EU AI Act Digital Omnibus 2026: What It Changes

The 2026 Digital Omnibus moved four AI Act deadlines, not two: Annex III to 2 December 2027, Annex I to 2 August 2028, national sandboxes to 2 August 2027, and content marking to 2 December 2026. Prohibited practices, GPAI rules and Art. 50 transparency were untouched.

Update — 2 August 2026. The Omnibus deferred the high-risk regime but not the transparency regime, which is now live and enforceable. Read what changed on 2 August 2026.

What the 2026 Digital Omnibus on AI changed

The Digital Omnibus on AI moved four application dates. Two are widely reported; the other two are the ones that catch compliance programmes out.

Everything else kept its date. The omnibus did not create new obligations, remove existing ones, or introduce derogations or exemptions.

What kept its original date

The sandbox deferral is the one most often got wrong. Article 57 requires each Member State to have a national AI regulatory sandbox operational; that obligation moved to 2 August 2027. It is regularly listed among the provisions the omnibus left alone. It is not one of them — see the national implementation tracker for where each Member State currently stands.

Why the Commission extended the deadlines

Three official reasons:

1. Standards not ready — Harmonised technical standards needed for conformity assessments under AI Act Art. 40 were not finalised by the original August 2026 deadline. Without these standards, conformity assessments could not be completed properly.

2. Enforcement infrastructure gap — Notified bodies needed designation and accreditation. National competent authorities required resources and guidelines. The EU AI Office needed operational capacity. An August 2026 deadline would have been unenforceable in practice.

3. Industry and SME readiness — Particularly for smaller providers in medtech, HR technology, and financial services, the parallel burden of AI Act, DORA (January 2025), and NIS2 (October 2024) compliance was cited as excessive.

What the omnibus does NOT do

The omnibus extension is commonly misread as reducing the regulatory burden. It does not:

• Remove any obligation
• Create an exemption for any sector or company size
• Reduce fines for non-compliance after the new deadlines
• Change the scope of what constitutes high-risk AI under Annex III or Annex I
• Affect GPAI rules, prohibited practice bans, or transparency obligations

What this means for a compliance programme

The deferral changes when you must be ready, not what ready means. Three consequences follow, and they run in opposite directions depending on which annex you fall under.

If your system is stand-alone high-risk (Annex III) — recruitment scoring, credit assessment, biometric identification, education, essential services — you have until 2 December 2027. That sounds distant. It is roughly one conformity-assessment cycle: a notified body engagement plus the technical documentation of Annex IV typically runs 12 to 18 months, and notified bodies are still being designated. The deferral removes the crisis, not the lead time.

If your AI is a safety component of a regulated product (Annex I) — medical devices, machinery, civil aviation, vehicles — you have until 2 August 2028, but your sectoral conformity assessment is already running on its own cycle. The practical question is whether your next MDR, Machinery or type-approval submission falls before or after that date, because aligning the two is far cheaper than doing them twice.

If you deploy a chatbot or generate synthetic content, none of this applies to you. Article 50 has been enforceable since 2 August 2026, and the only omnibus concession was a grace period to 2 December 2026 for systems already on the market. That is the nearest real deadline for most organisations, and it is the one the deferral headlines have obscured.

The classification question comes first

Every date above depends on a determination you may not have made: whether your system is high-risk at all. Most are not. Annex III point 5(b) explicitly carves out AI used to detect financial fraud; point 1 excludes one-to-one biometric verification; algorithmic trading appears nowhere in the annex.

Working through classification before buying anything is the difference between a proportionate programme and an expensive one. The risk classifier walks the Annex III categories, and providers vs deployers settles which set of obligations attaches to your role.

Detailed guide to deadline changes

For the obligation-by-obligation breakdown and a compliance programme timeline, see AI Act Omnibus 2026: New Deadlines Explained →.

Editorial, not legal advice.