Digital Omnibus: the AI Act timeline in 2026

The digital omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, defers the obligations attached to Annex III high-risk AI systems from 2 August 2026 to 2 December 2027. It does not defer the AI Act itself: the Article 50 transparency duties, the penalty regime and market surveillance have applied since 2 August 2026, including to organisations established outside the EU.

In brief: the real AI Act timeline

The digital omnibus on AI, formally Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act without replacing it.

What it does, precisely:

It defers the obligations attached to Annex III high-risk AI systems, from 2 August 2026 to 2 December 2027.
It defers those attached to high-risk systems embedded in products already regulated under EU product-safety law, Annex I, to 2 August 2028.
It strengthens the proportionality of penalties for SMEs and small mid-cap companies.

What it does not do: defer the AI Act. Since 2 August 2026 the transparency obligations of Article 50 have applied, the penalty regime is operational, and the supervisory authorities hold their enforcement powers.

The shorthand that has circulated since late July — “the AI Act has been delayed” — is wrong. It is also expensive, because it causes organisations to miss a deadline that has already passed.

Why this text exists

The AI Act was adopted in 2024 with an ambitious timeline. Three difficulties emerged afterwards.

First, the harmonised standards meant to translate the regulation’s requirements into technical specifications are not ready. Without them, a provider of a high-risk system has to demonstrate conformity with no enforceable reference framework. The position is legally uncomfortable on both sides.

Second, the national supervisory authorities have not all been designated or resourced. A regulation with no authority to enforce it produces uneven application from one member state to the next.

Third, competitive pressure. The Draghi report and the debate that followed carried the argument that regulatory load was weighing on European competitiveness in artificial intelligence. The digital omnibus is the political answer to that debate.

The deferral should be read for what it is: a timing adjustment driven by how ready the ecosystem is. It is not a retreat on the substance of the text.

Does this apply to you if you are not in the EU?

This is the first question a UK organisation should settle, and establishment in the UK does not answer it.

Article 2 of the AI Act sets out an extraterritorial scope. It catches providers that place an AI system on the EU market, wherever they are established. It also catches providers and deployers based in third countries where the output produced by the system is used in the EU.

Three concrete configurations:

Situation	In scope?
A UK software vendor sells an AI feature to customers in Ireland and Germany	Yes, as a provider placing a system on the EU market
A UK recruiter screens candidates on behalf of an EU subsidiary	Yes, output used in the EU
A UK company uses an internal AI tool, no EU customers, no EU output	No — but UK GDPR still applies in full

The last line matters as much as the first two. Falling outside the AI Act is not falling outside regulation. It means the applicable rules are UK GDPR and whatever your sector regulator expects, which is a different question with a different answer.

What has applied since 2 August 2026

Three blocks came into application, and they concern far more organisations than the high-risk obligations do.

Article 50: transparency

This is the block that touches the largest number of organisations, because it does not depend on a high-risk classification. It applies as soon as an AI interacts with a person or produces content.

Situation	Obligation
An AI system interacts with a person	Inform the person that they are dealing with an AI, unless it is obvious
A system generates synthetic content	Mark the content as artificially generated, in a machine-readable format
A system produces a deepfake	Disclose that the content has been generated or manipulated
Published text informs the public without human review	Disclose that it was AI-generated
A system recognises emotions or categorises people biometrically	Inform the people exposed to it

One piece of breathing room in this timeline: the machine-readable marking required by Article 50(2) has until 2 December 2026, and only for systems already placed on the market before 2 August 2026. A system deployed after that date must mark its outputs now.

In practice, if you run a conversational agent on your website, the disclosure has to be visible. If your marketing team publishes generated visuals, they have to be identifiable. Our guide to agentic AI covers the cases where an agent crosses the threshold of direct interaction.

The penalty regime

Chapter XII has been fully operational since 2 August 2026. Three tiers, with the higher of the two figures applying:

Breach	Ceiling
Prohibited practices under Article 5	EUR 35m or 7% of worldwide annual turnover
Other breaches, including Article 50	EUR 15m or 3%
Inaccurate information supplied to authorities	EUR 7.5m or 1%

The digital omnibus introduced stronger proportionality for SMEs and small mid-caps. The lower end of the range applies to them, which softens the threshold effect without removing the risk.

Note for organisations budgeting in sterling: these are turnover-based ceilings on worldwide annual turnover, not EU turnover. A UK group with a modest EU footprint is exposed on its global figure.

Governance and market surveillance

The European AI Office and the national market surveillance authorities now hold their enforcement powers. For a non-EU provider, the practical consequence is the authorised representative requirement: a provider established outside the EU that places a high-risk system on the EU market must appoint a representative within the Union. That obligation follows the high-risk timeline, which means it now sits in December 2027 — worth noting on a roadmap rather than solving today.

What the UK does instead

The UK has no equivalent to the AI Act, and there is no sign of one arriving on a comparable timeline.

The framework set out in the 2023 pro-innovation white paper is sector-led and principles-based. It relies on existing regulators applying existing law to their own patch: the ICO for personal data, the FCA for financial services, the MHRA for medical devices, Ofcom for online safety, the CMA for competition. There is no single register, no single classification exercise, and no single deadline.

That sounds lighter. In practice it shifts the burden of interpretation onto the organisation, because nobody hands you a risk tier. The ICO has made an AI and automated decision-making code of practice one of its stated priorities, which will eventually give the data-protection side of the question a reference document. Until it lands, the working references are the ICO’s existing guidance on AI and data protection and its AI and data protection risk toolkit.

The point where the UK moved in the opposite direction

While the EU was deferring its high-risk obligations, the UK was rewriting its rules on automated decisions — and loosening them.

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, in force since 5 February 2026. The shift is structural. The old regime was a prohibition on solely automated decisions with significant effects, subject to narrow exceptions. The new regime permits such decisions for most personal data, provided the controller puts safeguards in place.

The safeguards must, at minimum:

give the data subject information about the decision;
let them make representations about it;
let them obtain human intervention from the controller;
let them contest the decision.

Two cautions. The stricter regime is retained where special category data is involved, so a decision drawing on health or biometric data does not benefit from the relaxation. And “human intervention” has to be meaningful — a reviewer who rubber-stamps a score without the authority or the information to overturn it does not satisfy the safeguard.

The net effect for a UK organisation running a screening or scoring model is not less work. It is different work: less time spent proving an exception applies, more time spent evidencing that the four safeguards are real. Our guide to AI and data protection covers where the two regimes meet.

What has been deferred, and by how much

The deferral covers a precise perimeter. The question worth answering is whether you are inside it.

                    AI ACT — TIMELINE AS AT AUGUST 2026

  2 Feb 2025    ██ Prohibited practices (Art. 5)          IN FORCE
                ██ AI literacy (Art. 4)                   IN FORCE

  2 Aug 2025    ██ General-purpose AI models (GPAI)       IN FORCE

  2 Aug 2026    ██ Transparency (Art. 50)                 IN FORCE
                ██ Penalties (Chap. XII)                  IN FORCE
                ██ Market surveillance                    IN FORCE

  2 Dec 2026    ░░ Machine-readable marking, Art. 50(2)   short grace
                     (systems placed on market pre-Aug 2026)

  2 Dec 2027    ░░ High risk — Annex III                  DEFERRED
                     standalone: employment, education,
                     biometrics, essential services...

  2 Aug 2028    ░░ High risk — Annex I                    DEFERRED
                     embedded: medical devices,
                     machinery, connected toys

The obligations moved to 2 December 2027 are those bearing on standalone Annex III systems:

a risk management system;
governance of training, validation and test data;
technical documentation and logging;
transparency towards the deployer;
effective human oversight;
accuracy, robustness and cybersecurity;
a fundamental rights impact assessment, on the deployer’s side.

Annex III covers biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and the administration of justice. A CV screening tool falls under employment. A credit scoring model falls under essential services.

If your AI system is instead embedded in a product already covered by sector-specific legislation, the deadline is 2 August 2028.

Three concrete situations

The timeline becomes far easier to read against real cases. Here are three common configurations.

A conversational agent on a public website

A company runs an assistant that answers customer questions from its own documentation.

This system does not fall under Annex III: answering product questions touches neither employment, nor credit, nor an essential service. The December 2027 deferral does not concern it, and gives it nothing.

Article 50, on the other hand, has applied since 2 August 2026 — assuming the assistant is reachable by users in the EU. The user has to know they are dealing with an AI. The disclosure belongs at the start of the conversation, not buried in the terms and conditions. If the assistant generates summaries that are later published on the site, those fall under the marking obligation.

This configuration is by far the most widespread, and it is the one the “the AI Act has been delayed” shorthand harms most.

A CV screening tool

An HR function uses a tool that ranks applications against a role.

This system falls under Annex III, employment. The deferral applies where the EU is in scope: risk management, technical documentation and human oversight are expected by 2 December 2027.

Two things remain due today, though. For a UK controller, Articles 22A to 22D of the UK GDPR govern solely automated decisions and require the four safeguards described above — rejecting a candidate with no meaningful human involvement sits squarely in that regime. And a DPIA remains required wherever the processing is likely to result in a high risk to people’s rights. The AI Act timeline suspends none of this.

An internal scoring model with no external exposure

A finance function uses a model to prioritise collections follow-ups.

Ranking falls under Annex III only where it conditions access to an essential service, which prioritising a follow-up does not. Article 50 does not apply either, since no person interacts with the system and no content is published.

This case makes a useful point: a large share of enterprise AI use falls into neither category. The applicable obligations are then the data protection ones, and the AI Act load reduces to literacy and to documenting the classification you settled on.

The forgotten obligation: AI literacy

Article 4 has been in force since 2 February 2025, and it is widely ignored.

It requires providers and deployers alike to ensure their staff have a sufficient level of AI literacy. The text speaks of understanding the capabilities, the limits and the risks of the systems in use.

Two features make this obligation unusual. It depends on no risk classification: it applies as soon as an organisation deploys AI. And it calls for a demonstration, not a declaration. Under scrutiny, you have to produce a record.

What that record contains in practice:

the list of AI systems in use and by which teams;
the content of the awareness sessions, matched to what each population actually does;
dates, attendees and materials;
the internal usage policy, where one exists.

A generic session on artificial intelligence does not suffice. The article targets understanding of the systems actually in use. We cover this in our guides on the business AI charter and AI training.

It is the cheapest obligation in the regulation, and the one that has been overdue the longest.

”The AI Act has been delayed”: three reasons to distrust the shorthand

The message travelled fast in late July, and it produces three misreadings.

First misreading: believing nothing applies. Article 50 is in force and depends on no classification. An organisation running a chatbot without disclosure, within EU reach, is in breach today, with an operational penalty regime facing it.

Second misreading: treating the deferral as exemption. The deferred obligations bear on design: training data governance, documentation, logging, human oversight. These are decided at architecture time. Retrofitting them onto a system already in production means rebuilding part of the chain.

Third misreading: forgetting the other texts. Data protection law has not moved out of the way. A screening tool remains subject to the automated decision rules whatever the AI Act deadline — and in the UK those rules changed in February 2026, in a direction that demands evidence of safeguards rather than reliance on an exception. Deferring one text does not suspend another.

What this changes for your roadmap

The deferral changes the order of priorities, not the destination.

To handle now. An inventory of your AI systems and their classification. Article 50 compliance on everything exposed to users or publishing content, wherever the EU is within reach. Evidence of AI literacy across your teams, due since February 2025 and routinely forgotten.

To handle by the end of 2026. Documentation for the systems you suspect are high-risk. Not because the deadline is close, but because documenting them reveals what needs to change in the architecture. Discovering in 2027 that a model is unauditable leaves very little room.

To handle in 2027. Formal conformity work on Annex III systems, once the harmonised standards are published. That is the point at which a technical reference framework will finally exist.

This is the sequence we apply on our AI consulting engagements: settle what is already due first, design for what will become due next.

The inventory, the unavoidable starting point

None of these steps holds without an up-to-date inventory. It is the least rewarding job in the file, and the one most organisations underestimate.

The inventory is not limited to projects labelled as AI. It covers AI features embedded in software already in place: a scoring module in a CRM, a suggested reply in a support tool, automatic filtering in an HR application. These components engage the deployer’s responsibility exactly as an in-house model would.

For each system, four pieces of information are enough to start: the actual purpose, the population affected, the supplier, and the risk category you settled on with your reasoning. That last column is the important one. Under scrutiny, what gets discussed is rarely the classification — it is the reasoning that led to it.

What remains unsettled

Three points are not stable as at the date of this article.

The harmonised standards meant to translate the high-risk requirements into technical specifications have not been published. Their content will determine the real cost of conformity.

The Commission’s guidance on Article 50 remains partial, particularly on the format of machine-readable marking and on the cases where interaction with an AI counts as obvious.

On the UK side, the ICO’s code of practice on AI and automated decision-making is still to come. Until it does, the safeguards under Articles 22A to 22D have to be designed from the statute and the ICO’s existing guidance rather than from a settled reference.

What we will not promise

“The deferral buys you eighteen quiet months.” False for most organisations. Article 50 already applies and reaches everyone exposing an AI to users within the EU. The deferral covers an Annex III perimeter many organisations never reach.

“We will make you AI Act compliant.” Nobody can promise that today on the high-risk side, because the harmonised standards are missing. What we do know how to do is design a system that is documentable, logged and supervisable, so that formal conformity becomes a drafting exercise rather than a rebuild.

“Compliance can be sorted after go-live.” Technically possible, economically poor. Traceability and human oversight are architectural properties. Our approach as a data and AI agency is to put them in place at design time, when they cost little.

One point of honesty about this text: the digital omnibus is recent, and its interpretation will settle as the Commission’s guidance appears. The dates and perimeters set out here reflect the regulation as published. The practical detail will keep moving.

FAQ

Has the EU AI Act been delayed?

Not as a whole. Regulation (EU) 2026/1744, known as the digital omnibus on AI, defers one precise part of the text: the obligations attached to the high-risk systems listed in Annex III, moved from 2 August 2026 to 2 December 2027. High-risk systems embedded in products already covered by EU product-safety law move to 2 August 2028. Everything else keeps the original timeline: prohibited practices since February 2025, general-purpose AI models since August 2025, transparency and penalties since 2 August 2026.

Does the EU AI Act apply to a UK organisation?

It can, and establishment in the UK makes no difference on its own. Article 2 catches providers that place an AI system on the EU market regardless of where they are based, and it catches providers and deployers in third countries where the output of the system is used in the EU. A London software vendor with EU customers, or a UK recruiter screening applicants for an EU entity, is in scope. A UK organisation whose AI never touches the EU market is not — but it still answers to UK GDPR and to its own sector regulator.

What has applied since 2 August 2026?

Three blocks. Article 50 imposes transparency: a chatbot must disclose that it is an AI, and synthetic content must be identifiable as such. The penalty regime in Chapter XII became fully operational. Finally, the European AI Office and the national market surveillance authorities gained their enforcement powers. One exception: the machine-readable marking required by Article 50(2) has until 2 December 2026 for systems already placed on the market before 2 August 2026.

What penalties does an organisation face?

The regulation sets three tiers, and the higher of the two figures applies in each. Prohibited practices under Article 5 carry up to EUR 35 million or 7% of worldwide annual turnover. Most other breaches, including Article 50, carry up to EUR 15 million or 3%. Supplying inaccurate information to authorities carries up to EUR 7.5 million or 1%. The digital omnibus introduced stronger proportionality for SMEs and small mid-caps.

Is my system covered by the deferral to December 2027?

Only if it falls under Annex III and operates as a standalone system. Annex III covers biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and the administration of justice. A CV screening tool sits in the employment category. If the system is instead embedded in a product already regulated under EU product-safety law, such as a medical device, the deadline is 2 August 2028.

Does the UK have an equivalent to the AI Act?

No. The UK has no cross-cutting AI statute. It regulates AI through existing bodies applying existing law to their own sectors — the ICO for personal data, the FCA for financial services, the MHRA for medical devices, Ofcom for online safety, the CMA for competition. The ICO has made an AI and automated decision-making code of practice one of its priorities. The practical consequence is that a UK organisation has no single deadline to plan around, and no single regulator to satisfy.

Should we slow down our compliance programme?

No, for a practical rather than a legal reason. The deferred obligations concern training data governance, technical documentation, logging and human oversight. These are decided when the system is designed, not afterwards. Retrofitting them onto a system already in production costs far more than building them in from the start. The deferral buys design time, not exemption.

Full guide — This article complements our reference guide to the European regulation: AI Act: what businesses need to know in 2026.