If you build or buy anything with AI in it for EU customers, 2026 has been confusing. Headlines said the AI Act was "delayed", yet 2 August 2026 still arrived with real obligations. Both are true. This guide separates what moved from what did not.
What the Digital Omnibus on AI changed
In November 2025 the European Commission proposed a package of targeted amendments, called the Digital Omnibus on AI, because the technical standards needed for compliance were not ready. The European Parliament endorsed the final text on 16 June 2026 by 423 votes to 57, and the Council gave final approval on 29 June 2026.
It does not rewrite the Act's structure. It moves some dates, trims overlap with other product laws, and adds relief for smaller companies, including a new "small mid-cap" category.
The calendar in one table
| What | Date | Status |
|---|---|---|
| Prohibited practices and AI literacy provision | 2 February 2025 | Already applies |
| Obligations for providers of general-purpose AI models | 2 August 2025 | Already applies |
| Most transparency duties, including those for deployers | 2 August 2026 | Applies now |
| Machine-readable marking of AI output by providers (Article 50(2)) | 2 December 2026 | Delayed from August |
| New ban on "nudifier" and child-abuse-material AI tools | Reported as 2 December 2026 | Added by the Omnibus; confirm date in the final text |
| High-risk systems listed in Annex III (hiring, credit, education, and similar) | 2 December 2027 | Delayed from 2 August 2026 |
| High-risk AI inside regulated products (Annex I) | 2 August 2028 | Delayed from 2 August 2027 |
The machinery regulation was also taken out of the high-risk product category entirely, according to law-firm summaries of the deal.
What this means if you are not building high-risk AI
Most small teams are not in Annex III. For you the relevant parts are the ones that did not move.
1. Transparency. If your product has a chatbot, people must be told they are talking to an AI unless it is obvious. If you publish realistic synthetic images, audio, or video (deepfakes), disclosure rules apply to deployers. Text generated by AI and published to inform the public on matters of public interest needs a label unless a human has reviewed and taken editorial responsibility.
2. Marking AI output (providers). If you provide a system that generates synthetic content, the duty to mark output in a machine-readable way now starts on 2 December 2026, a few months later than the original August date.
3. Prohibited practices. Manipulative techniques, social scoring, untargeted scraping of faces, and similar practices have been banned since 2025. The Omnibus adds a ban on tools designed to generate non-consensual intimate imagery and child abuse material.
4. AI literacy. The Act asks organisations to make sure people who operate AI have enough understanding of it. A short internal guide and one training session is a reasonable first step. Watch for guidance on how this is enforced, because the Omnibus process touched this area.
5. General-purpose models. If you fine-tune or host a model and place it on the market under your own name, check whether you count as a provider of a general-purpose model. If you only call someone else's API, you are normally a deployer.
What "deferred" should not mean for your plans
Compliance teams were told that the delay is headroom, not relief. Three reasons to still start now:
- Annex III covers everyday business uses such as screening job applicants, scoring creditworthiness, and some education tools. Deployers of those need records, human oversight, and logs. Building that takes months.
- Customers write AI Act questions into procurement forms already. A NIS2 questionnaire was the same story.
- Software with AI in it may soon carry strict liability under the new Product Liability Directive, which applies to products placed on the market after 9 December 2026.
A short checklist for this quarter
- List your AI uses. Tools you build, tools you buy, and tools staff use on their own.
- Mark the ones that talk to people or generate media. Those carry transparency duties today.
- Check Annex III. If any use touches hiring, credit, education, or access to essential services, treat it as high-risk and plan for December 2027.
- Write a one-page AI use policy and tell staff.
- Keep a record of which model and version each feature uses. You will need it for questions from customers and regulators.
Sources
- Regulation (EU) 2024/1689 (AI Act) on EUR-Lex
- European Commission press release on the Digital Omnibus proposal
- Hogan Lovells summary of the May 2026 political agreement
Overview as of November 6, 2026. Dates come from public law-firm and institutional summaries; check the Official Journal text before relying on any single date. This is not legal advice.