EU AI Act After the Digital Omnibus: Which Deadlines Moved to 2027

The European Union’s Artificial Intelligence Act (EU AI Act) establishes rules for developing, deploying, and using AI systems while protecting fundamental rights, safety, and privacy. However, meeting these requirements can be challenging for organizations that rely on AI, especially when they must implement risk-management controls, maintain technical documentation, and demonstrate compliance.

To address implementation challenges, the EU introduced the Digital Omnibus on AI, which amended parts of the original AI Act and extended certain compliance timelines. The regulation entered into force on July 27, 2026, establishing revised deadlines for high-risk AI systems and other specific obligations.

These changes give businesses additional time to prepare for certain requirements. However, they do not postpone every AI Act obligation. Organizations must understand which deadlines changed, which requirements already apply, and how to use the additional time to strengthen their AI governance and compliance programs.

What is the Digital Omnibus on AI?

The Digital Omnibus on AI is an EU legislative measure that simplifies implementing the AI Act and reduces unnecessary administrative burdens. It addresses practical challenges, including delays in developing technical standards, establishing national regulatory arrangements, and preparing the support mechanisms organizations need to demonstrate compliance.

The measure aims to make AI regulation more practical without abandoning the EU’s commitment to safety, accountability, and fundamental rights. It also introduces targeted changes to AI governance, transparency, and regulatory oversight.

For businesses, the most important change is the introduction of fixed application dates for certain high-risk AI requirements. Rather than treating August 2026 as the deadline for all high-risk AI systems, organizations must now distinguish between systems used in specific high-risk areas and AI systems incorporated into regulated products.

Which EU AI Act Deadlines Moved to 2027 and Beyond?

The Digital Omnibus changes several important dates. The most significant extensions concern high-risk AI systems, while some other obligations remain scheduled for 2026.

1. High-Risk AI Systems Under Annex III — December 2, 2027

The relevant requirements for high-risk AI systems classified under Annex III will apply from December 2, 2027. These systems include certain AI applications used in employment, education, biometrics, and critical infrastructure. Organizations should use the additional time to assess risks, strengthen human oversight, and prepare technical documentation.

2. High-Risk AI Systems Under Annex I — August 2, 2028

The relevant requirements for high-risk AI systems covered by Annex I will apply from August 2, 2028. This category includes qualifying AI systems associated with specified EU product-safety legislation, such as certain machinery and toys. Manufacturers and providers should align AI compliance activities with their existing product safety and conformity assessment processes.

3. National AI Regulatory Sandboxes — December 2, 2027

EU Member States must meet the revised December 2, 2027 deadline to establish national AI regulatory sandboxes. These supervised environments let organizations test innovative AI systems and assess regulatory requirements under applicable conditions.

4. Transparency for Certain AI Systems Already on the Market — December 2, 2026

Not all deadlines have moved to 2027. Certain providers of AI systems that generate synthetic audio, images, video, or text and were placed on the market before August 2, 2026, must take the necessary steps to comply with Article 50(2) by December 2, 2026. This requirement concerns machine-readable marking of AI-generated or manipulated content, subject to applicable conditions and exceptions.

Organizations should review the relevant provisions and carefully classify their AI systems to determine which deadlines apply.

Which EU AI Act Requirements Still Apply in 2026?

The Digital Omnibus does not suspend the entire AI Act. Several obligations have already taken effect, while others continue to apply under their existing schedules.

The following milestones remain important:

• February 2, 2025: General provisions, including AI literacy requirements, and prohibitions on specified unacceptable-risk AI practices began to apply.
• August 2, 2025: Obligations for general-purpose AI models and the EU’s AI governance arrangements began to apply.
• August 2, 2026: The main body of the AI Act’s rules, including applicable transparency requirements and enforcement provisions, began to apply.
• December 2, 2026: New prohibitions concerning AI systems that generate non-consensual intimate or sexual content and child sexual abuse material begin to apply, alongside the relevant transitional transparency deadline.

These milestones form part of the revised implementation timeline published by the European Commission.

How Should Businesses Prepare for the Revised Deadlines?

Organizations should use the additional time to build a practical compliance program rather than delay their preparations. The following steps can help.

• Identify AI Systems and Their Risk Categories

Create an inventory of AI systems the organization has developed, purchased, or deployed. Classify each system according to its intended purpose, operational context, and applicable AI Act provisions.

Pay particular attention to systems that may fall under Annex III or Annex I.

• Conduct AI Risk Assessments

Evaluate how AI systems could affect safety, fundamental rights, privacy, and business operations. Document identified risks, mitigation measures, and the individuals responsible for managing them.

Review assessments whenever a system’s purpose, data, or operating environment changes significantly.

• Strengthen Data Governance

Review data quality, relevance, representativeness, access controls, and data protection practices. Establish processes to identify and address bias where applicable.

Organizations should also maintain records of their data management decisions and risk-mitigation activities.

• Establish Human Oversight

Determine where human supervision is necessary and ensure that responsible personnel understand their roles. Design procedures that allow authorized individuals to monitor system performance, identify problems, and intervene when necessary.

• Prepare Technical Documentation

Maintain documentation covering system design, intended use, risk assessments, testing, performance, and applicable conformity requirements.

Organizations should also establish procedures to monitor AI systems after deployment and respond to incidents or significant changes.

• Track Regulatory Updates

Monitor official EU guidance, applicable harmonized standards, common specifications, and national implementation measures. Assign responsibility for tracking changes and updating internal compliance plans.

The revised deadlines do not eliminate the need to monitor regulatory developments or prepare evidence of compliance.

What Do the Revised Deadlines Mean for AI Governance and Compliance Professionals?

The revised timeline gives AI governance, risk, and compliance professionals additional time to prepare for certain requirements. However, it also makes accurate classification and deadline management more important.

Professionals should understand the distinction between AI providers and deployers, identify the requirements applicable to each system, and coordinate legal, technical, security, privacy, and business teams.

Organizations should also integrate AI compliance into existing governance, risk management, and internal audit processes. This approach can help them identify gaps early, assign accountability, and maintain evidence that supports regulatory assessments.

For professionals building expertise in this area, knowledge of the EU AI Act, AI risk management, responsible AI, and frameworks such as the NIST AI Risk Management Framework can support more effective compliance planning.

Conclusion

The Digital Omnibus extends key EU AI Act deadlines to 2027 and 2028, giving organizations more time to prepare for compliance. Businesses should use this time to strengthen AI governance, risk management, and documentation practices. Staying up to date on regulatory changes can help organizations manage compliance risks and promote responsible AI adoption.

InfosecTrain offers a Data Protection Officer (DPO) training course to help professionals develop expertise in data protection regulations, privacy management, and compliance requirements.

TRAINING CALENDAR of Upcoming Batches For DPO Training