On 2 August 2026 the EU AI Act was supposed to hit its biggest cliff yet: full Chapter III obligations for high-risk AI systems. Six days earlier, on 27 July, Regulation (EU) 2026/1744 — the Digital Omnibus on AI — entered into force and moved that cliff. If you build, buy, or deploy AI for hiring, credit, education, biometrics, or product safety in Europe, the calendar you printed last year is wrong. The original AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 with a staggered rollout. Prohibitions and AI literacy kicked in on 2 February 2025. Rules for general-purpose AI models followed on 2 August 2025. High-risk systems were the next big wave, timed for 2 August 2026. The Commission’s own Digital Omnibus package, proposed on 19 November 2025, then peeled off an AI-only track so the delay could land before that date. What the Omnibus moved — and what it did not The Omnibus does not cancel high-risk rules. It splits them. Stand-alone high-risk systems under Article 6(2) and Annex III — biometrics, critical infrastructure, education, employment, essential services like credit scoring, law enforcement, migration, administration of justice — now apply from 2 December 2027. That is a 16-month deferral from the original August 2026 date. High-risk AI embedded as a safety component in products already covered by Union harmonisation law under Annex I — medical devices, toys, aviation equipment, and similar — moves to 2 August 2028. Member states get until 2 August 2027 to have at least one AI regulatory sandbox operational, instead of August 2026. Transparency duties under Article 50 are a different story. Chatbot disclosure and deepfake labelling for systems placed on the market from 2 August 2026 stayed on the original clock. Systems that generate synthetic audio, image, video, or text and were already on the market before that date get a grace period until 2 December 2026 for watermarking and machine-readable marking. GPAI model obligations that started in August 2025 stay in force. So “everything slipped” is the wrong takeaway. High-risk conformity assessments slipped. Labelling and disclosure mostly did not. Primary text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744 Consolidated Omnibus explorer: https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/ Why Brussels delayed it The recitals are unusually frank. Harmonised standards that providers were supposed to lean on were late. National governance and notified-body frameworks were not ready either. Stakeholder consultations asked for clearer, lighter implementation without lowering the level of protection the Act promises for health, safety, and fundamental rights. The Omnibus is the legislative answer to that gap: more time, clearer definitions, and some SME relief — not a political U-turn on regulating AI. Law firm summaries that track the same dates line up with the Official Journal text. White & Case’s 4 August 2026 note is a useful plain-English map of the deadline split, the watermarking grace period, and the expanded AI Office powers: https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act Definitions that actually matter in product meetings Two wording changes will show up in legal reviews more than the headline dates. First, “safety component” is narrower. An AI system used only for user assistance, performance optimisation, service efficiency, automation, convenience, or non-safety quality control is not automatically a safety component. Failure or malfunction that would endanger health and safety still pulls a system into that category. The practical effect: fewer productivity copilots get dragged into high-risk status just because they sit next to a regulated product. Second, AI literacy under Article 4 is softer. Providers and deployers must take measures to support AI literacy among staff and people who operate systems on their behalf. They are no longer required to guarantee a specific literacy level for every individual. The Commission and Member States are supposed to publish practical examples. Training still matters. The compliance risk profile is lower. New red lines for generative tools The Omnibus also expands Article 5 prohibitions. Placing on the market, putting into service, or using AI systems that generate or manipulate non-consensual intimate imagery of identifiable people, or child sexual abuse material, is banned — with a carefully drafted scope for when generation is the intended purpose or a reasonably foreseeable outcome without adequate safeguards. Those new bans apply from 2 December 2026. If you ship image or video models into the EU, content safeguards are no longer just a brand issue. Who watches whom The AI Office’s exclusive supervision now reaches further: AI systems built on GPAI models by the same provider or corporate group in many cases, and systems that constitute or are integrated into very large online platforms and search engines already designated under the Digital Services Act. GPAI providers and large platforms should treat governance as a Commission-facing problem, not only a national market-surveillance one. SMEs and small mid-cap enterprises get simplified technical documentation paths, more proportionate quality-management expectations, and mitigated penalty framing. Sandbox priority access stays. The paperwork burden is lighter. The substance of high-risk requirements when they finally apply is not gone. What this means if you ship software in Sweden or the rest of the EU If your roadmap assumed “high-risk ready by summer 2026,” you have breathing room on conformity assessment, technical documentation, and EU database registration for Annex III systems until December 2027. Use it. Standards and Commission guidance are still catching up; the Omnibus itself tells the Commission to request aligned standardisation deliverables and to publish post-market monitoring guidance by 2 September 2027. Do not treat the delay as a holiday from Article 50. If you launch a new generative system into the EU after 2 August 2026, expect labelling and disclosure obligations now. If your system was already on the market before that date, the watermarking clock runs to 2 December 2026. Inventory which systems are which. Also re-run risk classification with the new safety-component language. Some tools that compliance teams flagged as high-risk may fall out. Some that looked safe may still fail the health-and-safety test. Write that down. Public authorities get an even longer runway for high-risk systems they use: steps toward compliance by 2 August 2030 under the amended transitional rules. That matters for Swedish municipalities and agencies buying HR, benefits, or biometric tooling, but it does not freeze private-sector Annex III clocks. The uncomfortable open question Europe still wants trustworthy AI and a workable market for builders. The Omnibus bought time because the standards machinery was not ready. The next failure mode is obvious: December 2027 arrives, standards are still half-baked, and another political fight starts over another delay. Or the opposite happens — standards land, notified bodies scale, and the Act finally becomes operational law instead of a compliance rumour. If you run product or compliance for an EU-facing AI feature set, which bucket are you actually in today — Annex III stand-alone, Annex I embedded, GPAI, or “just” Article 50 transparency — and did your roadmap update after 27 July, or are you still sailing toward an August 2026 cliff that no longer exists?
![European Digital Identity [GO EUROPE]](https://avatars.githubusercontent.com/u/123750850?s=280&v=4)
