> General information, not legal advice. This briefing summarises publicly reported positions as at 30 July 2026 and does not constitute legal advice. No advisory relationship arises from reading it. The dates below changed three days before publication and could change again. Before acting, verify against the Official Journal text of Regulation (EU) 2026/1744 and take advice from counsel qualified in the relevant jurisdiction.
---
The short version
Three days ago, on 27 July 2026, the Digital Omnibus on AI — Regulation (EU) 2026/1744 — entered into force, having been published in the Official Journal on 24 July 2026. It amends the EU AI Act (Regulation (EU) 2024/1689). Two things follow, and they point in opposite directions.
The high-risk deadlines moved. Chapter III Sections 1–3 obligations for Annex III standalone high-risk systems moved from 2 August 2026 to 2 December 2027 — a sixteen-month extension. Obligations for Annex I high-risk systems embedded in regulated products moved from 2 August 2027 to 2 August 2028.
The 2 August 2026 date did not disappear. General applicability still arrives on 2 August 2026 — three days from now — bringing Article 50(1) transparency obligations, marking of synthetic content for systems placed on the market from that date, and the start of enforcement nationally and at EU level. For a small professional-services firm that is the obligation most likely to bite, and it is the one nobody is discussing, because the coverage has all been about the deferral.
The regulation number, OJ date and entry into force are triple-sourced (NicFab; Hunton; Lewis Silkin). The sixteen-month Annex III extension is quad-sourced (FPF; Gibson Dunn; CSA; Modulos).
---
The verified timeline
| Date | Status | Obligation |
|---|---|---|
| 2 Feb 2025 | Live | Article 5 prohibitions; Article 4 AI literacy |
| 2 Aug 2025 | Live | GPAI model provider obligations; national competent authorities; penalties regime; governance (AI Board, Scientific Panel) |
| 24 Jul 2026 | Done | Regulation (EU) 2026/1744 published in the Official Journal |
| 27 Jul 2026 | Live | Digital Omnibus enters into force; Articles 102–110 apply immediately |
| 2 Aug 2026 | In 3 days | General applicability. Article 50(1) transparency. Marking of synthetic content for systems placed on market from this date. Enforcement begins nationally and at EU level. |
| 2 Dec 2026 | Pending | New Article 5 prohibitions (AI-generated CSAM and non-consensual intimate imagery). Article 50(2) machine-readable marking for generative systems already on market before 2 Aug 2026 — grace period ends. |
| 2 Aug 2027 | Pending | Legacy GPAI models (pre-2 Aug 2025) must comply. Member State sandboxes operational. Commission guidelines on Article 6 classification and Articles 8(2), 9(10), 17(3). AI literacy guidelines. |
| 2 Sep 2027 | Pending | Commission guidance on post-market monitoring plans |
| 2 Dec 2027 | Moved (was 2 Aug 2026) | Chapter III Sections 1–3 for Annex III standalone high-risk — recruitment, credit, education, essential services, law enforcement, justice |
| 28 Jan 2028 | Pending | Notified body designation application deadline |
| 2 Aug 2028 | Moved (was 2 Aug 2027) | Chapter III for Annex I high-risk embedded in regulated products |
| 2 Aug 2030 | Unchanged | Legacy high-risk systems used by public authorities |
One important nuance. Earlier Commission drafts tied the high-risk deferral to harmonized-standards readiness through a "stop-the-clock" mechanism. Modulos' analysis of the final text reports that this conditionality was removed entirely, leaving unconditional calendar dates (Modulos). That is a single source, though consistent with the FPF and Gibson Dunn date tables. If the conditionality question matters to your planning, verify it against the Official Journal text rather than relying on this briefing.
---
Are you actually in scope?
Most of the anxiety here comes from firms that have not worked out which of three positions they occupy.
Provider. You place an AI system on the market or put it into service in the EU under your own name or trade mark — including where you have substantially modified someone else's system or put your branding on it. If you build AI into a product you sell, this is you.
Deployer. You use an AI system under your own authority in the course of a professional activity. This is where almost every 10–200 person firm actually sits: an AI writing assistant, an AI-enabled CRM, an AI note-taker in client meetings, a chatbot on your website. Deployers carry obligations — and the belief that the Act regulates developers and leaves users alone is the single most common misunderstanding about it.
Out of scope. Only if you neither place AI systems on the EU market nor use them professionally in a way connected to the EU: in practice, non-EU firms with no EU clients, no EU users and no EU-directed output.
If you are a deployer, does high-risk apply? The Annex III categories are recruitment, credit, education, essential services, law enforcement and justice. If AI materially influences your decisions in those areas, take advice. If you use AI to draft, summarize, analyze, code or answer routine questions, you are almost certainly not high-risk — and the Omnibus narrowed the safety-component definition so that systems used solely for "user assistance, performance optimization, efficiency or automation, and convenience or quality control" no longer automatically qualify unless failure endangers health or safety.
A reality check on difficulty: an appliedAI GmbH analysis of 106 enterprise AI systems found 40% could not be cleanly classified against the Act's risk tiers (cited via CSA, which dates it to 2023 — treat the vintage as uncertain). If you find this hard, that is the normal experience, not a failure of diligence. The Commission's Article 6 classification guidelines are due 2 August 2027.
---
The extraterritorial question, for a non-EU business
The Act is explicitly extraterritorial. A US or UK professional-services firm with EU clients is in scope. The trigger is not where your company is registered; it is where the system is placed on the market, put into service, or — for deployers — where the activity and its effects sit.
The practical test is short. Do you have EU clients? Do EU-based individuals interact with an AI system you operate — a chatbot, an automated intake tool, an AI-assisted service? Do you produce AI-generated output used in the EU? If yes to any, work through the scoping section above rather than assuming distance protects you.
That does not mean every non-EU firm with one European client has an enterprise compliance program to build. For most it means a transparency check, an inventory and a documented view of your position — a week of work, not a project.
---
What a deployer of ordinary commercial AI tools actually has to do
If you are a deployer of non-high-risk AI — the overwhelming majority of firms at this size — the live obligations are narrower than the coverage suggests.
Article 4 AI literacy, live since 2 February 2025, applying to providers and deployers. The Omnibus softened it from a duty to ensure competency to a duty to take measures to support the development of AI literacy: a significantly lower bar for a small firm, but not a removal. What satisfies it in practice is role-relevant training tied to the work people actually do, delivered with leadership sponsorship, with a record that it happened. Commission guidelines are due 2 August 2027.
Article 50 transparency, from 2 August 2026. Tell people when they are interacting with an AI system, and mark synthetic content. The marking obligation applies to systems placed on the market from 2 August 2026; for generative systems already on the market before that date, the Article 50(2) machine-readable marking grace period runs to 2 December 2026.
Article 5 prohibitions, live since 2 February 2025, with additional prohibitions covering AI-generated CSAM and non-consensual intimate imagery arriving 2 December 2026, at the highest penalty tier.
Registration. The Omnibus reinstated registration for self-assessed non-high-risk systems, contrary to the Commission's proposal to drop it, but with a lighter footprint — Annex VIII Section B points 7 and 9 were deleted. Separately, simplified documentation was extended to medium-sized enterprises (previously small only), and machinery-embedded AI was largely exempted.
Deployer duties that arrive later. From 2 December 2027, deployers of Annex III high-risk systems must use them strictly per provider instructions, apply technical and organizational safeguards with trained human oversight, monitor continuously, report serious incidents without delay, retain logs, conduct impact assessments where required, and inform affected individuals. If any of your systems might land in that category, vendor contracts need renegotiating well before then.
Penalties, unchanged by the Omnibus: €35m or 7% of global annual turnover for Article 5 prohibited practices; €15m or 3% for high-risk and most other obligations (Article 99(4)); €7.5m or 1% for incorrect or misleading information to authorities (Article 99(5)). SMEs benefit from proportionate caps — the lower of the fixed sum or the percentage — though the precise mechanics were not detailed in the sources available here. National regimes add their own ceilings; Italy's Law 132/2025 is reported to set a maximum of €774,685, a single-sourced figure that should be verified.
---
A warning about what you will read elsewhere
The single biggest practical hazard right now is stale guidance. The Omnibus is three days old, and a large amount of authoritative-looking published material has not caught up. Verified examples as at the research date:
| Source | Problem |
|---|---|
| artificialintelligenceact.eu — implementation timeline, the most-cited independent tracker | Page last updated 1 August 2024; still states "2 August 2026: the remainder of the AI Act starts to apply" |
| DataGuard timeline | Does not mention the Digital Omnibus or any recent amendment |
| Legiscope compliance calendar | Still lists 2 August 2026 for high-risk conformity assessment |
| Legal Nodes | States the Act "becomes fully applicable on August 2, 2026" and advises completing conformity assessments and CE marking before that date |
Even the specialist legal press disagrees on the chronology. Gibson Dunn dates the provisional political agreement 6 May 2026 with Council confirmation on 13 May; Sidley dates it 7 May 2026. DLA Piper records European Parliament endorsement on 16 June 2026 and Council green light by 30 June 2026. Treat only the OJ publication date (24 July 2026) and entry into force (27 July 2026) as firm.
Three rules follow. Treat any secondary summary dated before July 2026 as wrong on dates — not necessarily wrong on substance, since the obligations themselves are largely unchanged, but wrong on when they apply. Verify against the Official Journal: the consolidated AI Act text as amended by Regulation (EU) 2026/1744 is the only authoritative source, with the European Commission's AI Act Service Desk timeline as the official secondary reference. And check the "last updated" date on any tracker before you use it — in this area that field is doing more work than the content.
---
What to do in the next fortnight
Do not build a compliance program. Do four things.
1. Establish your position — provider, deployer or out of scope — and write it down with your reasoning. That memo is the artifact that matters if anyone asks.
2. Inventory your AI systems, including AI embedded in tools you bought for other reasons and tools your team adopted without telling you.
3. Run an Article 50 transparency check before 2 August 2026. Where does a person encounter AI in dealing with your business, and are you telling them? Where do you publish AI-generated content, and is it marked?
4. Do not stand down on the deferred obligations if you might be high-risk. DLA Piper's framing is correct: the deferral "should not be treated as an invitation to delay… the underlying obligations… remain unchanged."
Sixteen months to December 2027 sounds comfortable. Modulos puts the counterargument well: it "sounds comfortable until it absorbs a notified-body queue, an evidence backlog and a budget cycle." The critical path is CEN-CENELEC JTC21 harmonized standards, whose absence caused this delay and whose progress is the leading indicator for whether December 2027 holds.
Whether a further omnibus or review is queued could not be verified for this briefing. The Act has been amended once within two years of adoption, so further amendment is plausible — but we have no source for it and will not assert it.
---
Sources
Regulation (EU) 2026/1744 — the Digital Omnibus on AI
- NicFab — Digital Omnibus on AI: Regulation (EU) 2026/1744 Published in the Official Journal
- Hunton — EU Digital Omnibus on AI Enters Into Force
- Lewis Silkin — The Digital Omnibus on AI enters into force today (27 Jul 2026)
- Future of Privacy Forum — The AI Act implementation timeline: What changes under the AI Omnibus?
- Gibson Dunn — EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes
- Sidley Data Matters — EU Lawmakers Reach Provisional Agreement to Delay Key EU AI Act Obligations
- Freshfields — EU AI Act unpacked #34: The final Digital Omnibus on AI
- Modulos — EU AI Act Omnibus Published: New Deadlines
- Covington Inside Global Tech — EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions
- DLA Piper GENIE — The Digital AI Omnibus: deferral of high-risk AI obligations
- ComplianceHub.Wiki — The EU AI Act's August 2, 2026 Deadline Just Moved
- Cloud Security Alliance — Research Note: EU AI Act Omnibus VII Deadline Delay
- Cloud Security Alliance — Research Note: EU AI Act High-Risk Compliance Deadline / Enterprise Readiness Gap
- EU Law Live — Official publication: Digital Omnibus on AI Act
Official and baseline
- European Commission AI Act Service Desk — Implementation Timeline
- K&L Gates — EU and Luxembourg Update on European Harmonized Rules on AI (20 Jan 2026) — national supervisory architecture; penalty tiers
Cited as examples of superseded published guidance
- artificialintelligenceact.eu — Implementation Timeline — last updated 1 Aug 2024
- DataGuard — EU AI Act Timeline — no Omnibus
- Legiscope — EU AI Act Deadlines 2026-2027 — timeline superseded; penalty tiers valid
- Legal Nodes — EU AI Act 2026 Updates — pre-Omnibus
Note on verification. The consolidated AI Act text as amended (ELI reference `data.europa.eu/eli/reg/2026/1744/oj`) is the authoritative source and was not directly retrievable during the research behind this briefing; all dates above are reproduced from the secondary sources named. The Italian national penalty cap and the "unconditional dates" finding are single-sourced and flagged as such in the text. Verify against the Official Journal before relying on any of it.