Image: Unsplash.
Update (October 19, 2026): The Digital Omnibus on AI entered into force July 27, 2026. The question this article first asked, "will the deadline hold?", is answered: no. December 2, 2027 is binding law for Annex III high-risk AI systems. Article 50 obligations and GPAI enforcement still applied from August 2, 2026.
On May 7, 2026, Parliament and Council negotiators reached a provisional agreement on the Digital Omnibus on AI. The European Parliament approved it on June 16, 2026 by 423 votes to 57, with 174 abstentions. The Council adopted it on June 29, 2026. The Official Journal published Regulation (EU) 2026/1744 on July 24, 2026, and it entered into force on July 27.
Screenshot: European Parliament press release 20260611IPR45207, June 16, 2026. Source: European Parliament.
If you planned around August 2, 2026, here is what moved, what stayed, and what a deployer does next.
What the final text says
Regulation (EU) 2026/1744 defers the high-risk rules in Chapter III, Sections 1 to 3 of the AI Act, except Article 6(5). For Annex III systems, they now apply from December 2, 2027 instead of August 2, 2026. For high-risk AI in products covered by Annex I, they apply from August 2, 2028 instead of August 2, 2027.
Screenshot: Regulation (EU) 2026/1744, point (40), amending Article 113. Source: EUR-Lex, Publications Office of the European Union.
Those sections cover classification, the provider and deployer duties in Articles 16 to 27, and the core technical requirements in Articles 9 to 15:
- Article 9: Risk management system requirements
- Article 10: Data governance and data quality requirements
- Article 11: Technical documentation standards
- Article 12: Record-keeping and logging requirements
- Article 13: Transparency and provision of information to deployers
- Article 14: Human oversight measures
- Article 15: Accuracy, robustness, and cybersecurity requirements
These are the obligations that require the most significant internal work: building documentation systems, establishing audit trails, implementing human-in-the-loop controls, and, for some biometric systems, a third-party conformity assessment.
The new date covers every Annex III area: biometrics, critical infrastructure, education, employment, access to essential services such as credit and life and health insurance, law enforcement, migration and border control, and justice and democratic processes. High-risk systems used by public authorities that were already on the market before the new date must comply by August 2, 2030.
What did not move
Three sets of obligations kept their dates.
Article 5: Prohibited AI practices. These have been in force since February 2, 2025. They include social scoring, real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions), AI that uses subliminal or manipulative techniques or exploits vulnerabilities to distort behavior, and biometric categorisation that infers race, political opinions, religion or sexual orientation. The Omnibus did not delay any of them, and it adds two bans from December 2, 2026: AI that generates realistic intimate or sexually explicit images, video or audio of an identifiable person without consent, and AI that generates child sexual abuse material.
Article 50: Transparency obligations. These apply from August 2, 2026. Article 50 requires that AI systems designed to interact directly with people tell them they are dealing with an AI, unless that is obvious. Providers of generative AI must mark synthetic audio, image, video and text in a machine-readable way, and deployers must disclose deepfakes. The only Omnibus change is a transition for Article 50(2) marking: generative systems already on the market before August 2, 2026 have until December 2, 2026.
GPAI obligations for model providers. In effect since August 2, 2025. General-purpose AI model providers, meaning companies that develop foundation models or large language models and place them on the EU market, must prepare technical documentation, give information to downstream providers, put in place a copyright policy and publish a summary of training content, and, for models with systemic risk, run adversarial testing. The Commission's power to fine GPAI providers started on August 2, 2026. The Omnibus did not change or extend these dates.
Image: Unsplash.
How the delay became law
When this article was first published in June, the provisional agreement was not yet law and the open question was timing: if the regulation had not entered into force before August 2, 2026, the original Annex III date would have applied.
It did enter into force in time. The regulation states that it enters into force on the third day following its publication in the Official Journal. With publication on July 24, that was July 27, 2026, six days before the original deadline. The scenario in which the original deadline held did not happen.
The day after the Council's final vote, one reader in r/FuturePrep summed up the risk in one line: "The misread is treating the whole Act as deferred." That's the right warning, and it's why the next section starts with the duties that already apply.
Actions to take now
These are the investments worth making now that the dates are fixed.
Complete your AI tool inventory and risk classification. You cannot plan compliance without knowing which tools you have and which Annex III categories they fall into. It takes time if you have deployed AI broadly across the organization. Start now.
Implement Article 50 transparency notices. Article 50 has applied since August 2, 2026, so any AI system your organization offers that interacts directly with people must tell them they are dealing with an AI, unless that is obvious. For most teams, this is a short text notice added to the user interface. The work is limited and the deadline has passed.
Document human oversight procedures. Article 26 requires deployers to assign human oversight to people with the competence, training and authority to do it, following the provider's instructions. Having documented oversight procedures now is good governance practice, reduces liability risk in case of AI-related incidents, and forms the foundation of the documentation you will need by December 2027.
Conduct fundamental rights impact assessments. Article 27 requires deployers of high-risk Annex III AI systems in certain categories to complete a fundamental rights impact assessment before deploying the system. This obligation is separate from the Articles 9-15 technical obligations. Check whether it applies to your tools and conduct the assessment if so.
Review your GPAI vendor relationships. If you are deploying tools built on general-purpose AI models, your vendors have had GPAI obligations since August 2, 2025, and the Commission can enforce them since August 2, 2026. Ask for the documentation they give downstream providers and their training content summary. Their compliance status affects your documentation.
What deployers should not do
Do not treat the delay as 16 months of inaction. The December 2027 deadline is not far off, and high-risk work (classification, vendor documentation, oversight procedures, impact assessments where Article 27 applies) takes time to arrange. Use the extension to do the work properly, not as permission to deprioritize it.
Do not overlook the overlap between EU AI Act obligations and GDPR requirements. Many of the data governance requirements under Article 10 mirror GDPR data quality and minimization principles. Your GDPR documentation is a head start on EU AI Act technical documentation, not a substitute.
Where to check the dates
The application dates are in Article 113 of the consolidated AI Act on EUR-Lex, which now includes the Omnibus amendments. The AI Policy Desk AI regulation deadline calendar 2026 tracks key dates as they are confirmed.
For a complete breakdown of what applied August 2 versus what moved, see What is delayed vs what applies, EU AI Act August 2026. For deployers focused on the GPAI layer, the EU AI Act GPAI compliance checklist August 2 deadline covers that category specifically. For evidence gaps that SMEs commonly face, see EU AI Act deployer evidence gaps SME August 2026.
Correction (October 13, 2026): An earlier version said the Omnibus delay covers Articles 9 to 15 only. The final text, Regulation (EU) 2026/1744, delays Chapter III, Sections 1 to 3 (except Article 6(5)), which also covers classification and provider and deployer duties.
Correction (October 19, 2026): An earlier version said the Official Journal published the Omnibus on July 27, 2026 (it was published July 24 and entered into force July 27), that the Omnibus does not affect Article 5 (it adds two bans from December 2, 2026), that GPAI requirements start August 2, 2026 (they have applied since August 2, 2025), and that regulations enter into force 20 days after publication (this one entered into force on the third day). It also limited the social scoring ban to public authorities and placed deployer human oversight in Article 14; the ban covers everyone and the deployer duty is in Article 26 (consolidated AI Act).
Related reading
- EU AI Act Annex IV technical documentation guide: all 9 sections
- EU AI Act compliance guide for small teams
- EU AI Act August 2026 compliance checklist
- EU AI Act Article 50 watermarking and deepfake disclosure
- EU digital omnibus AI Act deadline extension 2026
- ISO 42001 vs NIST AI RMF for small teams
- AI regulation deadline calendar 2026
- EU AI Act prohibited AI practices Article 5 guide
- EU AI Act: what is delayed vs what applies August 2026
- EU AI Act enforcement starts August 2, 2026: what it means and what to d
- EU AI Act high-risk AI documentation templates for August 2026 (Articles
- EU AI Act Nudification Ban + Watermarking: December 2026 compliance deadline
- What Is the EU AI Act? Plain-English Guide (2026)
