The Digital Omnibus on the AI Act has been in force since 27 July 2026, published as Regulation (EU) 2026/1744. In many companies the news arrived as an all-clear: the obligations for high-risk systems, originally due from 2 August 2026, have been deferred. That reading is understandable and still dangerous. Part of the obligations has applied unchanged since early August, another part was softened but not removed, and the time gained is shorter than it looks on paper. Pausing now means facing the same tasks at the end of 2027 with less lead time.
What the Omnibus deferred
The central change concerns high-risk systems. For stand-alone systems under Annex III, such as AI in recruitment, creditworthiness assessment or access to essential services, the requirements now apply from 2 December 2027. For AI embedded in regulated products under Annex I, the deadline moves to 2 August 2028. The deadline by which member states must set up their AI regulatory sandboxes has also been moved to 2 August 2027.
The reason for the deferral was not that the requirements were considered excessive. The preconditions for meeting them were missing: harmonised standards were not available in time, and in several member states the competent authorities had not yet been designated. In substance, the obligations for high-risk systems have remained essentially the same. Risk management, data quality, technical documentation, human oversight and conformity assessment are coming, only later.
What has applied since 2 August
The transparency obligations under Article 50 entered into force unchanged. Anyone operating a system that people interact with must make clear that they are dealing with an AI. Synthetically generated content must be marked in a machine-readable way, deepfakes must be disclosed, and the use of emotion recognition and biometric categorisation must be communicated to the people concerned. Only the machine-readable marking has a transitional period until 2 December 2026, and only for systems already on the market before 2 August.
These obligations affect far more companies than the high-risk rules, because they attach to everyday applications: the assistant on the website, the chatbot in customer service, generated images and text in communications. Violations carry fines of up to 15 million euros or three percent of worldwide annual turnover. Added to this are the prohibitions under Article 5, which have applied since February 2025 and were extended by one further prohibition through the Omnibus, as well as the obligations for providers of general purpose AI, which have applied since August 2025.
The softer literacy duty is not a lesser one
Article 4 originally required providers and deployers to ensure a sufficient level of AI literacy among their staff. After the Omnibus, it is enough to take measures that support building that literacy. Legally this is a reduction, because what is owed is now the effort rather than a defined level. In practice less changes than the wording suggests.
The question of whether employees can handle the systems in use arises regardless of the AI Act. It arises in the event of damage, when it has to be established whether management met its duty of care, and it arises in every audit that asks about the effectiveness of controls. Organisations able to document which roles received which enablement are prepared for both situations. Treating the reduction as a reason to cut training budgets saves money at a point that will be hard to justify later.
What the time gained is enough for, and what it is not
Around fifteen months remain until December 2027. That sounds like breathing room but is tight once the work is counted backwards. First, it must be known which AI systems are in use, and in many organisations that overview still does not exist in full. Then comes the classification of each system, which often requires legal and business alignment. Only after that does the actual work on documentation, risk management and oversight processes begin, and for purchased systems it additionally depends on the cooperation of the vendors.
An additional effect shortens the time further. The harmonised standards on which conformity is meant to rest are expected to be complete only shortly before the deadline. Waiting for them before starting implementation means starting too late. A robust path looks different: complete the inventory and classification now, use the requirements of the legal text as the working basis and incorporate the standards as they appear. The deferral grants time for clean implementation, not for a later start.
Conclusion and recommendation
The Omnibus changed the timetable, not the direction. For the next ninety days we recommend three steps. First, check all productive applications with user contact or generated content against Article 50, because these obligations already apply and the transitional period for marking ends on 2 December 2026. Second, complete the inventory of all AI systems with risk classification and plan the implementation for high-risk systems backwards from December 2027. Third, document AI literacy measures by role, even though the law now demands less.
ECODYNAMICS supports boards and executive teams with exactly this assessment. As part of Strategy and Transformation we translate the regulatory deadlines into an implementation plan that connects to existing governance instead of building a parallel structure. In the C-Level & Executives AI Masterclass we give executives the understanding to take these decisions themselves. If it is still open at your organisation which of your systems fall under which deadline, get in touch.