| Myth | Reality |
|---|---|
| The 2026 Omnibus delayed the entire EU AI Act to 2027 and 2028. | Only the Annex III high-risk conformity assessment deadline moved, from August 2, 2026 to December 2, 2027. Annex I product-embedded safety components moved from August 2, 2027 to August 2, 2028. Everything else in the Act keeps its original schedule. |
| Nothing is enforceable right now, so teams can pause AI compliance work. | Article 5 prohibited-practice bans have been enforceable since February 2, 2025. Regulators can and do act on banned practices like manipulative dark-pattern AI and untargeted biometric scraping today. |
| Chatbot and deepfake labeling can wait until the high-risk deadline arrives. | Article 50 transparency duties become mandatory on August 2, 2026, on the original schedule. Any customer-facing generative AI tool must disclose that users are interacting with a machine by that date. |
| Watermarking generative AI output is part of the delayed package. | Machine-readable marking and watermarking obligations for synthetic content take effect December 2, 2026, a separate and much shorter runway than the high-risk deferral. |
What the 2026 Omnibus Actually Changed
In November 2025, the European Commission published a “Digital Omnibus on AI” proposal aimed at simplifying parts of the EU AI Act that industry and several member states argued were unworkable on their original timeline. The core problem was not political cold feet, it was a technical bottleneck: the European standardisation bodies responsible for drafting the harmonized technical standards that operationalize Annex III conformity assessments had fallen behind. Without those standards, software teams building high-risk systems had no concrete technical bar to build against, only the abstract legal text.
Negotiators from the Council, the European Parliament, and the Commission reached a provisional agreement on the Omnibus package in May 2026, and the European Parliament approved the simplification measures in mid-June 2026. The practical result for engineering and product organizations is a set of deferred deadlines for the highest-compliance-burden obligations, paired with a narrower definition of what counts as a regulated “safety component” in embedded AI features.
None of that changes the obligations that were already designed to move fast. This is the trap that catches software teams: headlines about a “delay” create a false sense that AI Act work can be shelved for another year and a half. In practice, three separate obligation tracks are still live or about to go live, and they apply to a much larger share of ordinary software products than the high-risk rules ever did.
| Obligation | Original Deadline | Current Deadline | Who It Affects |
|---|---|---|---|
| Article 5 prohibited practices (manipulative, exploitative, social scoring, untargeted biometric scraping) | February 2, 2025 | February 2, 2025 (unchanged, already active) | Every organization deploying AI in the EU market |
| Article 50 transparency duties (chatbot and deepfake disclosure) | August 2, 2026 | August 2, 2026 (unchanged) | Any customer-facing generative AI or synthetic media product |
| Watermarking and machine-readable marking of generative AI output | August 2, 2026 | December 2, 2026 | Providers of generative AI tools producing image, audio, video, or text output |
| Annex III standalone high-risk conformity assessment | August 2, 2026 | December 2, 2027 | Hiring, credit scoring, education, critical infrastructure, and law enforcement AI systems |
| Annex I product-embedded high-risk safety components | August 2, 2027 | August 2, 2028 | AI embedded in regulated products such as medical devices and industrial machinery |
| National regulatory sandbox availability | August 2, 2026 | August 2, 2027 | Member state regulators, indirectly affects vendors seeking sandbox access |
Formal adoption of the Omnibus text was expected before August 2026, but the new dates only bind once the amended regulation is published in the Official Journal of the European Union. Software teams should treat the delayed dates as the working plan while keeping an eye on the official publication, since amendment text can shift slightly between provisional agreement and final adoption.
The Three Obligations That Are Still Live Right Now
1. Article 5 Prohibited Practices (Active Since February 2025)
Article 5 bans a short list of AI practices outright, regardless of risk tier, and it has been enforceable since February 2, 2025. For software teams this is not abstract policy, it is a design constraint that should already be reflected in product requirements documents. The banned practices most relevant to commercial software include subliminal or manipulative techniques that materially distort a person’s behavior in a way that causes harm, exploitation of vulnerabilities related to age, disability, or socioeconomic situation, social scoring by public authorities, and untargeted scraping of facial images to build or expand recognition databases. Emotion inference in workplace and education settings is also restricted outside narrow safety or medical exceptions.
Because this obligation predates the Omnibus entirely, it is the one most likely to be forgotten precisely because it feels “old news.” Teams that shipped a feature in 2025 without a documented prohibited-practices review should close that gap now, not after an incident.
2. Article 50 Transparency Duties (Live August 2, 2026)
Article 50 requires that people be told when they are interacting with an AI system rather than a human, and that AI-generated or manipulated content (including deepfakes) be labeled as such. This obligation was never touched by the Omnibus negotiations. If your product includes a customer support chatbot, a voice assistant, an AI writing or image tool, or any synthetic media pipeline that reaches end users in the EU, the disclosure requirement is a near-term engineering and UX task, not a 2027 planning item.
3. Watermarking and Provenance (December 2, 2026)
Providers of generative AI systems must ensure outputs are marked in a machine-readable format that identifies them as artificially generated or manipulated. This deadline itself moved, but only by four months, from August 2026 to December 2, 2026, giving teams a modest grace period rather than the multi-year runway granted to high-risk systems. Engineering teams that generate images, audio, video, or synthetic text at scale should treat this as a Q4 2026 delivery milestone.
Compliance timeline at a glance
A horizontal timeline running from February 2025 through August 2028, with markers at February 2025 (prohibited practices, already active), August 2026 (Article 50 transparency), December 2026 (watermarking), December 2027 (Annex III high-risk conformity), and August 2028 (Annex I product-embedded systems). The near-term markers cluster tightly together while the high-risk markers stretch out, visually showing that the “delay” only applies to the far end of the timeline.
A Step-by-Step Checklist for Software Teams
Step 1: Inventory Every AI Feature and Where It Runs
You cannot classify what you have not counted. Build a single inventory covering every model, prompt-based feature, and third-party AI API your product calls, including features embedded by vendors you resell. Record whether the feature is customer-facing, what data it touches, and which EU member states its users are in. This inventory becomes the backbone for every later step, including the risk classification work described in a RAG architecture review if your product grounds generative answers in retrieved documents.
Step 2: Classify Each Feature Against the Risk Tiers
For each inventoried feature, determine whether it falls into a prohibited practice, a high-risk Annex III or Annex I category, a limited-risk transparency category under Article 50, or minimal risk. Do this classification in writing and store the rationale. Regulators and auditors will want to see the reasoning, not just the conclusion.
Step 3: Run a Prohibited-Practices Audit Immediately
Since Article 5 is already active, this is the most urgent step for anything not yet reviewed. Check dark-pattern design elements, targeting of vulnerable users, any workplace emotion-inference features, and biometric data collection practices. This audit should sit alongside your existing bias auditing tooling review rather than replace it, since fairness and prohibited-practice checks test for different failure modes.
Step 4: Implement Article 50 Disclosures Before August 2, 2026
Add clear, persistent disclosure language to every chatbot, voice interface, and synthetic media feature reaching EU users. Avoid burying the disclosure in a terms-of-service link; the obligation is about the user experience at the point of interaction, not legal boilerplate. This is also a natural point to review your broader AI transparency reporting practices so disclosure is consistent across product surfaces.
Step 5: Build the Watermarking Pipeline for December 2, 2026
If your product generates images, audio, video, or long-form text, plan the engineering work to embed machine-readable provenance metadata now. This overlaps heavily with the broader discipline of AI content provenance, and teams that have already invested in provenance tooling for other reasons will find this deadline far easier to hit.
Step 6: Use the Extended Runway for Annex III Systems Deliberately
If your organization runs hiring, credit scoring, education, or critical-infrastructure AI that falls under Annex III, the December 2027 deadline is real relief, but it is not a reason to stop work. Use the extra time to build a proper technical documentation package, a data governance process, and a human-oversight design, rather than scrambling in late 2027 once harmonized standards are finally published.
Step 7: Document Everything in an Audit-Ready Format
Every classification decision, disclosure implementation, and watermarking rollout should be logged with dates, owners, and evidence. This documentation discipline is the same one that underpins a mature agentic AI accountability program and will matter just as much when regulators start enforcing Annex III conformity in 2027.
Step 8: Reassess Quarterly as the Omnibus Text Finalizes
The Omnibus dates only become binding once published in the Official Journal. Assign someone to track official publication and any last-minute amendments, and rebuild your compliance calendar each quarter rather than treating this checklist as a one-time exercise.
| Role | Article 5 Audit | Article 50 Disclosures | Watermarking | Annex III Roadmap |
|---|---|---|---|---|
| Product manager | Consulted | Accountable | Consulted | Responsible |
| Engineering lead | Responsible | Responsible | Accountable | Responsible |
| Legal or compliance counsel | Accountable | Consulted | Consulted | Accountable |
| Data or ML lead | Consulted | Informed | Responsible | Responsible |
| Executive sponsor | Informed | Informed | Informed | Accountable |
Where This Fits With the Rest of Your Compliance Stack
The EU AI Act is a legal instrument, not a risk-management methodology. Software teams still need an internal process for actually managing AI risk day to day, which is why many organizations pair the Act with a voluntary framework such as NIST AI RMF and, increasingly, a certifiable standard such as ISO/IEC 42001. Comparing those two frameworks in detail, and getting the internal governance committee structure right so that someone actually owns the RACI responsibilities shown above, are both covered in the related reading links at the end of this article.
Teams should also not conflate this checklist with broader global divergence in AI law. The EU’s approach differs meaningfully from other jurisdictions, and if your product ships outside the EU as well, a comparison of global AI ethics standards is a useful next read before you assume one compliance program covers every market.
Common mistake
Treating the Omnibus delay as a blanket “AI Act paused” signal and quietly deprioritizing the entire compliance backlog, including the Article 50 disclosure work that is due in weeks, not years. Teams that make this mistake typically discover the gap only when a customer, journalist, or regulator points out an undisclosed chatbot after August 2026.
What worked
Splitting the compliance backlog into two explicit tracks at the planning stage: a “live obligations” track covering Article 5, Article 50, and watermarking with hard 2026 dates, and a “runway” track covering Annex III and Annex I work with a 2027 to 2028 horizon. Teams that made this split in their ticket tracker avoided the false sense of universal delay and kept near-term disclosure work fully staffed.
- Small Mid-Cap carve-outThe 2026 amendments extended simplified compliance treatment to companies with up to 750 employees and 150 million euros in annual revenue, a group previously exposed to the full high-risk burden once they outgrew standard SME thresholds.
- Safety component narrowingA feature is only a regulated “safety component” if its failure directly threatens physical safety or fundamental rights, which excludes most convenience, personalization, and backend optimization features from Annex I.
- Bias-testing data exemptionA narrow new exemption lets deployers process special category data such as race or gender, under strict safeguards, specifically to test high-risk systems for bias, resolving a prior conflict with general data protection law.
- Vendor documentation obligationsUpstream AI providers must still furnish deployers with instructions for use, technical documentation, and risk metrics, so contract renegotiation with vendors should start well before the 2027 deadline, not after.
- Enforcement penaltiesFines for transparency and disclosure failures can reach up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher, and this penalty structure was not softened by the Omnibus.
Glossary
- Digital Omnibus on AI
- The 2025 to 2026 European Commission legislative package that amended parts of the EU AI Act’s implementation timeline and scope, most notably deferring Annex III and Annex I high-risk deadlines.
- Annex III
- The section of the EU AI Act listing standalone high-risk AI use cases such as hiring, credit scoring, education, and law enforcement systems, now subject to a December 2, 2027 conformity deadline.
- Annex I
- The section of the EU AI Act covering AI embedded as a safety component in already-regulated products, such as medical devices and industrial machinery, now subject to an August 2, 2028 deadline.
- Article 5
- The provision banning specific AI practices outright, including manipulative techniques, exploitation of vulnerable groups, and untargeted biometric scraping, enforceable since February 2, 2025.
- Article 50
- The transparency provision requiring disclosure when a person is interacting with an AI system and labeling of AI-generated or manipulated content, effective August 2, 2026.
- Conformity assessment
- The formal process by which a provider demonstrates that a high-risk AI system meets the EU AI Act’s technical, data governance, and oversight requirements before market placement.
Key Takeaways
- The 2026 Digital Omnibus delayed Annex III high-risk conformity deadlines to December 2, 2027, and Annex I product-embedded systems to August 2, 2028, but did not touch the rest of the Act.
- Article 5 prohibited-practice bans have been enforceable since February 2, 2025, and should already be reflected in product design reviews.
- Article 50 transparency duties requiring AI disclosure to users remain due on the original August 2, 2026 date.
- Watermarking and machine-readable marking of generative AI output moved only four months, to December 2, 2026, not to 2027.
- Software teams should split their compliance backlog into a near-term “live obligations” track and a longer “runway” track to avoid treating the whole Act as paused.
- A Small Mid-Cap carve-out and a narrower definition of “safety component” reduce the compliance burden for many convenience and backend automation features.
- The extended Annex III runway should be used to build real documentation and oversight infrastructure, not simply banked as a reason to delay planning.
FAQs
Did the EU AI Act get delayed to 2027?
Only partly. The 2026 Digital Omnibus delayed the Annex III high-risk conformity assessment deadline from August 2026 to December 2, 2027, and the Annex I product-embedded deadline to August 2028. Article 5 prohibited practices, Article 50 transparency duties, and watermarking obligations were not delayed to 2027.
What is the current deadline for Article 50 transparency obligations?
Article 50 transparency duties, covering disclosure of chatbots and labeling of AI-generated content, remain due on August 2, 2026. This deadline was untouched by the Omnibus negotiations and applies regardless of whether a system is classified as high-risk.
Are prohibited AI practices under Article 5 currently enforceable?
Yes. Article 5 has been enforceable since February 2, 2025, well before the Omnibus discussions began. It bans practices such as manipulative behavioral techniques, exploitation of vulnerable groups, and untargeted facial recognition database scraping.
When must generative AI output be watermarked under the EU AI Act?
The watermarking and machine-readable marking obligation for generative AI output takes effect December 2, 2026, a four-month extension from the original August 2026 date, and is separate from the multi-year Annex III deferral.
What is the new deadline for high-risk AI systems under Annex III?
Standalone high-risk systems listed in Annex III, including hiring, credit scoring, education, and critical infrastructure AI, now have until December 2, 2027, to complete conformity assessments, a 16-month extension from the original August 2026 date.
Does the Omnibus change what counts as a high-risk safety component?
Yes. The amendments clarify that a feature is only a regulated safety component if its failure would directly threaten physical safety or fundamental rights, excluding many convenience, personalization, and backend optimization features from Annex I high-risk classification.
What penalties apply if a company misses the August 2026 transparency deadline?
Failing to meet Article 50 transparency obligations can expose an organization to fines of up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher. This penalty structure was not softened by the 2026 Omnibus amendments.
Is the Digital Omnibus on AI final and legally binding yet?
The European Parliament approved the simplification measures in June 2026 following a provisional agreement with the Council, but the new deadlines only become legally binding once the amended text is published in the Official Journal of the European Union.
References
- Gibson Dunn, “EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes”
- DLA Piper GENIE, “The Digital AI Omnibus: Proposed deferral of high risk AI obligations under the AI Act”
- Lumenova AI, “EU AI Act News 2026: New Deadlines and Business Impact”
- Covington Inside Privacy, “EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions”
- Addleshaw Goddard LLP, “AI Omnibus: provisional agreement on changes to EU AI Act, including delayed deadlines”
- ComplianceHub.Wiki, “The EU AI Act’s August 2, 2026 Deadline Just Moved: What the Digital Omnibus Actually Changed”
- VerifyWise, “EU AI Act omnibus: the new high-risk deadlines explained”
- European Parliament, press release on AI Act simplification measures, June 2026
For related reading on this site, see our guides to building an AI governance committee, NIST AI RMF versus ISO 42001, automated compliance tooling, AI incident response planning, and global AI ethics standards for teams shipping outside the EU as well.
