--- title: "EU AI Act Timeline After the Digital Omnibus: What Actually Moved and What Didn't | Human x AI Content Hub" description: "EU AI Act high-risk obligations now apply 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products after the Digital Omnibus delay." url: "https://humanxai.events/eu-ai-act-timeline-after-the-digital-omnibus-what-actually-moved-and-what-didnt" --- 1. [Content Hub](https://humanxai.events/content-hub) 2. [Build](https://humanxai.events/content-hub/build) 3. EU AI Act Timeline After the Digital Omnibus: What Actually Moved and What Didn't [Build](https://humanxai.events/content-hub/build) 4 Nov 2026 · 7 min read # EU AI Act Timeline After the Digital Omnibus: What Actually Moved and What Didn't The high-risk deadline shifted sixteen months. The underlying obligations didn't change by a single paragraph. Here's why treating this as a reason to slow down is a trap. By **The Operator** ![EU AI Act Timeline After the Digital Omnibus: What Actually Moved and What Didn't](https://storage.googleapis.com/visibilio-cms-bucket/images/humanxai/20261104_083641_cover_image.png) ## The High-Risk Deadline Shifted Sixteen Months. The Underlying Obligations Didn't Change by a Single Paragraph. On 27 July 2026, five days before the original compliance date, [Regulation (EU) 2026/1744](https://beesensible.eu/resources/blog/ai-act-timeline-digital-omnibus/) entered into force. The **Digital Omnibus on AI** pushed the Annex III high-risk obligations from 2 August 2026 to **2 December 2027**. For AI embedded in regulated products under Annex I, the deadline moved to **2 August 2028**. Teams that had been sprinting toward August suddenly found themselves with an extra year and a half. Here's the trap: treating this as a reason to slow down. ### Why the Delay Happened The official explanation is straightforward. [European standardisation bodies failed to deliver](https://www.morganlewis.com/pubs/2026/06/eu-approves-delays-and-other-amendments-to-certain-eu-ai-act-obligations-what-businesses-should-know) the harmonised technical standards that providers needed to operationalise compliance. Without those standards, organisations faced a compliance target they couldn't actually hit because the specifications hadn't been written yet. The Commission tabled the proposal on 19 November 2025. After a failed trilogue on 28 April 2026, negotiators returned and [reached provisional agreement on 6 May](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/). The European Parliament voted in favour on 16 June. The Council gave final approval on 29 June. The text was signed on 8 July, published in the Official Journal on 24 July, and entered into force on 27 July. That's a legislative sprint by Brussels standards. It also means the delay was a last-minute rescue operation, not a planned adjustment. ### The New Timeline Here's what the schedule looks like now, according to [the AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act): #### Already in Force - 1 August 2024: AI Act entered into force - 2 February 2025: Prohibitions and AI literacy requirements apply - 2 August 2025: GPAI (General-Purpose AI) model obligations and governance structures apply #### 2 August 2026 (This Already Happened) - Article 50 transparency obligations apply - Enforcement begins for GPAI models, prohibitions, transparency rules, and AI literacy - Innovation support measures take effect #### 2 December 2026 - New prohibitions on AI systems generating non-consensual sexual deepfakes and child sexual abuse material - Watermarking grace period ends for generative systems placed on the market before 2 August 2026 #### 2 August 2027 - Member States must have at least one AI regulatory sandbox operational - Legacy GPAI models placed on market before 2 August 2025 must be compliant #### 2 December 2027 - High-risk AI system obligations for Annex III systems apply (recruitment, credit scoring, education, law enforcement, border control, critical infrastructure) - Fundamental Rights Impact Assessment (FRIA) requirements apply #### 2 August 2028 - High-risk AI embedded in regulated products under Annex I applies (medical devices, machinery, toys, radio equipment) ### What Didn't Move The Omnibus delayed the heavy machinery. It left everything else on schedule. [Article 50 transparency obligations became enforceable on 2 August 2026](https://www.holisticai.com/blog/eu-ai-acts-deadline-moved-2027), exactly as planned. That means four distinct duties are now live: **Article 50(1):** If a system interacts with people, they must be told they're dealing with AI. Not buried in terms and conditions. At the point of interaction. **Article 50(2):** AI-generated or manipulated content must carry machine-readable markers. In practice, this points toward **C2PA Content Credentials** or equivalent watermarking. **Article 50(3):** Deepfake disclosure requirements for audio and visual content. **Article 50(4):** Emotion recognition and biometric categorisation systems must inform subjects. The watermarking requirement for systems already on the market before 2 August 2026 got a four-month grace period to 2 December 2026. Everything else in Article 50 is enforceable now. GPAI enforcement also went live on schedule. The **AI Office** inside the European Commission and national market surveillance authorities across all 27 member states can investigate and fine. ### The Reach Problem Here's what catches teams off guard: the AI Act's jurisdictional scope. Like GDPR, the regulation reaches past EU borders. The duties attach to the AI system and its users, not to where headquarters sits. A US company serving EU customers faces the same transparency obligations as a Berlin startup. A Gulf-based deployer using AI in recruitment decisions affecting EU residents is in scope. The delay to 2027 only helps if the systems in question are high-risk under Annex III or Annex I. Transparency obligations, GPAI rules, and prohibitions apply regardless of where the provider is incorporated. ### What the Extra Time Is Actually For [CSA research from March 2026](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-omnibus-vii-deadline-delay-20260/) found governance gaps were still wide across most organisations preparing for compliance. The delay doesn't change the substance of what's required. It changes when the enforcement clock starts. The underlying obligations remain identical: - Risk management systems under Article 9 - Data governance requirements - Technical documentation under Annex IV - Human oversight mechanisms - Logging and traceability - Quality management systems - Post-market monitoring - Conformity assessments Penalties haven't changed either: up to **€15 million or 3% of global annual turnover** under Article 99. The standards bodies whose delays triggered this postponement are expected to finalise harmonised standards through late 2026 and into 2027. That means the compliance window isn't sixteen months of breathing room. It's sixteen months to implement against standards that are still being written, with the expectation that final versions will land in the middle of the implementation period. ### What to Do With the Time Three questions every team should answer before December 2027: #### 1. Which Systems Are Actually High-Risk? The [Article 6 guidelines](https://euai.app/timeline) were published in draft on 19 May 2026. Use them. The classification determines whether the 2027 deadline applies at all. Misclassification in either direction creates problems: over-compliance wastes resources, under-compliance creates enforcement exposure. #### 2. What Does the Conformity Assessment Path Look Like? Some Annex III systems require third-party conformity assessment. Others allow self-assessment. The path determines the timeline. Third-party assessment requires notified body capacity, and notified body capacity is finite. #### 3. Where Are the Governance Gaps? Risk management, technical documentation, human oversight, post-market monitoring. These aren't checkbox exercises. They require operational changes, role definitions, and process documentation. Sixteen months sounds generous until the work is scoped. ### The Sandbox Requirement [By 2 August 2027](https://artificialintelligenceact.eu/implementation-timeline/), every Member State must have at least one AI regulatory sandbox operational. These sandboxes are meant to provide controlled environments for testing AI systems before market deployment, with regulatory guidance built into the process. For teams developing novel high-risk applications, the sandbox pathway may offer a clearer route to compliance than attempting to interpret standards in isolation. The catch: sandbox capacity will be limited, and demand will likely exceed supply in the first year. ### The Practical Takeaway The Digital Omnibus bought time. It didn't buy simplicity. Organisations that treat December 2027 as a distant deadline will find themselves in the same position they were in during summer 2026: sprinting toward a compliance date with incomplete standards and insufficient preparation time. The teams that use this window well will have three things in place by mid-2027: a defensible system classification, a conformity assessment pathway, and operational governance that doesn't depend on last-minute heroics. The model is the easy part. The compliance infrastructure is where projects die. For teams tracking the evolving regulatory landscape, this is one thread in a larger conversation about how AI governance actually gets implemented. The [Content Hub](https://humanxai.events/content-hub) covers the operational side of these questions across policy, deployment, and practice. ## Frequently Asked Questions **Q: When do EU AI Act high-risk obligations now apply?** A: Stand-alone high-risk systems under Annex III must comply by 2 December 2027. High-risk AI embedded in regulated products under Annex I must comply by 2 August 2028. Both dates were extended by the Digital Omnibus on AI. **Q: What EU AI Act obligations are already enforceable?** A: Article 50 transparency obligations, GPAI model requirements, AI literacy obligations, and all prohibited practices have been enforceable since 2 August 2026. The delay only affected high-risk system obligations. **Q: Does the EU AI Act apply to companies outside the EU?** A: Yes. Like GDPR, the regulation applies based on where the AI system is used and who it affects, not where the provider is headquartered. Non-EU companies serving EU customers or affecting EU residents are in scope. **Q: What are the penalties for non-compliance with the EU AI Act?** A: Penalties can reach €15 million or 3% of global annual turnover under Article 99, whichever is higher. Different violation categories carry different penalty thresholds. **Q: What is the Article 50 watermarking requirement?** A: AI-generated or manipulated text, images, audio, and video must carry machine-readable markers identifying them as synthetic content. Systems already on the market before 2 August 2026 had until 2 December 2026 to comply. **Q: When must EU Member States have AI regulatory sandboxes operational?** A: By 2 August 2027, each Member State must have at least one AI regulatory sandbox operational. These provide controlled testing environments with built-in regulatory guidance for AI system development. Keep the conversation going [Back to the Content Hub](https://humanxai.events/content-hub) ## Format - [Build](https://humanxai.events/content-hub/build) ## Tags - [EU AI Act](https://humanxai.events/content-hub?tag=eu%20ai%20act) - [Digital Omnibus](https://humanxai.events/content-hub?tag=digital%20omnibus) - [High Risk Obligations](https://humanxai.events/content-hub?tag=high-risk%20obligations) - [Compliance Deadline](https://humanxai.events/content-hub?tag=compliance%20deadline) - [Regulatory Timeline](https://humanxai.events/content-hub?tag=regulatory%20timeline) - [AI Governance](https://humanxai.events/content-hub?tag=ai%20governance) - [Harmonised Standards](https://humanxai.events/content-hub?tag=harmonised%20standards) - [Fundamental Rights](https://humanxai.events/content-hub?tag=fundamental%20rights) - [AI Literacy](https://humanxai.events/content-hub?tag=ai%20literacy) ## Follow - [Daily Brief newsletter](https://humanxai.events/eu-ai-act-timeline-after-the-digital-omnibus-what-actually-moved-and-what-didnt#newsletter) - [RSS feed](https://humanxai.events/content-hub/feed.xml) More perspectives ## Related reading [All articles](https://humanxai.events/content-hub) - Build 28 Oct 2026 6 min read ### [Voxtral 3: What Mistral's Voice Agent Stack Actually Means for European Deployment Teams](https://humanxai.events/voxtral-3-what-mistrals-voice-agent-stack-actually-means-for-european-deployment) - Build 21 Oct 2026 7 min read ### [Article 17 Checklist: Building a Quality Management System That Survives Audit Day](https://humanxai.events/article-17-checklist-building-a-quality-management-system-that-survives-audit-da) - Build 14 Oct 2026 7 min read ### [The EU AI Act in Plain English: What Actually Ships and When](https://humanxai.events/the-eu-ai-act-in-plain-english-what-actually-ships-and-when) Daily Brief ## Follow the Content Hub New analysis, interviews and briefings by email. Or subscribe to the [RSS feed](https://humanxai.events/content-hub/feed.xml).