EU Digital Omnibus on AI Defers High-Risk AI Act Obligations to 2027 and 2028
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on July 27, 2026, three days after publication in the Official Journal. First proposed by the European Commission on November 19, 2025, it amends the AI Act to defer high-risk system obligations: standalone Annex III systems must now comply by December 2, 2027, and AI embedded in Annex I regulated products by August 2, 2028. Other obligations still apply from August 2, 2026 as originally scheduled, including Article 50 transparency duties, with a limited transition to December 2, 2026 for generative AI systems already on the market.
Key Analytics
Impact Analysis
Organizations racing toward the original August 2, 2026 high-risk deadline now have 16 to 24 additional months, but the reprieve is targeted, not general: prohibited practices, GPAI obligations, and Article 50 transparency requirements remain enforceable on the original timeline. The omnibus also adds new Article 5 prohibitions on AI systems that generate non-consensual intimate imagery or child sexual abuse material, expands the Commission AI Office's supervisory powers over general-purpose AI, and gives SMEs and small mid-caps simplified technical documentation and quality management pathways. Treat the deferral as time to mature conformity assessment readiness, not as a reason to pause AI governance programs.
Recommended Actions
- Re-baseline your EU AI Act compliance roadmap against the new dates: December 2, 2027 for standalone Annex III high-risk systems and August 2, 2028 for AI embedded in Annex I regulated products.
- Confirm which obligations still took effect on August 2, 2026, including Article 50 transparency and content marking duties, and verify whether the December 2, 2026 transition for generative systems already on the market applies to you.
- Screen your AI portfolio against the new Article 5 prohibitions on generating non-consensual intimate imagery and child sexual abuse material, which sit in the Act's highest penalty tier.
- If you qualify as an SME or small mid-cap enterprise, evaluate the simplified technical documentation and quality management options to reduce compliance cost.
- Use the deferral window to complete gap assessments and pilot conformity assessment procedures for high-risk systems rather than deprioritizing readiness work.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Roadmap re-baseline to December 2027 and August 2028
- ›Screening against the new prohibitions on non-consensual intimate imagery and CSAM
- ›Article 50 obligation confirmation including the December 2026 transition
- ›SME and small mid-cap simplified documentation evaluation
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 65 to 145 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.