The EU AI Act Timeline Just Changed Again: What the July 2026 Digital Omnibus Means
- In July 2026, a few days before 2 August 2026, the EU moved the date when the rules for high-risk systems start to apply.
- Systems listed in Annex III now have until 2 December 2027. AI built into regulated products (Annex I) has until 2 August 2028.
- The obligations were deferred, not cancelled.
- The transparency rules of Article 50 started on 2 August 2026 as planned. Fines can reach EUR 15 million or 3% of worldwide annual turnover.
- The next date to watch is 2 December 2026.
For almost two years, 2 August 2026 was the date everyone working with AI in Europe had circled in the calendar. This was supposed to be the day when the main part of the EU AI Act, the rules for high-risk systems, started to apply. In July 2026, a few days before that date, the EU moved it. If you prepared for August, you were partly right and partly wrong: some obligations did start on time, and others now begin in December 2027 or even August 2028.
Below we explain what exactly changed, what did not, and why this matters not only for European companies but also for businesses in the UAE.
Below we explain what exactly changed, what did not, and why this matters not only for European companies but also for businesses in the UAE.
Operating in the UAE? See also: Is There a UAE AI Act? What the Law Actually Says in 2026
How we got here
The European Commission proposed the so-called Digital Omnibus on AI in November 2025. The main argument was practical: the technical standards that companies need to show compliance for high-risk AI were not ready, and it made little sense to enforce rules that nobody could properly meet.
The negotiations were not easy, and in spring 2026 it was unclear whether the EU would make it in time. A provisional agreement was reached on 6 May 2026, the European Parliament approved the text on 11 June and the Council on 29 June. The final act, Regulation (EU) 2026/1744, was published on 24 July and entered into force on 27 July 2026, just six days before the old deadline.
What was delayed
The delay concerns high-risk AI.
- Annex III: Systems listed in Annex III of the AI Act, for example AI used for credit scoring, recruitment, education or access to essential services, now have until 2 December 2027 instead of 2 August 2026.
- Annex I: AI built into products that are already regulated in the EU, such as medical devices or toys, has until 2 August 2028 instead of 2 August 2027.
It is important to read this correctly: the obligations were deferred, not cancelled. Risk management, data governance, technical documentation and human oversight will all be required, just later.
What did not move
This is the part many companies miss. The transparency rules of Article 50 started on 2 August 2026 as planned. In simple terms, this means three things.
- If people talk to a chatbot, they must be told it is AI, unless it is obvious.
- If a system generates images, audio, video or text, the output must be marked in a machine-readable way so that it can be detected as AI-generated.
- And deepfakes must be labelled by whoever publishes them.
The only relief is a short grace period until 2 December 2026 for the technical marking of generative AI systems that were already on the market before August. Fines for breaching these rules can reach EUR 15 million or 3% of worldwide annual turnover.
The rules for general-purpose AI models, which have applied since August 2025, also stay as they were.
Other changes worth knowing
- AI literacy became softer. Companies no longer have to ensure a sufficient level of AI literacy among their staff. They now have to take measures to support it. In practice, training is still expected, but the obligation is less strict.
- Relief for smaller companies. SMEs (Small and Medium-sized Enterprises) and small mid-caps get simplified technical documentation and a more proportionate approach to quality management.
- Bias testing. Providers of high-risk AI may, in exceptional cases and with strict safeguards, process sensitive personal data to detect and correct bias.
- New bans. From 2 December 2026, AI systems that generate non-consensual intimate images or child sexual abuse material are prohibited.
- Stronger AI Office. The European AI Office received direct supervisory powers over certain systems based on general-purpose models and over AI built into very large online platforms.
EU AI Act timeline after the Digital Omnibus
Here is how the timeline looks now:
Not sure which of your AI systems may be high-risk?
Take the AI Compliance Readiness Score and see where your gaps are.
Take the AI Compliance Readiness Score and see where your gaps are.
What we recommend
- Do not treat the delay as a break. Use the extra time until December 2027 to classify your AI systems and see which of them may be high-risk.
- Check Article 50 now. If you have a chatbot or generate content for EU users, disclosure and labelling are already required.
- If you use generative AI tools that were on the market before August 2026, make sure the technical marking is in place by 2 December 2026.
- Keep basic AI training for your team. The wording became softer, but regulators will still look at it.
Did the EU AI Act timeline change?
So the EU AI Act timeline did change again, but only half of it. The high-risk rules moved to December 2027 and August 2028, and this is a real relief: companies now have time to classify their systems properly and to work with technical standards that are actually finished.
Transparency, on the other hand, is already here. Since 2 August 2026, a chatbot that does not say it is a chatbot, or an AI-generated video without a label, is a breach, today, not in 2027. The next date to watch is 2 December 2026, when the marketing grace period ends and the new bans start to apply.
If you are not sure which of your AI systems fall under the AI Act and which deadline applies to you, AML ZONE can support. We will review how your business uses AI, tell you what already applies and what can wait, and build a clear plan for each stage.
06.10.2026
