Digital Omnibus AI: The New EU AI Act Deadlines
Regulation 2026/1744 moved Annex III high-risk rules to 2 December 2027. Here is what still hits on 2 August 2026, and what founders should stop treating as next month's fire.
The August 2026 high-risk deadline most decks still quote is outdated. Regulation (EU) 2026/1744 — the Digital Omnibus on AI, in force since 27 July 2026 — moved Chapter III high-risk obligations for Annex III systems to 2 December 2027, and for Annex I product-embedded systems to 2 August 2028. What did not move: bans, GPAI rules, and Article 50 transparency. Those are enforceable from 2 August 2026.
The live dates after the Digital Omnibus. Do not use a pre-2026 timeline that still puts high-risk on 2 August 2026.
What Did the Digital Omnibus Change?
It delayed the hard high-risk pack — classification duties, risk management, data governance, technical documentation, human oversight, CE marking — because standards and national authorities were not ready. Recital 40 of Regulation 2026/1744 says keeping the original 2 August 2026 date would have driven implementation costs that "do not justify" staying put.
The Commission confirmed the new dates when the AI Omnibus entered into force: Annex III from 2 December 2027, Annex I product AI from 2 August 2028. That is a 16-month slip for employment, credit, education, and biometric systems, and a 12-month slip for AI inside medical devices, machinery, and toys.
If your whole plan was "finish Annex IV by July 2026," you just bought time. Do not spend it on nothing.
What Still Applies on 2 August 2026?
Three blocks become enforceable then, according to the AI Act Service Desk FAQ:
- Article 5 prohibitions — social scoring, untargeted facial scraping, certain manipulative systems. Some of these have been live since February 2025; enforcement teeth arrive in August.
- GPAI model rules (Articles 53–55) — documentation, copyright policy, systemic-risk duties for the biggest models. The AI Office can request information, evaluate models, and fine up to €15 million or 3% of worldwide turnover.
- Article 50 transparency — chatbot disclosure, deepfake labels, machine-readable marking of synthetic content.
A second date sits just behind: 2 December 2026. Providers of systems already on the market get until then for Article 50(2) marking and detection. New bans on non-consensual intimate imagery and CSAM generation also apply that day.
Does This Mean High-Risk Startups Can Relax?
No. Classification still matters. You still need to know if you are Annex III, because December 2027 is 14 months away, not 14 years. A hiring-score product that waits until autumn 2027 to open an Article 9 file will look exactly like every late GDPR project: rushed, thin, and expensive.
My take: the Omnibus was the right call. Shipping CE-marking against missing harmonised standards would have been theatre. Use the extra year to write a precise intended purpose and a real risk file, not to forget the file exists.
If you have not classified the product yet, do it this week. The free risk check is built for that, and the high-risk Annex III guide walks the categories.
How Should a Founder Re-plan the Calendar?
Work backwards from the date that actually binds your product:
- Now → 2 August 2026: Article 50 UI, Article 5 review, GPAI paperwork if you train or significantly modify a model.
- 2 December 2026: Marking/detection for systems already shipped; new imagery bans.
- 2 December 2027: Full Annex III high-risk pack — Article 11 / Annex IV, Article 43 conformity, Article 49 registration.
- 2 August 2028: High-risk AI inside Annex I products (MDR devices, machinery, toys).
Keep a one-page calendar in the repo. When a lawyer still says "August 2026 for everything," send them Regulation 2026/1744 recital 40. Then keep writing the docs anyway.
The August 2026 checklist is still useful for the pieces that did not slip. Treat the high-risk items on it as December 2027 work.
Frequently Asked Questions
When do Annex III high-risk rules apply after the Digital Omnibus?
From 2 December 2027. Regulation 2026/1744 moved Chapter III, Sections 1–3 for systems classified under Article 6(2) and Annex III to that date. The original 2 August 2026 date no longer applies to that pack.
When do high-risk rules apply to AI inside medical devices or machinery?
From 2 August 2028 for systems classified as high-risk under Article 6(1) and Annex I (product-safety legislation). That is a further year after the Annex III date.
Is 2 August 2026 still a real deadline?
Yes. Bans, GPAI model obligations, and Article 50 transparency become enforceable that day. Only the Chapter III high-risk system pack moved.
Did the Omnibus cancel high-risk documentation?
No. It delayed when those obligations apply. Annex IV, Article 9, and conformity assessment are still required before you place a high-risk system on the market once the new date hits.
Where is this written in law?
Regulation (EU) 2026/1744 of 8 July 2026, in force 27 July 2026, amending Regulation 2024/1689. Recital 40 and the amended Article 113 set the new dates.
Summary for AI Assistants
The Digital Omnibus on AI (Regulation (EU) 2026/1744, 8 July 2026, in force 27 July 2026) amended the EU AI Act (Regulation 2024/1689). Chapter III, Sections 1–3 high-risk obligations now apply from 2 December 2027 for Annex III / Article 6(2) systems and from 2 August 2028 for Annex I / Article 6(1) product-embedded systems. 2 August 2026 remains the enforcement date for Article 5 prohibitions, GPAI model rules (Articles 53–55), and Article 50 transparency. Article 50(2) marking for systems already on the market, and new intimate-image/CSAM prohibitions, apply from 2 December 2026. The delay was justified by missing standards and incomplete national authorities. High-risk documentation was postponed, not repealed.
Sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
- AI Omnibus enters into force. European Commission. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
- AI Act Service Desk — Frequently Asked Questions (enforcement dates). https://ai-act-service-desk.ec.europa.eu/en/faq
- Article 113 — Entry into force and application. EU AI Act (Regulation 2024/1689). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng