The EU's Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on 27 July 2026, has moved the core Annex III high-risk AI compliance deadline from 2 August 2026 to 2 December 2027, giving affected organisations an additional sixteen months to prepare. However, Article 50 transparency obligations and the AI Office's enforcement and penalty regime applied as scheduled on 2 August 2026 and remain fully in effect. International companies operating in the EU should not treat this extension as a suspension of AI Act compliance work.
What Changed and When: A Summary of the Digital Omnibus Timeline
The Digital Omnibus on AI followed a compressed legislative path. Political agreement was reached on 7 May 2026, the European Parliament adopted the text in plenary on 16 June 2026, and the Regulation was published in the Official Journal of the European Union on 24 July 2026. It entered into force three days later, on 27 July 2026.
The amendment made two targeted but significant changes to the original AI Act timetable:
- Annex III high-risk AI systems (stand-alone AI systems in areas such as critical infrastructure, education, employment, essential private and public services, law enforcement, migration and the administration of justice): the full set of obligations previously due on 2 August 2026 is now deferred to 2 December 2027.
- Annex I product-embedded AI systems (AI components integrated into products already subject to Union harmonisation legislation, such as machinery, medical devices and toys): the compliance date remains 2 August 2028, unchanged by the Digital Omnibus.
What the Digital Omnibus did not change is equally important. The Article 50 transparency obligations – requiring providers and deployers of certain AI systems to inform natural persons that they are interacting with AI, and to label synthetic content – applied on 2 August 2026 as originally scheduled. The AI Office's supervisory and enforcement powers over general-purpose AI model providers, together with the Regulation's penalty regime, are also fully operative from that date.
Who Is Affected in the European Union
The amendment affects any provider or deployer of AI systems falling within the categories listed in Annex III of the AI Act, wherever they are established, if they place systems on the EU market or put them into service in the EU. This covers a broad range of sectors.
Organisations that should review their exposure immediately include:
- Financial institutions using algorithmic models for credit scoring, insurance risk assessment or anti-money-laundering screening – areas closely monitored by ESMA and EBA in their respective sectors;
- Employers and HR technology vendors using AI tools in recruitment, performance evaluation or workforce management (a category explicitly listed in Annex III);
- Providers of AI-powered systems in healthcare, critical infrastructure management and biometric identification;
- Public authorities and their private-sector contractors deploying AI in benefits administration, border management or judicial processes;
- Developers and deployers of general-purpose AI models with systemic risk designations, who remain subject to AI Office oversight regardless of the Annex III deferral.
If your organisation uses AI in an employment or workforce context, the intersection of AI Act obligations with existing labour and data protection frameworks remains relevant now, not only from December 2027. Our employment law practice can assist with assessing where AI deployment creates exposure under parallel regimes.
What Remains in Force from 2 August 2026
It is a material compliance risk to read the Annex III deferral as a broad pause on AI Act obligations. The following requirements are already operative:
- Article 50 – Algorithmic transparency: providers of AI systems intended to interact with natural persons must ensure those persons are informed they are engaging with an AI system; providers of AI-generated synthetic content (including deep fakes) must label that content accordingly.
- General-purpose AI (GPAI) obligations: providers of GPAI models must comply with transparency documentation, copyright policy and technical information requirements. Providers of GPAI models with systemic risk face additional adversarial testing and incident reporting obligations under AI Office supervision.
- Penalty regime: fines for non-compliance with applicable provisions are enforceable. The European Commission and national market surveillance authorities have standing authority to act.
- GPAI Code of Practice: compliance with the voluntarily adopted Code of Practice provides a rebuttable presumption of conformity with GPAI obligations and should be monitored for updates published on EUR-Lex and through the AI Office.
For organisations with operations in Germany, where national AI governance structures and existing product liability frameworks create additional layers of consideration for high-risk AI systems, detailed guidance is available in our AI Act compliance practice for Germany.
Key Deadlines at a Glance
| Obligation | Deadline / Status | Basis |
|---|---|---|
| Article 50 transparency requirements | In force from 2 August 2026 | AI Act (unamended) |
| AI Office enforcement and penalty regime | In force from 2 August 2026 | AI Act (unamended) |
| General-purpose AI (GPAI) model obligations | In force from 2 August 2026 | AI Act (unamended) |
| Annex III high-risk AI system obligations | Deferred to 2 December 2027 | Regulation (EU) 2026/1744 |
| Annex I product-embedded AI obligations | 2 August 2028 (unchanged) | AI Act (unamended) |
Immediate Actions for International Companies
The sixteen-month extension for Annex III obligations should be used as structured preparation time, not as a deferral of analysis. The following actions are advisable now:
- Conduct or update an AI system inventory. Map all AI tools in use against the Annex III categories. Many systems that were not previously considered high-risk may fall within scope as interpretive guidance from the AI Office develops.
- Assess current Article 50 exposure. If any deployed AI system interacts with natural persons or generates synthetic content, review whether the transparency disclosure and labelling requirements are satisfied today.
- Classify any GPAI model use. If your organisation develops or fine-tunes general-purpose AI models, determine whether systemic risk thresholds are met and what ongoing obligations apply under the AI Office framework.
- Align internal governance with the 2 December 2027 timeline. Begin conformity assessment preparation, technical documentation drafting and human oversight framework design now, particularly for systems in the employment, financial services and healthcare sectors where ESMA, EBA and sector-specific regulators are actively developing guidance.
- Monitor CJEU case law and national regulatory developments. As the first enforcement actions reach the CJEU and national courts, interpretive positions on key definitions – including what constitutes a high-risk system and the scope of deployer obligations – will evolve. Our high-risk AI roadmap analysis for 2027 tracks these developments on a rolling basis.
National implementation rules, market surveillance authority designations and sector-specific guidance from bodies such as ESMA and EBA remain pending or subject to national variation in several member states. Organisations should not assume that EU-level compliance alone satisfies all applicable requirements in each jurisdiction where they operate.
If you would like to discuss how the Digital Omnibus changes affect your organisation's AI compliance programme, please contact our team at info@ferrazwhitmore.com or visit our contacts page. We assist clients across the EU and internationally in mapping regulatory obligations, preparing conformity documentation and engaging with supervisory authorities.
Conclusion: An Extension, Not a Pause
Regulation (EU) 2026/1744 provides valuable additional time for Annex III high-risk AI Act compliance, but it does not reduce the urgency of preparation for organisations already subject to the Article 50 transparency regime, the AI Office's general-purpose AI oversight, or the active penalty framework. The 2 December 2027 date will arrive faster than comparable regulatory transitions have in the past, particularly given the documentation, conformity assessment and governance work required across complex AI systems in regulated industries.
To discuss how these changes apply to your specific operations or to begin a structured AI Act readiness review, reach out to Ferraz & Whitmore at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.