The EU AI Act after the Digital Omnibus: what applies now, and what moved

In short: the EU AI Act’s prohibitions have applied since February 2, 2025 and its general-purpose model rules since August 2, 2025. The Article 50 transparency duties apply from August 2, 2026, with content marking for generative systems already on the market due by December 2, 2026, the date a new prohibition on non-consensual intimate imagery also applies. The 2026 Digital Omnibus moved the high-risk obligations to December 2, 2027 for Annex III uses and to August 2, 2028 for AI in regulated products.^1,2,3

Regulation (EU) 2024/1689, the AI Act, has applied in stages since it entered into force on August 1, 2024.¹ In July 2026 the European Union changed the schedule. The “Digital Omnibus on AI,” Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026.^2,3 For most organizations the headline is relief on high-risk systems. The fine print is that three sets of obligations did not move at all.

This briefing sets out what applies today, what was deferred, and the short list of work a deployer should be doing this quarter. It is educational, not legal advice: check the Official Journal and your counsel before you rely on any date.

Who is in scope

The Act reaches further than Europe. It applies to providers that place AI systems on the EU market, to deployers established in the EU, and to providers and deployers outside the EU whose system output is used in the EU. A US company whose AI-generated decisions, content or recommendations reach EU customers or employees can be in scope without an EU office.¹

The Act separates providers (who develop a system, or have one developed, and place it on the market under their name) from deployers (who use a system under their authority). Most organizations are deployers, and deployers carry real obligations.¹

What did not move

• Prohibited practices have applied since February 2, 2025. They include social scoring, by public or private actors, that leads to detrimental or unjustified treatment, certain manipulative or exploitative techniques, untargeted scraping of facial images, emotion recognition in workplaces and schools (with narrow exceptions) and certain biometric categorization.¹ The Omnibus adds a prohibition, from December 2, 2026, on systems that generate or manipulate non-consensual intimate imagery or child sexual abuse material.^2,4
• General-purpose AI model obligations (documentation, copyright policies, training-data summaries, and more for models with systemic risk) have applied since August 2, 2025.^1,5 Our briefing on what to ask general-purpose model providers lists the documents a deployer can request.
• Article 50 transparency duties apply from August 2, 2026: people must be told when they are interacting with an AI system, synthetic content must be marked as machine-generated, and deepfakes and AI-generated text on matters of public interest must be disclosed.¹ Generative AI systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the content-marking duty.²

What moved

The original Act applied most high-risk obligations from August 2, 2026. The Omnibus defers the stand-alone Annex III high-risk obligations (biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit, insurance and benefits, law enforcement, migration and the administration of justice) to December 2, 2027.^2,4,6 Obligations for AI embedded in regulated products under Annex I move to August 2, 2028.^2,3 The June provisional agreement set out these dates before the final text was adopted.

For any high-risk system placed on the market before its application date, the obligations apply only if its design changes significantly after that date. Article 111(2) speaks of “significant changes in their designs,” which is not the Act’s defined term “substantial modification.” High-risk systems intended for use by public authorities must comply by August 2, 2030 in any case.²

The amendments also move the deadline for national regulatory sandboxes to August 2, 2027, create a category of small mid-cap enterprises with lighter documentation duties and capped fines, and soften the Article 4 AI-literacy duty from ensuring a sufficient level of literacy among staff to taking measures to support it.^2,4 Penalties remain substantial: up to 35 million euros or 7 percent of global turnover for prohibited practices.¹

What a deployer of a high-risk system will owe

When the deferred dates arrive, deployers of high-risk systems must use them according to the provider’s instructions, assign competent human oversight, monitor operation, keep logs, inform affected workers and, in many public and essential-service contexts, carry out a fundamental-rights impact assessment. Providers carry the heavier load: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and conformity assessment.¹

The work for this quarter

1. Classify every system in your AI inventory against the prohibited list and Annex III, and record the reasoning.
2. For anything that may be high risk, identify the provider, obtain its instructions and documentation, and plan oversight, logging and any impact assessment against the 2027 date.
3. Prepare Article 50 disclosures now. The Omnibus left their timetable in place.
4. Put every date in a compliance calendar (the IAIM regulatory calendar lists them) and name one owner to watch the Official Journal.

A practical first step: add two columns to your inventory, “EU reach” and “AI Act tier,” fill them with your best reasoning, and flag the uncertain rows for counsel. Keep in mind that the deferral covers the high-risk obligations only; plan the transparency work to its existing dates. The AI regulation guide sets these dates beside the US rules, which our state-by-state briefing covers in detail.