The AI Act Omnibus Delay: Relief or a Trap for Small Teams?

The headline version of the 2026 Digital Omnibus on AI is simple. The EU pushed the high-risk rules back. Stand-alone high-risk systems now have until 2 December 2027. High-risk systems embedded in regulated products have until 2 August 2028. Both dates are later than the original 2 August 2026 date. This headline will cost some small teams a compliance scramble in eighteen months. They will read “delayed” as “cancelled” and stop preparing.

That is the trap. The delay is real. It is now in force as Regulation (EU) 2026/1744. It does not remove the obligations. It gives more time to build the same obligations properly, plus a few genuine simplifications. If you treat it as relief, you will start from zero in late 2027.

What actually happened, precisely

On 19 November 2025 the European Commission published a proposal to amend the AI Act as part of a wider Digital Omnibus package. Parliament and Council reached a trilogue agreement on 7 May 2026. Member States’ ambassadors (Coreper) approved it on 13 May 2026. Parliament’s IMCO and LIBE committees approved it on 2 June 2026. Parliament’s plenary adopted it on 16 June 2026 with 423 votes in favor, 57 against, and 174 abstentions.

This is not a proposal sitting in a drawer. It is law. The Council gave final approval on 29 June 2026. The text was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744. It entered into force three days later, on 27 July 2026.

What actually changed

The co-legislators agreed fixed deadlines, not the conditional “once standards are ready” mechanism the Commission originally floated:

• 2 December 2027 — stand-alone high-risk AI systems (the Annex III use cases: recruitment, worker management, credit scoring, and similar)
• 2 August 2028 — high-risk AI systems that are safety components of products already regulated under other EU law (Annex I)
• 2 December 2026 — extended transitional period for marking AI-generated content on generative AI systems already on the market before 2 August 2026 (previously due 2 August 2026)

Alongside the timeline shift, the agreed text also does the following. It replaces the mandatory AI-literacy obligation with a requirement for the Commission and Member States to promote literacy initiatives. It extends the SME simplified-documentation and penalty regime to small mid-caps. It removes the obligation to register systems a provider has judged not high-risk. It expands the scope for testing high-risk systems in real-world conditions through regulatory sandboxes. It adds a new prohibition on AI systems that generate non-consensual intimate content or CSAM.

The Commission’s own estimate states the amendments can save businesses up to €429.5 million per year in administrative costs. €68–204 million of that comes from the timeline change alone. That is a real number, but it is a saving on when you spend, not on whether you eventually comply.

Why “delayed” is not “removed”

Nothing in the agreed text removes the high-risk obligations themselves. Conformity assessment, technical documentation, the quality management system, human oversight, and post-market monitoring still apply to Annex III and Annex I high-risk systems. What moved is the date by which you must be ready.

Eighteen months can feel like a long time. But notice what must happen inside it. Harmonized standards must reach final form. Notified bodies need capacity to run conformity assessments at scale. Your own system must be built to a specification that does not yet fully exist in published, stable form. If you wait until late 2027 to start, you will wait until the assessment queue is already full.

Who supports the delay, and who is worried

The reaction split is informative. Industry groups broadly welcome the change. Connect Europe and GSMA called it “a positive first step.” Some groups, like CCIA Europe, wanted the fixed dates because certainty beats a conditional trigger. SME United took a narrower and more useful position for small teams. It argued that application dates must tie to harmonized standards and guidance actually being available, not just a calendar date.

On the other side, the European Data Protection Board and European Data Protection Supervisor issued a joint opinion. They oppose the removal of registration requirements and call for strict limits on the new bias-correction data provisions. Consumer group BEUC and several civil-society organizations went further. They warned the changes weaken protections built into the original Act. Both sides agree on one thing: the substance of the obligations has not disappeared, only their timing and some procedural detail.

What to do with the extra time

The delay is a genuine gift if you use it to build rather than to relax. Do the following.

Finish your classification now, not in 2027. Work out which of your systems are high-risk under Annex III while there is no deadline pressure distorting the judgment. The Annex III test takes an afternoon. Doing it under a looming deadline takes longer and produces worse decisions.

Track the harmonized standards as they publish. Do not wait for a single announcement that “compliance is now possible.” Standards will arrive in stages. Teams that start building against draft guidance early will not start from scratch when the final versions appear.

Use the sandbox provisions while sandboxes are quiet. Article 62 gives SMEs and start-ups priority access to national AI regulatory sandboxes. These sandboxes must be operational by 2 August 2027, a year later than originally set, after the Omnibus amended Article 57(1). Getting in early, before every other high-risk provider in the EU queues for the same conformity assessment capacity in 2027, gives you a genuine advantage.

Do not delay the parts that were never delayed. Article 5 prohibitions have applied since February 2025. GPAI model rules have applied since August 2025. Article 50 transparency duties apply from August 2026 regardless of the high-risk timeline. The Omnibus did not touch these.

The Digital Omnibus bought small teams real time. It did not buy permission to stop thinking about the Act until the new dates arrive. Treat 2027 and 2028 as the deadline for being audited. Treat the months between now and then as the only realistically calm window you will get to build toward it properly.

If you want to work out what the Omnibus changes mean for your specific systems, do that mapping before the calm window closes. Get in touch →

Related reading on The Science Talk

This piece pairs with ERC Reverses Resubmission Rule Changes After Community Feedback for a sense of how EU processes revise rules mid-stream. It also pairs with the EPRS’s own tracked timeline for the Act, AI Act Implementation Timeline (At a Glance), for the pre-Omnibus statutory baseline this piece updates.

Browse all Perspectives or get in touch →