For many organisations, 2 August 2026 had been in the diary for two years. That was the day most of the AI Act was due to apply, including the demanding obligations for high-risk AI systems. Then, a week before the deadline, the dates changed after all. On 27 July 2026, Regulation (EU) 2026/1744, better known as the Digital Omnibus on AI, entered into force. It pushes the high-risk deadlines back to late 2027 and 2028. The rest of the law took effect on 2 August as planned.
#Where the Digital Omnibus came from
The European Commission presented the proposal on 19 November 2025, as part of a wider package to simplify digital regulation. The reason was practical: many of the technical standards and guidance documents that providers needed to meet the high-risk requirements were not ready. Keeping the original date would have forced companies to comply with requirements whose details had not been settled.
The package was split into two tracks. The AI track is now law: the European Parliament voted in favour on 16 June 2026 and the Council followed on 29 June 2026. The regulation has been in force since 27 July 2026. The second track, which includes proposals affecting the GDPR and the cookie rules, is still before Parliament and the Council. More on that below.
#The timeline as it stands
The AI Act entered into force on 1 August 2024 and is being phased in. Here is the schedule after the omnibus:
#What moved
The biggest shift concerns high-risk AI. The obligations for Annex III systems (AI used in recruitment and selection, staff assessment or access to services, for example) now apply from 2 December 2027 instead of 2 August 2026. The duties of deployers of those systems move with them: human oversight, informing workers in advance, logging and the fundamental rights impact assessment (FRIA).
For high-risk AI embedded as a safety component in regulated products, such as machinery or medical devices (Annex I), the new date is 2 August 2028. The deadline for member states to have a national AI sandbox in place moves to 2 August 2027.
The omnibus also brings relief for smaller companies: simplified technical documentation, requirements that scale with the size of the organisation and lower caps on fines for SMEs.
#What did not move
This is where much of the reporting in recent months went wrong. Only the high-risk part was deferred. Everything below applies as planned:
- The prohibited practices, such as social scoring, since 2 February 2025.
- The rules for GPAI models, since 2 August 2025.
- The Article 50 transparency obligations, since 2 August 2026. Chatbots must make clear you are talking to AI. AI-generated audio, images, video and text must be marked in a machine-readable format. Deepfakes must be recognisable as artificial. Anyone deploying emotion recognition or biometric categorisation must inform the people involved. There is one transitional period: generative systems already on the market have until 2 December 2026 before their output must be marked in this way.
- The fines. The ceilings stand: up to €35 million or 7 per cent of global annual turnover for prohibited practices, and up to €15 million or 3 per cent for breaches of the transparency duties and certain other obligations.
The GDPR was always separate from all this. Personal data in an AI tool needs the same lawful basis, purpose limitation and data minimisation today as it did last year.
#AI literacy: softened, not scrapped
The omnibus also rewrites Article 4. The old text required organisations to provide a sufficient level of AI literacy among the people working with AI systems on their behalf. The new text requires them to take measures that support the development of AI literacy. In legal terms, it has gone from an obligation to achieve a result to a best-efforts obligation.
In practice, what is sensible barely changes. You still want to be able to show that you are doing something: explaining what AI may and may not be used for, and which data does not belong in a prompt. Our guide to what you can and cannot share with AI can form part of that.
#What starts on 2 December 2026
The omnibus extends the list of prohibited practices in Article 5. From 2 December 2026, AI is banned if it creates or manipulates realistic images, video or audio showing an identifiable person's intimate parts or that person in sexually explicit activity, without their explicit consent. The second new prohibition covers AI that creates or manipulates child sexual abuse material.
The ban works differently for providers and for organisations that use AI. A provider may not place such a system on the market if that is what it is for. The same applies if the system can predictably produce this material without significant technical modification and lacks adequate safeguards, which means a general image generator can fall under the ban too. For you as a user the rule is narrower: it applies when you use a system to create that material. Because the prohibitions sit in Article 5, a breach falls into the top fine bracket listed above.
A transition period ends on the same day. Providers of generative AI that was already on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2), so that what their system produces is marked in a machine-readable format. That duty sits with the vendor, not with the organisation using the tool.
For an employer, this comes down to two practical points. State in your AI policy that staff do not use AI to create sexual images of real people. And check your AI register for the image generators in use and what each vendor says about safeguards against this material. If you cannot find that out, it is a reason not to approve the tool for now.
The dates and the scope are set out in the AI Act Service Desk timeline and the amended text of Article 5, with the fines in Article 99, all published by the European Commission. Checked 28 October 2026.
#The GDPR omnibus is not here yet
The second track of the package, which would move the cookie rules into the GDPR, raise the threshold for reporting data breaches and add a legal basis for training AI models, is still a proposal. Regulators are critical, and parts of the text have already been dropped in negotiations. Do not count on it. Until Parliament and the Council agree, the GDPR applies as you know it.
#What this means for your planning
Postponed does not mean cancelled. For most organisations, the to-do list is the same as before the omnibus:
- AI register. Keep track of which AI tools are in use and what for. BeeSensible shows which tools are in use and records your decision on each tool in the AI register.
- Short AI policy. A few pages setting out the rules for staff is often enough.
- AI literacy. It may now be a best-efforts obligation, but you still want to be able to show what you are doing.
- Data processing agreement and GDPR basics. These were always separate from the AI Act.
- Using high-risk AI? Then you have until December 2027 to put human oversight, logging and the FRIA in place. Use that time, because the requirements themselves have barely changed.
An AI register kept by hand is out of date as soon as a tool appears that nobody has logged. BeeSensible's catalogue takes care of that step: over 1,000 AI tools, each scored for risk and continuously extended with tools that turn up in organisations.
#What to set up in the meantime
The timeline has moved; the risk in everyday work has not. An employee pasting customer data into a prompt today is not waiting for December 2027. The AI Act and the GDPR both ask for the same thing: policy that shows up in daily work, and a way to demonstrate how it works in practice. BeeSensible brings together what usually sits in separate places:
The highlight appears as you type in browser-based AI tools, so sensitive data can be masked or removed before the prompt is sent. That supports data minimisation under the GDPR and puts AI literacy into practice at the moment it counts. The Accountability screen in the dashboard sets those same figures against the provisions of the GDPR, NIS2 and the AI Act, and shows for each provision what lies outside BeeSensible's reach. BeeSensible runs on ISO 27001-certified EU infrastructure.
Put 2 December 2027 in the diary, but the register, the short policy and the explanation for staff belong on this month's list. The omnibus changed nothing there.
Further reading: our article on what the AI Act means for your business alongside the GDPR and the overview of GDPR and workplace AI.
