EU AI Act Digital Omnibus Delay: What Applies Now and What Moved to 2027 and 2028

The Digital Omnibus is adopted law, not a proposal

Many internal compliance plans still treat the Digital Omnibus as a pending proposal. That is out of date. The Commission proposed it on 19 November 2025, citing delays in standards for the high-risk rules and in designating national competent authorities and conformity assessment bodies. Council and Parliament reached political agreement on 7 May 2026. Regulation (EU) 2026/1744 is dated 8 July 2026 and entered into force on 27 July 2026. It amends the AI Act (Regulation (EU) 2024/1689) as well as Regulations (EU) 2018/1139 and (EU) 2023/1230, and a consolidated AI Act text dated 27 July 2026 now exists.

The Commission's original proposal tied the high-risk application date to the availability of standards and support tools, with a delay of up to 16 months. The adopted outcome replaced that trigger with fixed dates. The Commission has said that delayed standards put the original 2 August 2026 date for the high-risk rules in jeopardy. Neither the original date nor the standards-linked trigger should appear in a current plan.

Obligations by category: status, Omnibus effect, operational implication

The table below separates what already applies from what has a fixed future date. Where a term comes only from the May 2026 political agreement, it is labelled that way.

• Governance and penalties: Status: applying since 2 August 2025. Omnibus effect: the delay concerns high-risk dates, so these dates stand. Implication: the enforcement framework is live, so assign accountable owners now.
• General-purpose AI model provider obligations: Status: applying since 2 August 2025. Omnibus effect: none to these dates. Implication: these are provider duties, not deployer duties. Enterprises that build on third-party models should track upstream compliance and record which models they depend on.
• Prohibition 9: Status: comes into effect in December 2026. Omnibus effect: introduced as part of the AI Omnibus. Implication: screen current and planned use cases against it before the date and record the outcome.
• AI literacy: Status: the consolidated text requires providers and deployers to take measures to support the AI literacy of staff and others operating or using AI systems on their behalf. Implication: document training tailored to role, experience and context of use.
• Generated-content transparency: Status: the 7 May 2026 political agreement cut the grace period for transparency solutions for artificially generated content from 6 to 3 months, with a new deadline of 2 December 2026. Implication: treat it as a near-term checkpoint.
• High-risk systems: Status: 2 December 2027 for Annex III, 2 August 2028 for systems embedded in Annex I products. Omnibus effect: fixed dates replaced the standards-linked delay. Implication: set readiness targets against these dates and start building evidence now.

Plan against the fixed dates, and keep the legal record current

The Omnibus shows that application dates in this regulation can change. Two practices follow. First, keep the legal status in the compliance file: Regulation (EU) 2026/1744, in force 27 July 2026. This stops teams planning against the withdrawn proposal or the original 2 August 2026 date. Second, separate adopted law and the consolidated text from provisional-agreement terms and Commission FAQs when reporting to boards or regulators. The national AI regulatory sandbox date of 2 August 2027, for example, is a term from the May 2026 political agreement and should be labelled that way.

The delay also does not make the high-risk dates distant in engineering terms. Oversight interfaces, record-keeping and deployer processes take time to design and test. Teams that treat 2 December 2027 as a design deadline rather than a legal horizon will have room to adjust if guidance or further amendments arrive.

What to operationalize now: oversight, records and evidence

The consolidated text requires high-risk AI systems to be designed and developed, including with appropriate human-machine interface tools, so that natural persons can effectively oversee them while in use. That is an architectural requirement. Oversight needs intervention points inside the system, not only a written procedure. The recitals add that deployers should take technical and organisational measures to use high-risk systems according to their instructions of use, with monitoring of functioning and record-keeping as appropriate.

These requirements point to the same practice: capture what the system was allowed to do and what it did, at the point of execution. Policy decisions and system-level records generated in the execution path are stronger evidence than records reconstructed afterwards. Map each record type to the AI Act provision it supports, so the same evidence can be reused as the 2027 and 2028 dates arrive.

For AI literacy, evidence means documented, role-specific training that is kept current. For general-purpose AI models, it means a supplier register and a way to verify upstream provider compliance, including incident reporting by providers as described in Commission guidance.

Where runtime policy enforcement fits

Trussed enforces policy in the execution path of models, agents, tools and MCP servers: allow, redact, block, rate limit, or escalate for human approval, at the level of individual interactions and tool calls. Enforcement is at runtime, not reviewed after the fact, and it generates audit-ready evidence mapped to the EU AI Act. That supports the oversight and record-keeping practices above, both for obligations that apply now and for systems as they come into scope. It can be deployed self-managed in the customer cloud, with configurable retention and data residency.

It does not replace the obligation register, AI literacy programme or supplier verification described here, and it does not address model provenance or end-to-end tracing of agentic workflows. Those remain separate work for the compliance team.