The Digital Omnibus on AI, Regulation (EU) 2026/1744, became law on 27 July 2026. It moves the high-risk rules for Annex III systems (hiring, credit, education and similar uses) to 2 December 2027 and the rules for AI in regulated products to 2 August 2028. Article 50 transparency did not move: it has applied since 2 August 2026.
Updated 13 November 2026. Many teams still plan against the original AI Act calendar, where almost everything landed on 2 August 2026. That calendar is gone. This post sets out the dates now in force, checked against the Official Journal texts of the AI Act (Regulation 2024/1689) and the Digital Omnibus on AI (Regulation 2026/1744). It also covers what did not move and what an engineering team should do in each window. It is an engineering guide, not legal advice.
Has the EU AI Act Digital Omnibus been adopted?
Yes. Regulation (EU) 2026/1744 was signed in Strasbourg on 8 July 2026 and published in the Official Journal on 24 July 2026. Under its Article 4 it entered into force on the third day after publication, which was 27 July 2026. It is directly applicable in every Member State, and no national law is needed to make it bite.
The Omnibus is an amending act. It does not replace the AI Act. It rewrites specific articles: the application dates in Article 113, the transitional rules in Article 111, AI literacy in Article 4, parts of the penalties in Article 99, and the AI Office's supervisory powers in Article 75. Anything it does not touch still applies as written in 2024. The K&L Gates summary in the National Law Review confirms the same publication and entry-into-force dates.
What are the new EU AI Act deadlines after the Digital Omnibus?
There are two new big dates. Annex III high-risk obligations now apply from 2 December 2027, and Annex I (AI inside products covered by EU product law) from 2 August 2028. There is also a smaller date, 2 December 2026, for two new prohibitions and a marking grace period. The full calendar now looks like this:
| Date | What applies | Legal basis | Changed by Omnibus? |
|---|---|---|---|
| 2 Feb 2025 | Prohibited practices (Art. 5), definitions, AI literacy | Art. 113(a) | No (literacy duty reworded from 27 Jul 2026) |
| 2 Aug 2025 | General-purpose AI (GPAI) model obligations, governance, penalties chapter | Art. 113(b) | No |
| 2 Aug 2026 | General application, including Art. 50 transparency | Art. 113 | No |
| 27 Jul 2026 | Omnibus in force; new Art. 4 AI literacy wording | Reg. 2026/1744 Art. 4 | New |
| 2 Dec 2026 | New prohibitions on non-consensual intimate imagery and CSAM; Art. 50(2) marking deadline for generative systems already on the market before 2 Aug 2026 | Art. 113(a), new Art. 111(4) | New |
| 2 Aug 2027 | At least one national AI regulatory sandbox operational per Member State | Art. 57 | Moved later |
| 2 Dec 2027 | High-risk rules for Art. 6(2) / Annex III systems | Art. 113(c) | Moved from 2 Aug 2026 |
| 2 Aug 2028 | High-risk rules for Art. 6(1) / Annex I systems | Art. 113(c) | Moved from 2 Aug 2027 |
| 2 Aug 2030 | Legacy high-risk systems used by public authorities | Art. 111(2) | Kept |
The high-risk move covers Chapter III, Sections 1 to 3: classification, the requirements in Articles 8 to 15 (risk management, data governance, logging, human oversight, accuracy and robustness), and provider and deployer obligations. Article 6(5), the Commission's duty to publish classification guidelines, is excluded from that shift.
Which EU AI Act obligations did not move?
Article 50 transparency, the GPAI model rules and the original prohibitions did not move. If you run a chatbot, an AI agent that talks to people, or a system that generates synthetic content, your obligations have applied since 2 August 2026.
Article 50 is live
Article 50 requires providers to tell people they are dealing with an AI system unless it is obvious. Providers of generative systems must mark output as AI-generated in a machine-readable way. Deployers must disclose deepfakes and AI-generated text published on matters of public interest. The only Omnibus change to timing is the new Article 111(4). Generative systems placed on the market before 2 August 2026 get until 2 December 2026 to meet the machine-readable marking duty in Article 50(2). Recital 38 calls this a four-month transitional period. It does not cover the disclosure duties in Article 50(1), (3) or (4).
The Commission published its Article 50 guidelines in July 2026 and found the Code of Practice on marking and labelling adequate on 8 July 2026. Our Article 50 developer checklist walks through both, including what the guidelines expect from AI agents.
GPAI model rules are on the original clock
Providers of general-purpose AI models have had obligations since 2 August 2025. Models placed on the market before that date have until 2 August 2027 (Article 111(3), unchanged). The Commission's power to fine GPAI providers has applied since 2 August 2026. The Omnibus did not delay any of this.
Prohibitions and literacy still bite
The Article 5 prohibitions (social scoring, certain manipulative systems, untargeted facial scraping and others) have applied since 2 February 2025, with fines up to EUR 35 million or 7% of worldwide turnover. The Omnibus added to this list rather than delaying it.
What changed in AI literacy under Article 4?
The duty was softened but not removed. Since 27 July 2026, providers and deployers must take measures to support AI literacy among staff and others who operate AI on their behalf, rather than ensure a sufficient level of literacy. In practice, keep the training you built in 2025. Make sure it is documented per role, and pay special attention to anyone assigned to human oversight.
The softer wording does not help much in practice. Article 26(2) still requires deployers of high-risk systems to assign oversight to people with the necessary competence, training and authority. From December 2027 that becomes an auditable control for Annex III systems.
Does the high-risk delay mean we can stop compliance work until 2027?
No. The delay gives you time to build the controls properly, not a reason to skip them. Articles 9 to 15 describe engineering work: logging, data governance, human oversight design, accuracy testing, technical documentation. That work takes 6 to 12 months to do properly inside a live product, and customers' procurement teams are already asking for it.
Three practical reasons to keep going:
- Your customers have their own deadlines. A bank or an HR platform deploying your system as a high-risk deployer from 2 December 2027 will want documentation, logs and oversight hooks from you in 2027 contracts, and that means 2026 roadmaps.
- The design-change trap. Under Article 111(2), a system already on the market before the application date is only caught if it later goes through significant design changes. Major model swaps and new features after December 2027 can pull a legacy system into scope, so the cheap path is to build the controls in now.
- The date is fixed in law, but the standards are not finished. The harmonised standards that give a presumption of conformity are still being finalised. Teams that wait for them will have very little time once they are published.
If you sell into the EU from outside it, the rules still apply when your system's output is used in the EU. That is the same logic Vietnam used in its own law. See our Vietnam AI law guide if you build in both markets.
What did the Omnibus change for SMEs and small mid-caps?
Small mid-cap enterprises (SMCs) now get the same fine treatment that SMEs and start-ups already had. Under the new Article 99(6a), each fine for an SMC is capped at whichever of the percentage or the fixed amount is lower, not higher. The SMC definition follows Commission Recommendation (EU) 2025/1099.
For a 200-person software company, the difference matters. A 3% of turnover cap on EUR 40 million revenue is EUR 1.2 million, well below the EUR 15 million fixed ceiling for most breaches. The obligations themselves are unchanged. Only the ceiling on penalties moves.
Who enforces the AI Act for products built on GPAI models?
The amended Article 75(1) makes the AI Office the exclusive supervisor for AI systems built on a general-purpose AI model when the same provider (or its group) develops both the model and the system. It also covers AI systems integrated into very large online platforms and search engines under the Digital Services Act. There are carve-outs for some Annex I and Annex III systems.
K&L Gates notes that the AI Office now has competition-style tools: information demands, inspections, binding commitments and periodic penalty payments of up to 5% of average daily turnover. For most companies that build on a third-party model API, nothing changes: national market surveillance authorities supervise you. If you are a model lab shipping your own assistant or agent product, your regulator is now Brussels.
What should engineering teams do before each deadline?
Work backwards from the dates that apply to you, and start with the ones already live. A simple plan:
- Now (Article 50 is live): confirm AI disclosure at first interaction for every chatbot and agent, including voice and email agents. Log that the disclosure was shown.
- By 2 December 2026: if you shipped a generative feature before August 2026, make sure its output carries machine-readable marking (the Code of Practice expects signed metadata, with C2PA a common choice, plus an imperceptible watermark), and check that you have no feature that could produce intimate imagery of real people.
- By mid-2027: classify every AI feature against Annex III. Write down why a feature is or is not high-risk. Article 6(3) lets you argue a feature is not high-risk, but you must document the reasoning.
- By 2 December 2027 (Annex III): risk management file, data governance records, automatic event logs, human oversight design with a working stop or override path, accuracy and robustness tests, technical documentation, a quality management system, registration, and a post-market monitoring plan.
- By 2 August 2028 (Annex I): the same for AI embedded in medical devices, machinery and other regulated products, run through the sectoral conformity assessment.
Most of the controls in steps 4 and 5 are the same ones you need for agent safety anyway. Our AI agent governance post covers ownership and policy, and human-in-the-loop design covers oversight that people actually use. For agent identity and kill switches, see our companion piece on AI agent control planes. If you also sell into the US, federal preemption vs state AI laws covers the other side of the Atlantic.
Could the EU AI Act dates move again?
They could, but only by another regulation, which takes months. As of 13 November 2026 the dates above are the law. Any further change would need a new Commission proposal, agreement by Parliament and Council, and publication in the Official Journal. Plan against the published dates and re-check them each quarter. We will update this post if anything changes.
How BeevR builds this
We build AI agents and AI features for companies in regulated industries, and we design for the EU calendar from the first sprint. In practice that means AI disclosure and audit events emitted by the agent runtime, not bolted onto the UI. It also means tool calls logged with who, what and why, human approval gates on actions that touch money or personal data, and a kill switch that works without a redeploy. We write the technical documentation as we go, so a deployer's compliance team gets it with the code.
BeevR is a senior, founder-led team in Hanoi. We work in fixed-scope, fixed-price phases from $10K, ship a working demo every Friday, and you own the source code and IP from day one. See how we approach AI development for regulated products.
Planning an EU launch or an audit of an existing AI feature? Book a 30-minute call and we will map your features against the 2026–2028 dates with you.