national authorities started on 2 August 2026.
- **General-purpose AI models**: obligations and governance rules have applied since 2 August 2025.
- **Article 50 transparency duties** started on 2 August 2026: telling people they are interacting with AI, marking synthetic content in a machine-readable way, and disclosing deepfakes.

Article 50 has one transition period. According to AKOS and the AI Act Service Desk timeline, providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the output-marking duty in Article 50(2). The transition does not cover the other transparency duties, such as telling users they are talking to an AI or disclosing deepfakes.

## What else did the Omnibus change?

The changes the official sources agree on:

- **Two new prohibitions.** AI systems that generate intimate images of people without their explicit consent, and systems that generate child sexual abuse material. The Commission says these apply from December 2026; the AI Act Service Desk timeline gives 2 December 2026.
- **Special category data for bias.** A new Article 4a allows special categories of personal data to be processed to detect and correct bias, but only where strictly necessary and where the goal cannot be met with anonymised or synthetic data.
- **Small mid-caps.** According to the Commission, some simplifications granted to SMEs, such as simplified technical documentation, now extend to small mid-cap companies.
- **Supervision.** According to the Commission, the AI Office's powers are reinforced and oversight of AI systems built on general-purpose AI models is centralised. According to AKOS, exceptions such as Annex I systems and systems used by law enforcement, border control or financial institutions remain with national authorities.

Secondary sources read some of the finer points differently, including the registration rules. If a specific provision affects your system, read the official text of Regulation (EU) 2026/1744 on EUR-Lex with your legal counsel.

## What applies when?

The table below follows the timeline published by the European Commission and the AI Act Service Desk as of November 2026.

| Date | What applies | Omnibus effect |
|---|---|---|
| 1 August 2024 | The Act enters into force | None |
| 2 February 2025 | Definitions, prohibited practices, AI literacy (Article 4) | No specific literacy level required |
| 2 August 2025 | General-purpose AI rules, governance bodies | None |
| 2 August 2026 | General application, Article 50 transparency, supervision and enforcement | None |
| 2 December 2026 | Two new prohibitions; end of the Article 50(2) transition for earlier generative systems | New |
| 2 August 2027 | At least one AI regulatory sandbox per Member State | None |
| 2 December 2027 | Annex III high-risk use cases | Delayed (was 2 August 2026) |
| 2 August 2028 | High-risk AI embedded in Annex I products | Delayed (was 2 August 2027) |

The timeline has changed before and may change again. Check the Commission's AI Act page and the AI Act Service Desk before you plan.

## Should you wait, or use the time?

Use it. Three reasons.

**High-risk compliance takes longer than it looks.** Risk management, data governance and technical documentation are cheap to build while a system is being designed and expensive to reconstruct for a model already in production. A [credit risk scoring](/solutions/credit-risk-scoring/) model serving consumers in the EU, for example, may fall under Annex III; by late 2027 you will need documented training data sources, model versions and human oversight steps.

**EU customers will not wait for the date.** Suppliers outside the EU, including the many Turkish software, services and machinery exporters selling into the EU, already meet AI questions in vendor assessments. Documentation and logging duties can end up in a contract well before the Act requires them.

**The obligations that did not move are already supervised.** National authorities began supervising AI literacy and transparency in August 2026. If you offer a chat assistant or a system that generates content, those duties apply today.

For companies that want to turn the extra time into a management system, ISO/IEC 42001 is a sound framework; we compare it with the NIST AI RMF in [ISO 42001 vs NIST AI RMF](/blog/iso-42001-vs-nist-ai-rmf/). Neither proves compliance with the Act on its own, but both keep the records and responsibilities you will need in order.

## Where to start

1. Inventory the AI systems your company uses and sells into the EU, and record your role for each.
2. Flag likely high-risk systems under Annex III or Annex I and note the applicable date (2 December 2027 or 2 August 2028).
3. Confirm that content-generating systems mark their outputs by 2 December 2026, and that systems talking to users disclose that they are AI today.
4. Write down your AI literacy measures by team and tool.
5. For high-risk candidates, draw up a documentation and testing plan that runs to 2027.
6. Review the results with your legal counsel.

The umbrella term for this work is [AI governance](/glossary/ai-governance/). The same inventory also underpins your GDPR records and, if you process personal data of people in Türkiye, your KVKK records; running them separately duplicates effort.

Corrplus does not give legal advice. We are the technical team that builds the requirements your counsel sets into your systems. Through our [AI governance](/services/ai-governance/) service we set up the inventory, logging and human oversight controls; through [AI consulting](/services/ai-consulting/) we build a roadmap for systems that may be high-risk. If you are not sure where to begin, our [AI discovery sprint](/ai-discovery-sprint/) maps your systems with you as a first step.

## Frequently asked questions

### Has the EU AI Act been postponed?

Only in part. The Digital Omnibus on AI moved the dates for the main high-risk obligations. Prohibitions and AI literacy have applied since February 2025, general-purpose AI rules since August 2025, and Article 50 transparency duties since 2 August 2026.

### When do the high-risk rules apply now?

According to the European Commission, from 2 December 2027 for Annex III use cases such as employment, education and creditworthiness, and from 2 August 2028 for AI embedded in products covered by Annex I. Before the Omnibus, those dates were 2 August 2026 and 2 August 2027.

### What happens on 2 December 2026?

Two new prohibitions start to apply: AI systems that generate intimate images of people without their explicit consent, and systems that generate child sexual abuse material. Providers of generative AI systems placed on the market before 2 August 2026 must also comply with the output-marking duty in Article 50(2) from that date.

### Is this legal advice?

No. This article summarises the current timeline from official sources. Whether a given system is in scope, and what your role is, should be assessed with your legal counsel. The timeline has changed before, so check the Commission's page before you plan.

## Sources

- [European Commission, Regulatory framework on AI](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- [European Commission, AI Act Service Desk: Implementation timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline)
- [European Commission, AI literacy questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers)
- [AKOS (Slovenian regulator), Digital Omnibus on Artificial Intelligence FAQ](https://www.akos-rs.si/en/umetna-inteligenca/explore/frequently-asked-questions-and-answers/digital-omnibus-on-artificial-intelligence)
- [AI Act, Article 113: Entry into force and application (amendments marked)](https://artificialintelligenceact.eu/article/113/)