Digital Omnibus and the EU AI Act: What Small Insurers and Fintechs Actually Get

What changed, and when

The Commission proposed the AI Omnibus on 19 November 2025. Parliament adopted its negotiating position in March 2026, and Council and Parliament reached a political agreement on 7 May 2026. The regulation is dated 8 July 2026 and entered into force on 27 July 2026. It amends Regulation (EU) 2024/1689, the AI Act, along with two other regulations.

The most consequential change for planning is the timeline. The original high-risk application date was 2 August 2026, and it was at risk because supporting standards were delayed. The Commission's original proposal tied the date to the availability of support measures such as harmonised standards, common specifications or guidelines, which the Council described as an adjustment of up to 16 months. The final regime does not use that floating mechanism. It sets fixed dates instead: 2 December 2027 for stand-alone high-risk systems in the Annex III use cases, and 2 August 2028 for high-risk systems embedded in products.

For a compliance team, fixed dates are easier to plan against than a date that depends on standards being published. They also remove the argument for waiting to see whether the timeline moves again.

Relief and retained obligations at a glance

The table separates what the Omnibus is described as changing from what the AI Act already requires of high-risk systems. Where the Commission's proposal contained an element that has not been confirmed in the final text, it is labelled as proposed.

• High-risk timeline: Changed: fixed dates of 2 December 2027 (Annex III) and 2 August 2028 (embedded in products). Not relief from the obligations themselves.
• SME and small mid-cap simplification: Changed: certain SME simplifications, including simplified technical documentation, extend to small mid-caps. Small and micro-enterprises already had a special regime.
• Registration and post-market monitoring: Proposed by the Commission: easier registration and more flexibility in post-market monitoring. Confirm the final wording before relying on either.
• Bias detection: Proposed: processing of special categories of personal data for bias detection and correction.
• Deployer use and monitoring: Baseline in the AI Act: use per instructions of use, monitoring of functioning, and record-keeping as appropriate. Not described as changed.
• Human oversight: Baseline in the AI Act: effective oversight while in use, with competent, trained and authorised people. Not described as changed.

Does being small exempt you from high-risk requirements?

No evidence points that way. The relief identified is simplification, chiefly of technical documentation, for SMEs and now for small mid-caps. The Commission's proposal text described the small mid-cap changes as targeted, with minimal change to the scope of the obligations. The Council described the overall package as reducing requirements in a very limited number of cases, which indicates the core high-risk framework was not rewritten.

The practical consequence is that a smaller insurer or fintech should first establish which category it falls into, since any simplification depends on qualifying as an SME or small mid-cap under the amended regulation's definitions. It should then treat that status as a way to reduce documentation effort, not as a reason to skip high-risk preparation.

The second question is whether a given AI use is high-risk at all. Firms using AI for purposes such as life and health insurance risk assessment and pricing, or creditworthiness scoring, should classify each use case against Annex III in the regulation text. That classification decides which deadline applies, and it should be documented per use case rather than assumed at the portfolio level.

What stays the same: evidence, oversight and record-keeping

The AI Act text frames deployer duties around technical and organisational measures to use high-risk systems per their instructions, monitoring their functioning and keeping records as appropriate. It also requires high-risk systems to be designed so that natural persons can effectively oversee them while in use, with suitable human-machine interface tools. People assigned to oversight need competence, including an adequate level of AI literacy, training and authority.

These duties sit in the original regulation. The Omnibus is described as changing timelines, small mid-cap extensions, registration and post-market monitoring flexibility, and bias-detection data processing. It is not described as relaxing logging or human oversight design requirements.

A reasonable inference follows. If a firm must show monitoring, record-keeping and effective oversight, it needs a retrievable record of what the AI did and who intervened, for each high-risk decision. It also needs defined points where a person can review, approve or stop an output or action. That requirement does not depend on whether the date is 2027 or 2028, and it matches what supervisors already expect from model risk management: demonstrable evidence rather than assertions about intended behaviour.

Where runtime control fits, and where Trussed does

Documentation can be completed late and revised. A record of what an AI system was allowed to do and what it did cannot be reconstructed afterward if it was never captured. That is why runtime control is the one workstream that does not depend on how the legislative timeline moves.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. It can allow, redact, block, rate limit or escalate an individual interaction or tool call for human approval. Policy is enforced at runtime, not reviewed after the fact, and the enforcement generates audit-ready evidence mapped to the EU AI Act, along with NAIC, NYDFS, HIPAA and NIST. It can be deployed self-managed in the customer cloud, with configurable retention and data residency.

Insurance is the regulated financial sector where Trussed is deepest. Trussed does not classify use cases against Annex III or determine SME status, and it does not replace the oversight roles and documentation a firm must maintain. It supplies the enforcement and evidence layer for individual interactions and tool calls.