In spring 2026 uncertainty was high. The EU was negotiating the Digital Omnibus, and many companies read it as a pause for the AI Act. It is now clear what has changed and what has not.
The Omnibus Regulation
After the agreement on 7 May 2026, Parliament (16 June) and Council (29 June) approved it. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July and has applied since 27 July 2026R. Above all, it postpones the duties for high-risk systems. No duty was deleted.
The timeline
| Date | What applies |
|---|---|
| 1 Aug 2024 | AI Act in force |
| 2 Feb 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) |
| 2 Aug 2025 | Duties for providers of general-purpose AI |
| 27 Jul 2026 | Omnibus in force, Art. 4 rewritten |
| 2 Aug 2026 | Transparency duties under Art. 50 |
| 2 Dec 2026 | End of the labelling grace period for existing systems, two new prohibitions |
| 2 Dec 2027 | High-risk systems under Annex III, such as HR, credit, education |
| 2 Aug 2028 | High-risk systems under Annex I, in regulated products |
What this means for most companies
AI literacy (Art. 4): The duty has applied since February 2025. The new wording requires measures to promote AI literacy, not a guaranteed level per person. Commentary on the new wording is still divided. Documented training is the safe route.
Transparency (Art. 50): Since 2 August 2026, people must be able to tell when they are interacting with an AI system, such as a chatbot. Labelling duties apply to certain generated content.
Data protection: The AI Act does not replace the GDPR. Germany's Data Protection Conference published guidance in 2024. The key points: the company is the controller, needs a data processing agreement, should prefer tools that do not train on inputs, write internal policies and check whether a data protection impact assessment is needed.
The workflow: governance in seven steps
- 01StartAI inventory: which systems do we use for what?
- 02CheckProhibited practice or high-risk under Annex III?yes: legal review, plan for 2 Dec 2026 and 2 Dec 2027
- 03SystemCheck data processing agreements
- 04SystemWrite an AI policy
- 05PersonRun and document training
- 06SystemAdd transparency notices under Art. 50
- 07ResultReview every six months
Limits and risks
- False security: "Omnibus means pause" is wrong. Literacy, transparency and prohibitions already apply.
- High-risk underestimated: If you support HR or credit decisions with AI, plan now. The time until December 2027 is short for documentation and oversight.
- No legal advice: This article provides orientation. Individual cases need legal review.
How to start
- Create an AI inventory: system, purpose, data types, vendor, responsible person.
- Flag everything that touches personnel decisions, credit or education.
- Check each tool's data processing agreement and use of inputs for training.
- Plan training for everyone who uses AI and record attendance.
Sources
- RRegulation (EU) 2024/1689 (AI Act)
- RCloud Security Alliance: EU AI Act's High-Risk Deadline: Deferred, Not Cancelled
- RGibson Dunn: EU AI Act Omnibus Agreement, Postponed High-Risk Deadlines
- RLaw and Technology: AI literacy, the Digital Omnibus rewrites Article 4 of the AI Act
- RGerman Data Protection Conference (DSK): Guidance on AI and data protection, 6 May 2024