Where things stand — 18 August 2026: The Digital Omnibus is fully in force. There is no more "pending publication" or "expected around July." Regulation (EU) 2026/1744 defers the Annex III standalone high-risk deadline to 2 December 2027 and the Annex I embedded-product deadline to 2 August 2028 — both dates are now the binding law, not a forecast.
How the Deferral Became Law
The Digital Omnibus followed the full EU ordinary legislative procedure. The European Parliament voted in favour of its position on 26 March 2026 (569 votes), and Parliament and Council negotiators reached a provisional political agreement in trilogue on 7 May 2026. That was real progress, but a provisional trilogue agreement is not law — it still had to be formally adopted by both institutions and published before taking legal effect. That happened over the following months:
| Stage | Date |
|---|---|
| European Parliament first reading vote | 26 March 2026 |
| Trilogue provisional political agreement | 7 May 2026 |
| European Parliament formal adoption | 16 June 2026 |
| Council of the EU formal adoption | 29 June 2026 |
| Published in the Official Journal as Regulation (EU) 2026/1744 | 24 July 2026 |
| Entered into force | 27 July 2026 |
Entry into force is the legal trigger — not the vote, and not the trilogue agreement. Because that happened on 27 July 2026, ahead of the original 2 August 2026 date, the new deadlines took effect before the old ones would have lapsed, and the change was never retroactively needed.
What Actually Changed
| Obligation | Original Deadline | Confirmed New Deadline |
|---|---|---|
| Annex III standalone high-risk AI (employment, credit scoring, biometrics, education, law enforcement, critical infrastructure) | 2 August 2026 | 2 December 2027 |
| Annex I high-risk AI embedded in regulated products (medical devices, machinery, vehicles, aviation, lifts) | 2 August 2027 | 2 August 2028 |
| National AI regulatory sandboxes established | 2 August 2026 | 2 August 2027 |
Beyond the timeline, the confirmed text also narrows the "safety component" definition — AI that merely assists or optimises a product function, without itself creating a health or safety risk, is no longer automatically classified as high-risk — and introduces a new "small mid-cap" enterprise category (fewer than 750 employees, turnover up to €150 million) that gains access to simplified compliance tools and documentation templates, alongside the existing SME support measures.
What Did Not Change
The Omnibus is a targeted deferral, not a general pause on the EU AI Act. Three tracks were confirmed as unaffected:
| Obligation | Status |
|---|---|
| Article 5 prohibited AI practices | In force since 2 February 2025 — unchanged |
| GPAI model obligations (Chapter V) | In force since 2 August 2025 — unchanged |
| Article 50 transparency and watermarking | Applied on schedule from 2 August 2026 (grace period to 2 December 2026 for pre-existing systems) — not deferred. See our Article 50 guidelines explainer. |
| New prohibition on AI-generated CSAM and non-consensual intimate imagery | Applies from 2 December 2026 — not deferred |
Common mistake: treating "the deadline moved to 2027" as if the whole EU AI Act paused. It didn't. A business can be fully compliant on Article 50 disclosure and still be two years away from its Annex III high-risk obligations — these are separate tracks with separate, now-confirmed timelines.
Why "Confirmed" Matters More Than It Sounds
For over two months after the 7 May 2026 trilogue agreement, businesses and advisers were operating in a genuinely ambiguous window: the political direction was clear, but until formal adoption and Official Journal publication, 2 August 2026 remained the legally binding date. Any compliance plan built purely on the assumption that the deferral would happen — rather than on confirmation that it had — carried real risk if the legislative timeline had slipped. That risk is now closed. From 27 July 2026 onward, 2 December 2027 and 2 August 2028 are not forecasts; they are the dates written into EU law.
What to Do Now
- Update any internal compliance plan still dated against August 2026 for Annex III systems — the confirmed date is 2 December 2027, and planning against the wrong date wastes budget and creates false urgency in the wrong places.
- Don't confuse the confirmed deferral with permission to wait — a compliant high-risk AI system still takes 3-6 months to document properly, and enterprise buyers are already asking for EU AI Act compliance evidence ahead of the statutory date.
- Check whether you qualify for the new small mid-cap track if your business has under 750 employees and turnover under €150 million — the simplified tools may reduce your documentation burden.
- Keep Article 50 on a separate clock — those transparency and watermarking obligations are already in force and were never part of this deferral.
Aurora Trust tracks confirmed EU AI Act deadlines automatically — so your risk classification and documentation stay current as the regulation evolves, without you having to monitor the Official Journal yourself. Starting at €49/month.