EU AI Act Timeline Update: What the Digital Omnibus Delays, Adds, and Leaves Untouched

The Practitioner Guide to What Changes, What Stays, and What to Do Before August 2026

The EU AI Act has been in force since 1 August 2024. Its compliance obligations apply in phases: by risk category, by actor type, and by system status. The phased structure was always deliberate. What has changed is that some of those phases are now moving.

In November 2025, the European Commission published the Digital Omnibus, a legislative package that proposes, among other things, to push back the high-risk AI system deadlines that most organisations have been building toward. The proposal is moving fast by EU standards. The Council adopted its position in March 2026. The European Parliament's committees followed days later. The plenary voted its position on 26 March 2026. Trilogue between the three institutions is now formally open, with a target agreement before 2 August 2026.

Nevertheless, the companies will not get a break from what applies on 2 August 2026. The Digital Omnibus targets high-risk system obligations specifically. Transparency rules, penalties, and governance infrastructure apply as scheduled. The direction is clear enough to act on. August 2026 is still the operative deadline.

For a full overview of the regulation, see our EU AI Act summary. For a guide to which systems qualify as high-risk AI, see our dedicated guide.

Where enforcement stands as of March 2026

Fines of up to EUR 35 million or 7% of global annual turnover have been applicable since August 2025. But the investigatory and enforcement powers that allow authorities to act on those fines for most obligations do not apply until 2 August 2026.

The EU AI Act Timeline: Milestone by Milestone

1 August 2024: Entry into Force

The regulation entered into force. No compliance obligations apply yet, but the clock starts on all phased deadlines.

2 February 2025: Prohibited Practices and AI Literacy

The first live obligations. Prohibited AI practices under Article 5 are banned: social scoring by public authorities, real-time biometric identification in public spaces for law enforcement (with limited exceptions), AI that exploits vulnerabilities to manipulate behaviour, and systems that infer emotions in the workplace or education. Organisations must currently have AI literacy measures in place for staff working with or on AI systems. The Digital Omnibus proposes softening this obligation for most actors. Critically, the training and competency requirements for staff in human-oversight roles for high-risk AI systems are expected to remain. Organisations should not assume AI literacy obligations will disappear: they should differentiate between general workforce literacy (likely softened) and role-specific oversight competence for high-risk deployments (likely retained).

These obligations are in force and are not proposed for delay under the Digital Omnibus. One significant addition is in the pipeline: the Council's negotiating position proposes expanding Article 5 to add an explicit prohibition on AI systems that generate or manipulate non-consensual intimate imagery and child sexual abuse material. The prohibitions are being tightened in this respect, not relaxed.

2 August 2025: GPAI Models and Governance Infrastructure

General-purpose AI model obligations became applicable. Providers of GPAI models must maintain technical documentation, publish a summary of training data content, comply with EU copyright rules, and put in place policies for systemic risk.

The AI Office became fully operational. The penalty regime entered into effect for most infringements (penalties for GPAI obligations are delayed to August 2026). Member States should have designated national competent authorities.

GPAI providers that placed models on the market before 2 August 2025 have until 2 August 2027 to comply: a two-year grace period. New models must comply immediately.

2 August 2026: The Main Application Date

The date the bulk of the EU AI Act becomes enforceable. This is not proposed for delay under the Digital Omnibus. Organisations preparing for August 2026 should continue on that track regardless of how the Digital Omnibus negotiations resolve. The following section covers in detail what applies on this date.

2 December 2027: Proposed New Deadline for Annex III High-Risk AI

Under the Digital Omnibus proposal, as supported by both the Council (13 March 2026) and the Parliament committees (18 March 2026), the obligations for standalone high-risk AI systems listed in Annex III would apply from 2 December 2027, approximately 16 months after the original August 2026 date. Annex III covers AI used in biometrics, education, employment, access to essential services, law enforcement, migration, and administration of justice.

Both Parliament and Council have formally adopted their positions. Trilogue is now open. The deadline of 2 December 2027 reflects the agreed positions of both institutions, though the final text may still be amended in trilogue. If the Digital Omnibus is not formally adopted before 2 August 2026, the original deadline stands.

2 August 2028: Proposed New Deadline for Annex I High-Risk AI

High-risk AI systems embedded in regulated products under Annex I (medical devices under the MDR, machinery, vehicles, in vitro diagnostic devices) were originally due to comply by 2 August 2027. The Digital Omnibus proposes pushing this to 2 August 2028, one year later than the previous deadline. For more on conformity assessment for these systems, see our EU AI Act conformity assessment guide.

31 December 2030: Large-Scale IT Systems

AI systems that are components of large-scale IT systems listed in Annex X must be brought into compliance by 31 December 2030. These systems have the longest transition period given their embedded nature and cross-border governance complexity.

What Applies on 2 August 2026

August 2026 is not a soft target. The obligations below apply regardless of how the Digital Omnibus negotiations conclude.

The AI-generated content marking deadline: an important nuance

For AI systems that generate synthetic audio, images, video, or text and are already on the market before 2 August 2026, the Digital Omnibus proposes an extended deadline for machine-readable content marking (Article 50(2)). The Council proposes 2 February 2027. The Parliament adopted 2 November 2026 at its plenary vote on 26 March 2026. The final date will be settled in trilogue. For new systems launched after 2 August 2026, the marking obligation applies immediately from launch.

What Has Been Pushed and Why

The original EU AI Act set August 2026 as the date for full compliance by providers and deployers of high-risk AI systems listed in Annex III. For Annex I systems embedded in regulated products, the date was August 2027. The Digital Omnibus proposes changing both. It is important to note that the Omnibus is not purely a simplification package: it also tightens certain provisions. New prohibitions are being added, data protection requirements in some areas are being debated in a more restrictive direction, and the enforcement architecture is being refined. The net effect is a more workable framework, not a weaker one.

Why?

The Commission's stated rationale is the absence of the compliance infrastructure the Act assumed would be ready. Harmonised standards from CEN-CENELEC are delayed. Commission guidance on high-risk classification was expected in February 2026 but has not been finalised. Guidance on serious incident reporting, originally expected in August 2025, has no confirmed publication date. Only 8 of 27 Member States have designated single points of contact for enforcement. The pool of formally designated notified bodies under the EU AI Act remains very small.

The delay is a practical acknowledgement: enforcing obligations when the compliance tools and enforcement infrastructure are both incomplete is not viable. It does not mean the obligations are weakening.

The critical caveat: the Digital Omnibus has not yet been formally adopted as law. Both the Parliament and the Council have adopted their positions and trilogue is open. The target is agreement by May 2026. If the final text is not adopted before 2 August 2026, the original deadlines apply. The Parliament adopted its position at plenary on 26 March 2026. Both institutions have moved quickly. For businesses: August 2026 is a build deadline, not a watch list item.

Other Digital Omnibus Changes That Affect Compliance Planning

Registration under Article 6(3): self-assessment obligations changing

Under the current AI Act, providers who determine that a system listed in Annex III is not high-risk under Article 6(3) must register that determination in the EU database. The Commission proposes removing this registration duty entirely. The Council's position is more conservative: it wants lighter registration requirements rather than outright removal, and it wants to reinstate the obligation to register where providers self-assess their system as non-high-risk. This is directly relevant to compliance planning: organisations that have structured their classification decisions around the current registration obligation should review those assumptions. The outcome will determine how much public accountability attaches to self-assessments, and how much scrutiny they face from market surveillance authorities.

Sensitive data for bias mitigation: a live data protection dispute

One of the most actively contested elements of the Omnibus is the legal standard for processing special categories of personal data for bias detection and correction in AI systems. The Commission proposed relaxing the standard from "strictly necessary" to "necessary" and extending the permission to a broader set of actors beyond high-risk AI systems. The Council and Parliament have both pushed back, reinstating the "strictly necessary" standard and narrowing the scope. This is not a settled question. The final outcome will directly affect how organisations structure their bias-mitigation workflows and what legal bases they rely on under the GDPR. Organisations processing sensitive data for bias detection purposes should document strict necessity now and should not assume the Commission's more permissive position will prevail.

Proportionality extended to small mid-caps

The Digital Omnibus proposes extending the SME-style proportionality provisions currently in the AI Act to small mid-cap enterprises (SMCs): companies with up to 750 employees and up to EUR 150 million in annual turnover. This means simplified technical documentation requirements and capped penalties for a significantly larger group of organisations than currently benefit from those provisions. Companies that currently sit just above SME thresholds should assess whether they would qualify as SMCs and what that would mean for their compliance planning.

Enforcement: What It Looks Like in Practice

The penalty regime under the EU AI Act has three tiers:

Who enforces it

National market surveillance authorities are the primary enforcement actors. Only 8 of 27 Member States have designated one as of March 2026. Italy is the first to have passed a national AI law, in September 2025. Most Member States are still building their enforcement infrastructure.

The AI Office, now fully operational, supervises GPAI model obligations and systemic risk assessments. The Commission's Digital Omnibus proposal would give the AI Office exclusive competence over AI systems built on GPAI models. The Council has pushed back: its negotiating position retains national authority competence for product-safety systems, critical infrastructure, law enforcement, financial services, and justice. The final split of competence will be settled in trilogue.

What enforcement looks like now

Fines for prohibited practices have been applicable since August 2025. Full enforcement powers for most obligations apply from August 2026. Capacity is uneven across Member States, but that does not make the obligations optional. Expect enforcement to begin with visible cases and escalate, as it did under GDPR.

The GDPR analogy is instructive but imperfect. AI obligations are more technically complex than data protection obligations, and enforcement authorities will need specialist knowledge and tooling that takes time to develop. There is also a coordination question: where GPAI models are used across multiple Member States, enforcement competence may lie primarily with the AI Office rather than national authorities. This will generate jurisdictional questions that will not be resolved quickly. For organisations building AI governance programmes, the enforcement trajectory should inform the priority sequence, not the binary question of whether enforcement is real.

What Organisations Should Do Now

Your compliance calendar, regardless of how the Digital Omnibus resolves:

• Audit prohibited practices immediately. These have been in force since February 2025 and carry the maximum fines. If your organisation uses AI for employee monitoring, social benefit decisions, or law enforcement purposes, these obligations are live.
• Classify all AI systems against the Annex III taxonomy. This work does not depend on which deadline applies. You cannot assess compliance risk without knowing which category your systems fall into. Our high-risk AI guide covers the classification framework.
• Prepare for August 2026 transparency obligations. Article 50 applies from 2 August 2026 and is not proposed for delay. AI systems interacting with people must disclose they are AI. Generative AI outputs must be marked. Emotion recognition systems must notify users. These are the obligations to build toward immediately.
• Build governance infrastructure regardless of high-risk deadline. Quality management systems, risk management processes, and technical documentation take time to develop. The December 2027 deadline gives more time for formal certification. It does not reduce the documentation work. Our ISO 42001 guide covers the governance framework that aligns most directly with AI Act requirements.
• Apply AI Act requirements to vendor assessments now. If you deploy third-party AI systems in high-risk use cases, your deployer obligations are already in scope. The vendor assessment process should include AI Act compliance verification as a standard checkpoint.
• Monitor the Digital Omnibus legislative progress closely. Trilogue negotiations between the Parliament, Council, and Commission will determine the final dates. If the Omnibus is not adopted before 2 August 2026, the original deadlines apply. The Parliament voted on 26 March 2026. Trilogue is now open. The Cypriot Presidency is targeting a final agreement by May 2026.
• Review Article 6(3) classification decisions. The Omnibus proposes changes to registration obligations for systems self-assessed as non-high-risk. Re-inventory your Annex III systems, document your classification reasoning, and track how the trilogue resolves the Commission vs Council disagreement on registration. Self-assessments that are underdocumented today will be harder to defend regardless of which position prevails.
• Audit bias-mitigation workflows for sensitive data processing. If your organisation processes special categories of personal data for bias detection or correction in AI systems, document strict necessity now. The Commission's proposal to relax the standard has not been accepted by either the Council or Parliament. Do not plan on the basis that the standard is changing.
• Differentiate AI literacy obligations by role. The general AI literacy obligation for the workforce is being softened. Training and competence requirements for staff in human-oversight roles for high-risk AI systems are expected to remain. Update training programmes accordingly: broad awareness training may become lighter, but role-specific oversight competence for high-risk deployments should be treated as a firm obligation.

How Whisperly Supports EU AI Act Compliance

The EU AI Act is live, being amended, and will be enforced. A spreadsheet of deadlines is not enough. Whisperly's AI governance platform maps your AI systems to their applicable obligations across the current timeline and the Digital Omnibus scenarios, generates the documentation structure required for conformity assessment, and tracks QMS compliance across your AI portfolio.

For organisations deploying third-party AI systems and managing vendor due diligence, the vendor assessment capability provides a framework for verifying provider compliance before systems enter your environment.