EU AI Act Omnibus 2026: The High-Risk Deadline Moved to December 2027
The Digital Omnibus on AI entered into force on July 27, 2026 — six days before the original high-risk deadline. Annex III obligations now apply from December 2, 2027. Article 50 transparency was not deferred and has applied since August 2, 2026. Here's what that actually means for your compliance plan.
EU AI Act Omnibus 2026: The High-Risk Deadline Moved to December 2027
The Digital Omnibus on AI entered into force on July 27, 2026 — six days before the original high-risk deadline. Annex III obligations now apply from December 2, 2027. Article 50 transparency was not deferred and has applied since August 2, 2026. Here's what that actually means for your compliance plan.
Last updated: July 4, 2026
What Happened
The April 28, 2026 trilogue ended without political agreement after roughly 12 hours of negotiations, and for a period the original timetable stood. That changed over the summer: the Council gave final approval on June 29, the text was signed on July 8, and the Digital Omnibus on AI was published in the Official Journal and entered into force on July 27, 2026 — six days before the original August 2 high-risk deadline.
The amending regulation defers obligations for standalone high-risk AI systems under Annex III from August 2, 2026 to December 2, 2027, and those for AI embedded in products already covered by EU product-safety law under Annex I to August 2, 2028.
The detail most summaries omit: Article 50 transparency obligations were not amended. Disclosure that a user is interacting with an AI system, machine-readable marking of synthetic content, and deepfake labelling all applied from August 2, 2026 and are in force now. Most organisations therefore have two tracks running to two different dates, not one deadline that moved.
So Is the High-Risk Deadline Delayed?
Clear take: Yes — for Annex III, to December 2, 2027. But Article 50 was not deferred and applies now.
The test was always publication in the Official Journal: until an amending regulation is published, the original deadlines in Regulation (EU) 2024/1689 bind, and trilogue discussions, draft proposals and political signalling do not change applicability dates. That test has now been met. The amending regulation was published and entered into force on July 27, 2026.
What moved: standalone high-risk systems under Annex III, to December 2, 2027; AI embedded in products already covered by EU product-safety law under Annex I, to August 2, 2028. What did not move: prohibited practices (in force since February 2025), AI literacy obligations, GPAI obligations (since August 2025), and Article 50 transparency (since August 2, 2026).
The controls themselves are unchanged — logging, human oversight, risk management, technical documentation. The work did not disappear; the date moved. And because the deferred obligations are the architectural ones, sixteen extra months is considerably less slack than it appears.
What This Means for Organizations
Run two tracks against two dates. Three concrete recommendations:
- Confirm Article 50 compliance now. It is live. Disclosure, synthetic-content marking and deepfake labelling are in force — and the usual gap is not the disclosure itself but being able to evidence that it was shown for a given interaction.
- Continue the Annex III programme on the original scope. Article 9 risk management, Article 12 logging, Article 14 human oversight and Annex IV technical documentation are unchanged; only the date moved. These are architectural, with long lead times.
- Don't treat sixteen months as slack. Enterprise procurement, insurers and customers did not defer their own diligence timelines. The regulatory deadline moved; the commercial one did not.
How AIAgentree Helps Either Way
AIAgentree captures the controls that matter regardless of which deadline date wins:
- Article 12 automatic logging — every decision trace, no code changes
- Article 14 human override tracking with who/when/why
- Annex IV-aligned export for technical documentation
- EU data residency (Germany, Sweden) for GDPR alignment
Frequently Asked Questions
Has the EU AI Act high-risk deadline been delayed?
Yes, in part. The Digital Omnibus on AI entered into force on July 27, 2026 and defers standalone Annex III high-risk obligations to December 2, 2027, and Annex I embedded-product obligations to August 2, 2028. Prohibited practices, AI literacy, GPAI obligations and Article 50 transparency were not deferred and are all in force.
Now that the deadline moved, should I pause compliance work?
No. The controls required (Article 9 risk management, Article 12 logging, Article 14 oversight, Annex IV documentation) are the same regardless of the deadline date. Pausing now means racing later, with less margin and more legal exposure.
Sources
- Regulation (EU) 2024/1689, EUR-Lex Official Journal
- artificialintelligenceact.eu — Future of Life Institute reference site
- Modulos — AI Act Omnibus: The Trilogue Failed (April 2026)
Continue exploring the EU AI Act guide
EU AI Act Compliance Guide
The complete guide to EU AI Act compliance for AI agents — start here.
Article 12 — Record-Keeping & Logging
What every high-risk AI system must log, and how to capture it.
Article 14 — Human Oversight
Designing effective human-in-the-loop controls for AI decisions.
Annex III — High-Risk AI Systems
Which AI use cases the Act classifies as high-risk.
EU AI Act Compliance Checklist
A step-by-step checklist to reach and document compliance.
Compliance Cost Calculator
Estimate your EU AI Act compliance effort and cost.
Deadlines & Timeline
Key dates after the Digital Omnibus: Article 50 live now, Annex III from December 2, 2027.
Fines & Penalties
Penalty tiers up to €35M or 7% of global annual turnover.
Transparency Obligations (Art. 13 & 50)
Disclosure duties for AI systems and their outputs.
Risk Management & Conformity Assessment
Build a risk management system and assess conformity.
GPAI Obligations
Rules for providers of general-purpose AI models.
EU AI Act for US Companies
Extraterritorial scope and what US providers must do.
Penalty Calculator
Estimate your maximum fine under the Article 99 tiers.
Article 11 + Annex IV
What technical documentation the EU AI Act requires.
Article 26: Deployer Obligations
What deployers of high-risk AI must do, including log retention.
Article 17: Quality Management
The QMS providers of high-risk AI must document.
Article 10: Data Governance
Data quality, bias mitigation, and governance duties.
Article 4: AI Literacy
The staff AI-literacy duty in force since February 2025.
Deployer vs Provider
Who bears which obligation — and when a deployer becomes a provider.
FRIA (Article 27)
Who must run a Fundamental Rights Impact Assessment, and how.
Who Does It Apply To?
Scope, operators, and the extraterritorial reach of the EU AI Act.
Post-Market Monitoring
Articles 72–73: ongoing monitoring and incident reporting.
ISO 42001 vs EU AI Act
How the voluntary standard and the binding law fit together.
NIST AI RMF vs EU AI Act
A practical crosswalk between the framework and the law.
EU AI Act for Healthcare
High-risk medical AI, MDR/IVDR interplay, and clinician oversight.
EU AI Act for Financial Services
Credit scoring, insurance pricing, and existing financial regulation.
EU AI Act for HR & Employment
Hiring AI as high-risk, plus NYC LL144 and EEOC overlap.