AI Act After the Digital Omnibus: New Deadlines, AI Literacy and Labelling Duties

TL;DR

Regulation (EU) 2026/1744 has been in force since July 27, 2026 and postpones the high-risk duties of the AI Act: for stand-alone systems under Annex III from August 2, 2026 to December 2, 2027, and for AI in regulated products (Annex I) to August 2, 2028.
Not postponed: the prohibitions (since February 2, 2025), the duties for general-purpose AI models (since August 2, 2025) and the Article 50 transparency duties, which have applied since August 2, 2026. Only the machine-readable marking for systems that were on the market before August 2, 2026 has until December 2, 2026.
AI literacy under Article 4 still applies: providers and deployers must take measures to promote it. What is new is that no specific level of competence has to be guaranteed, and the Commission and Member States support companies.
The postponement is a fixed date without a condition. If you clarify inventory, roles, risk classes, training and supplier contracts over the next twelve months as a deployer, you will not have to catch up in a rush in December 2027.

If you had August 2, 2026 in your calendar as the date for the high-risk duties of the AI Act, you can delete that entry. The AI part of the Digital Omnibus postponed the high-risk deadlines, but by no means all obligations. This article gives you the current state (October 2026), an overview of what already applies, and a twelve-month plan for companies that mostly use AI systems rather than build them.

If you are not yet familiar with the basics of the regulation, read AI Act and information security first. It covers the risk classes and the requirements for high-risk systems. The dates in that article are now outdated, so this text supplements them. This is not legal advice, so clarify borderline cases with your legal department or law firm.

What did the Digital Omnibus change in the AI Act?

The European Commission presented the proposal on November 19, 2025. Council and Parliament reached a political agreement on May 7, 2026, Parliament approved it on June 16, 2026, and the Council gave its final green light on June 29, 2026. The amending regulation is numbered (EU) 2026/1744 and has been in force since July 27, 2026. It amends the AI Act (Regulation (EU) 2024/1689) in several places, not just the deadlines.

Five changes matter for a company with 100 employees:

Deadlines for high-risk AI: The duties for high-risk systems apply later, on fixed dates instead of depending on whether standards and tools are ready in time.
Labelling AI-generated content: For systems that were already on the market before August 2, 2026, there is a transitional period for machine-readable marking.
AI literacy: Article 4 was reworded, see below.
New prohibitions: Systems that generate non-consensual intimate depictions of real people or child sexual abuse material are prohibited. This applies from December 2, 2026.
Relief for smaller companies: The SME relief, for example for documentation and for the setting of fines, now also covers small mid-caps, meaning companies just above the SME threshold. If you wonder whether you belong to this group, check the definition in the regulation text, because I do not state the thresholds here.

The AI Office, the Commission's supervisory body for AI, also gets extended powers, for example over systems built on an AI model from the same provider. For you as a deployer this changes little day to day, but it does for the providers of your AI tools.

AI Act deadlines 2027: The new timeline at a glance

The following table lays out the dates as they apply after the Omnibus. It replaces the timeline list in the older article.

Date	What applies	Status
February 2, 2025	Prohibited practices (Article 5) and AI literacy (Article 4)	applies
August 2, 2025	Duties for providers of general-purpose AI models (GPAI), governance rules	applies
August 2, 2026	General applicability of the AI Act, transparency duties under Article 50, AI Office power to fine GPAI providers	applies
December 2, 2026	Machine-readable marking for generative systems that were on the market before August 2, 2026; new prohibitions on intimate deepfakes and abuse material	upcoming
December 2, 2027	High-risk systems under Annex III (employment, creditworthiness, education, biometrics, critical infrastructure and more)	new, previously August 2, 2026
August 2, 2028	High-risk systems under Annex I (AI as a safety component in regulated products)	new, previously August 2, 2027

On sources: the European Commission names the dates December 2027 and August 2028 on its AI Act page and in its announcement of the Omnibus entering into force, and so does the Council. You occasionally read "end of 2028" for Annex I. That is imprecise, the date is August 2, 2028.

What is the difference between Annex III and Annex I?

Annex III lists areas of use in which an AI system counts as high-risk because it affects people. Two areas matter most for mid-sized companies: employment (candidate selection, performance evaluation, promotion, task allocation) and access to essential services such as creditworthiness checks.

Annex I covers AI that is a safety component in products already subject to EU harmonisation legislation, for example toys or medical devices. The Omnibus took machinery out of the direct application of the high-risk rules. AI in machinery is to be regulated through the Machinery Regulation, and the Commission has to adopt legal acts for this. If you build machines, that path matters more to you than the AI Act itself.

What stays unchanged: prohibitions, GPAI and transparency

Reading the headline "AI Act postponed", you might think everything is quiet until the end of 2027. That is only true for the high-risk duties. Three large blocks apply without delay.

Prohibited practices since February 2025

The prohibitions in Article 5 are unchanged and have applied since February 2, 2025. They include manipulative techniques, social scoring, untargeted scraping of facial images from the internet and emotion recognition in the workplace. The last item is the most common stumbling block for mid-sized companies: a video interview tool that infers emotions from facial expressions or voice is not "not yet regulated", it is prohibited. Fines for violations go up to EUR 35 million or 7 percent of worldwide annual turnover, and for SMEs the lower of the two amounts applies.

From December 2, 2026, the new prohibitions are added. They are aimed mainly at providers of image and video generators that fail to prevent their system from producing intimate depictions of real people without their consent. As a deployer, you check when selecting a generator whether the provider makes statements about this.

General-purpose AI models since August 2025

The duties for providers of GPAI models, for example the large language models, have applied since August 2, 2025. Since August 2, 2026, the AI Office can also impose fines for them. This matters to you indirectly: providers have to maintain technical documentation and give information to downstream providers. In your supplier assessment, ask what the provider makes available to you.

Transparency duties under Article 50 since August 2026

Article 50 was not postponed and has applied since August 2, 2026. It contains four duties that quickly become relevant in a company with 100 employees:

Duty	Who is obliged	What it means in practice
Disclose AI interaction	Providers	A chatbot on your website must show no later than the first interaction that the user is talking to an AI, unless it is obvious
Machine-readable marking	Providers of generative systems	Generated text, images, audio and video carry a machine-readable label
Emotion recognition and biometric categorisation	Deployers	Affected people must be informed
Deepfakes and AI text of public interest	Deployers	You label them, unless a human took editorial responsibility

The deepfake point also affects marketing and communications: you label AI-generated or AI-manipulated images, audio and video that look real as such. Depending on its effect, an AI-generated image for a social media post can fall under this. The same applies to AI-generated text you publish on matters of public interest if no human reviews it editorially and takes responsibility for it.

The machine-readable marking is the generator provider's job. The transitional period applies here: systems that were on the market before August 2, 2026 have to implement it by December 2, 2026, newer systems immediately. As a deployer, you do not rely on marketing promises but have the provider confirm in writing that and from when it implements the marking. For other violations of AI Act duties, which include Article 50, fines go up to EUR 15 million or 3 percent of worldwide annual turnover.

What changes for AI literacy under Article 4?

Article 4 has applied since February 2, 2025 and requires providers and deployers to make sure that their staff and other people working with AI systems on their behalf have AI literacy. This means the skills, knowledge and understanding needed to use AI systems competently.

The Omnibus changed the wording. Before, a company had to ensure "to their best extent" a sufficient level of AI literacy. Now Article 4 requires providers and deployers to take measures to promote the development of AI literacy. A company does not have to guarantee a specific level for individuals. There is also a new task for the Commission and the Member States: they are to support companies, especially SMEs, and the Commission publishes practical examples on the central information platform.

Accounts differ on this. Some write that the duty was abolished. That is not correct. The Commission's original proposal wanted to replace the company duty with a pure promotion task for the Commission and the Member States. In the end the company duty remained, but as a duty of effort rather than of result. In its announcement of the entry into force, the Commission itself speaks of lighter training requirements for companies.

What does that mean in practice? You still need proof that you are doing something:

a training or briefing on AI use for everyone who uses AI tools
a rule on who may use which tools, ideally in the AI usage policy
a record of who was trained and when

The effort depends on the knowledge, experience and context of use of your staff. Someone who uses Copilot for meeting notes needs a shorter briefing than the HR department running applicant management with AI pre-selection. You can build this into your existing security awareness programme instead of setting up a second training system. You keep the training records in the ISMS, as for other mandatory training.

Provider or deployer: Which role do you have?

The AI Act distinguishes mainly two roles. Providers develop an AI system and place it on the market or put it into service under their own name. Deployers use a system under their own authority in a professional context. Most mid-sized companies are deployers: they use Microsoft 365 Copilot, an applicant management system with AI functions, fraud detection in payments or a chat tool for writing.

The role is not fixed forever. A deployer becomes the provider of a high-risk system if they do one of the following three things:

Trigger	Example from a mid-sized company
They put their name or trademark on a high-risk system already on the market	A service provider sells a purchased applicant-scoring tool as its own product
They substantially modify a high-risk system	A department retrains a scoring model with its own data so that its effect changes
They change the intended purpose so that a system becomes high-risk	A general-purpose chatbot is used to pre-select job applications

The third example is the trickiest because it happens without intent. Nobody decided to "become a provider", the HR department just used an existing tool for a new task. This is exactly the case that belongs in the role clarification, and it shows why the purposes of use have to be in the inventory and not just the product names.

Another case: you build a customer chatbot on top of a language model interface, with your own system prompt and your own name. Then you are usually not only the deployer of the model but the provider of your chatbot, and the disclosure duty under Article 50 lies with you. Whether a particular setup is to be assessed this way is something you clarify with legal counsel.

What applies to deployers from December 2027?

For high-risk systems under Annex III, deployers face the following duties from December 2, 2027:

use the system in line with the provider's instructions for use
assign human oversight to people who have the competence, training, authority and support for it
check input data for relevance and representativeness, as far as you control it
monitor operation and inform the provider about risks and serious incidents
keep automatically generated logs, at least six months, unless other law requires something different
inform employees and their representatives before a high-risk system is used in the workplace
inform affected people that a high-risk system is being used

If you use applicant management with AI pre-selection, these are not abstract points. You need someone in HR who can understand and override the AI's results, a concept for keeping the logs, and information for the works council and applicants. Depending on the use, the data protection impact assessment is added.

Postponed does not mean cancelled

The delay is a gift to the providers of high-risk systems whose conformity assessment was not ready because harmonised standards are missing. It is not a free pass for deployers. There are four reasons to use the extra time.

The date is fixed. The Commission's original proposal wanted to tie the deadline to the availability of standards and tools. Council and Parliament chose fixed dates. There is no mechanism that postpones December 2, 2027 again just because standards are missing. Do not plan on a further delay.

Much already applies. Prohibitions, AI literacy and transparency duties are running. If you wait for December 2027 now, you already have a gap in these three areas.

Your suppliers need lead time. Providers of high-risk systems have to deliver conformity assessment, documentation and instructions for use. Contracts with three-year terms that you sign or renew today run past the deadline. What is not in them, you only get later with negotiation effort.

The inventory takes time. Most companies do not know which AI functions sit in which software. The inventory is not an afternoon task, and all other steps build on it.

One practical note to close this section: the postponement concerns European law. If your customers, for example in the automotive industry or the financial sector, already pass AI requirements on contractually, those apply regardless of the AI Act.

What do you need to do in the next 12 months?

The following plan assumes a deployer with around 100 employees that does not develop its own AI systems. It is split into three stages so that the order is right.

Stage 1 until end of 2026: Inventory and immediate duties

Create an AI inventory. You collect all AI systems used in the company from three sources: the software list from IT asset management, a survey of the departments, and a check for unapproved tools. For the latter, the article on shadow AI and Copilot governance helps, because the free accounts with chat services in particular appear on no procurement list. For each system you record: name, provider, purpose, department, processed data, number of users and contract status. In ISMS Lite you create AI systems as assets and link them to the service provider, the contract and the risks.

Rule out obvious prohibitions. You check whether any system evaluates the emotions of employees or applicants or categorises people biometrically by sensitive characteristics. If so, switch it off and document it.

Ensure transparency. You check where chatbots talk to customers, where AI-generated images, audio or video are published and where AI texts on public topics appear. Then you define the labelling. A short rule in the AI policy is enough, as long as someone implements it.

Plan training. You decide which groups get which briefing and run the first round before the end of this year.

Stage 2 until mid-2027: Roles, risk classes and contracts

Clarify roles. For each system in the inventory you record whether you are deployer or provider and check the three triggers from the table above.

Assign the risk class. You compare each system with the areas in Annex III: does the purpose of use fall into employment, creditworthiness, education, biometrics or one of the other areas? If so, it is a candidate for high-risk. If in doubt, you ask the provider how it classifies its system and get the classification in writing.

Update supplier contracts. In new contracts and at every renewal, you include the following points:

classification of the system under the AI Act and the role of the contracting parties
assurance of conformity and delivery of the instructions for use as soon as the duties apply
access to logs so that you can meet the retention duty
information about substantial changes to the system and its purpose
implementation of machine-readable marking for generative systems, with a date
use of your data to train the model: no, or only with your consent
duty to report incidents to you, with a deadline

For the assessment you use the security questionnaire you already use and extend it with the AI questions. In ISMS Lite you manage the service provider with contract, notice period and reassessment.

Stage 3 until end of 2027: Prepare the deployer duties

Oversight and logs. For each high-risk system you name the person who takes on human oversight and make sure they understand the results and are allowed to override them. You clarify with the provider how you get to the logs and where they are kept for at least six months.

Information. You prepare the notification of employees, works council and affected people.

Integrate into the ISMS. AI risks belong in the risk assessment of the ISMS and not in a parallel system. If you use AI permanently and broadly, a look at ISO 42001, the standard for AI management systems, is worthwhile, because it bundles many of these steps into a framework.

Checklist: AI Act after the Digital Omnibus

Right away (until end of 2026)

AI inventory created: name, provider, purpose, department, data, users, contract
Survey run in all departments, including free accounts
Emotion recognition and biometric categorisation ruled out or switched off
Customer chatbots made recognisable as AI
Rule set for labelling AI-generated images, video, audio and text
Written confirmation from providers on machine-readable marking obtained
AI training planned for all users, first round scheduled, attendance documented

Until mid-2027

Role per system defined (deployer or provider), the three triggers checked
Risk class per system documented, rationale for high-risk candidates
Providers asked about their own classification
Contract clauses for AI stored in procurement and contract management
Existing contracts running beyond December 2027 reviewed
AI risks added to the ISMS risk assessment

Until end of 2027

Oversight person named and briefed for each high-risk system
Access to logs clarified, retention of at least six months arranged
Information for employees, works council and affected people prepared
Data protection impact assessment checked for relevant systems
Inventory, roles and risk classes reviewed on a fixed cycle (at least yearly)

Common mistakes in dealing with the AI Act after the Omnibus

Applying the postponement to everything. Only the high-risk duties are postponed. Prohibitions, transparency and GPAI are running, and so is AI literacy. If you have "AI Act only in 2027" in mind, you miss the labelling that has applied since August.

Building the inventory only from the software list. Embedded AI functions and private accounts with chat services are not in procurement. Without a survey of the departments, the most interesting part is missing.

Setting the role once and forgetting it. A new purpose of use can turn a harmless tool into a high-risk system and make you a provider. The role clarification belongs in the approval process for every new use, not just in the inventory.

Relying on the provider's marketing claim. "AI Act ready" is not a declaration of conformity. Ask for the classification and the commitment on marking in writing, ideally in the contract.

Treating AI literacy as abolished. The duty is softened, not deleted. Without training and records you have nothing to show in an audit or after an incident. Training is also worthwhile without a legal duty: most everyday AI incidents are caused by data someone dumps into a tool.

Conclusion: Twelve months of lead time are not a reprieve

The Digital Omnibus stretched the timeline for high-risk systems, but prohibitions, transparency duties and AI literacy keep running. If you build the inventory as a deployer, clarify roles and risk classes and adapt supplier contracts at the next renewal, you will be in a calm position in December 2027. Start this week with the survey in the departments, because it provides the basis for everything else. If you do not want to keep the inventory in a spreadsheet, you can record the AI systems in ISMS Lite as assets and link them to service providers, risks and measures.