Executive summary
2 Dec 2027
stand-alone high-risk duties (Annex III) now apply, moved from 2 August 2026
2 Aug 2028
high-risk duties for AI inside regulated products (Annex I), moved a year
2 Aug 2026
transparency duties under Article 50 applied on schedule; the Omnibus did not move them
€35m / 7%
maximum fine for a prohibited practice, whichever is greater
Key conclusions
- Only the high-risk duties moved. The prohibitions, AI literacy, general-purpose AI rules, penalties and Article 50 transparency all already apply.
- The Omnibus also added obligations: a new prohibition on generating non-consensual intimate imagery and child sexual abuse material, from 2 December 2026.
- The Act reaches outside the EU. A Singapore provider placing a system on the EU market, or whose system's output is used in the EU, is in scope.
- About thirteen months remain to the Annex III date, which is not long to build a management system and take it through certification. Operators should use the delay to prepare.
In July 2026 the EU published Regulation (EU) 2026/1744, the Digital Omnibus on AI, and it entered into force on 27 July [2][5]. Its best-known effect was to push back the deadlines for high-risk AI systems: by sixteen months for stand-alone systems and by a year for AI built into regulated products [4]. The reason given was that the harmonised standards those duties depend on were not ready [4].
The press widely reported this as a delay to the AI Act, which is only partly accurate. The Act has applied in stages since February 2025, and the Omnibus left unchanged the stages that reach the most organisations. An operator who read the headline and paused its AI governance work has misread its own exposure.
Most obligations already apply; the high-risk dates fall in 2027 and 2028
The Act's application dates after the Omnibus. Filled stops have passed; hollow ones are still ahead as of this article's date.
1 Aug 2024
The AI Act, Regulation (EU) 2024/1689, enters into force [1]
2 Feb 2025
Prohibited practices banned; AI literacy duty applies [2]
2 Aug 2025
General-purpose AI model obligations apply, with the penalty regime [2][6]
27 Jul 2026
Digital Omnibus, Regulation (EU) 2026/1744, enters into force [2][5]
2 Aug 2026
Article 50 transparency duties apply, and the AI Office's enforcement powers [2]
2 Dec 2026
New prohibitions apply; watermarking grace ends for systems already on the market [2]
2 Aug 2027
General-purpose AI models already on the market must comply; national sandboxes due [2][8]
2 Dec 2027
High-risk duties apply to stand-alone systems in Annex III [2][4]
2 Aug 2028
High-risk duties apply to AI in products covered by Annex I [2][4]
2 Aug 2030
High-risk systems intended for public authorities must comply [2][8]
The Omnibus moved only the high-risk deadlines
The obligations most operators will meet, with their dates before and after the Omnibus:
| Obligation | Applies from | Moved by the Omnibus? |
|---|---|---|
| Prohibited practices (Article 5) | 2 February 2025 | No. Two new prohibitions added from 2 December 2026 [2] |
| AI literacy (Article 4) | 2 February 2025 | Date unchanged; the duty softened from ensuring staff competence to supporting it [2][3] |
| General-purpose AI model obligations | 2 August 2025 | No [2][3] |
| Transparency: disclosing AI interaction and deepfakes (Article 50) | 2 August 2026 | No. Watermarking gets a grace period to 2 December 2026 for systems already on the market [2][3] |
| High-risk, stand-alone systems (Annex III) | 2 December 2027 | Yes, from 2 August 2026 [4] |
| High-risk, AI in regulated products (Annex I) | 2 August 2028 | Yes, from 2 August 2027 [4] |
| High-risk, systems for public authorities | 2 August 2030 | Yes, from 2 August 2026 [2] |
The Omnibus also added obligations, some of which apply before the high-risk dates
Several of these changes take effect before the high-risk dates:
- A new prohibition: Article 5 now bans AI systems that generate non-consensual intimate imagery or child sexual abuse material, including systems where that output is a foreseeable result without reasonable safeguards. It applies from 2 December 2026, with no exemption for systems already on the market [2][3].
- Registration still applies: a provider relying on the Article 6(3) exemption from the high-risk category must still register the system, through a simplified procedure. A proposal to drop that requirement was rejected [2].
- Relief for smaller firms: exemptions that already applied to SMEs now extend to small mid-cap companies, with lighter documentation and more flexible post-market monitoring [2].
- A wider legal basis for bias testing: processing special-category personal data to detect and correct bias is allowed beyond high-risk providers, under a strict-necessity test [2][3].
- A central sandbox: the AI Office will run an EU-level regulatory sandbox, with priority access for SMEs, start-ups and small mid-caps; national sandboxes are now due by 2 August 2027 [2].
The Act reaches operators outside the EU in two ways
Article 2 sets out two routes. First, it applies the Act to any provider that places an AI system or general-purpose model on the EU market, wherever that provider is established. Second, it applies to providers and deployers located outside the EU where the output of their AI system is used in the EU [7].
For a Singapore firm, the first route catches equipment and software sold into Europe. The second is less obvious: a system run from Singapore whose decisions, scores or generated content are used by a European customer or affect people in the EU can be in scope without anything being shipped. Settle the question for each system by asking where its output is used. Where the company is registered does not decide it.
AI in machinery will now follow the machinery regime
For an industrial operator the most consequential change is easy to miss. The Omnibus moved the Machinery Regulation into Section B of Annex I, so AI built into machinery will follow the sectoral machinery regime rather than the AI Act's own high-risk conformity route. The Commission is to set the AI-specific health and safety requirements through delegated acts [2]. It also narrowed what counts as a safety component: an AI function that only assists a user or optimises performance is no longer high-risk by default, unless its failure creates a health or safety risk [2][3].
Two cautions follow. First, the delegated acts were not yet published when this was written, so the detailed requirements for AI in machinery are still open. Second, the narrower definition depends on a judgement about failure modes. A buyer of AI-enabled equipment should ask the vendor to put that analysis in writing. Annex I systems now have until 2 August 2028 [4].
Five steps to take in the thirteen months before the Annex III date
The Annex III date is about thirteen months away. In that time:
- Inventory every AI system, including those inside bought software, and record where each one's output is used. That settles both the Article 2 question and which deadline applies.
- Check every system against Article 5 now, including the prohibitions that start on 2 December 2026. These are already in force or close to it, and they carry the highest fines.
- Comply with Article 50 now. If a system talks to people or generates content, the disclosure duties already apply.
- Classify against Annex III and Annex I, and write down the reasoning for any system you treat as outside them. That written reasoning is what an authority will ask for.
- Build the quality management system Article 17 requires. ISO/IEC 42001 is a sound base for it, though not a substitute on its own [9]. Start now: certification runs through two external audit stages, and the system has to be operating before the first.
Operators should use the added time to build and certify a management system
The Omnibus gave high-risk providers more time because the standards they need were late. The obligations themselves did not get lighter. The duties that reach the most organisations (the prohibitions, transparency, AI literacy and the general-purpose model rules) already apply, and new ones arrive in December. Thirteen months is not long to set up a management system and take it through certification, so organisations should spend the added time on that work.
