The EU AI Act timeline after the Digital Omnibus: a builder's guide
The EU Digital Omnibus (formally adopted June 2026) moved the high-risk deadline by 16 months. Here is what actually changed, what already applies, and what to do with the time.
| Date | What applies | Status |
|---|---|---|
| Feb 2, 2025 | Art. 5 prohibited practices in force | In force |
| Aug 2, 2025 | GPAI obligations | In force |
| Aug 2, 2026 | Art. 50 transparency | Upcoming |
| Dec 2, 2027 | Annex III high-risk obligations | Moved by Omnibus |
| Aug 2, 2028 | Annex I: AI in regulated products | Upcoming |
What changed in mid-2026
The Digital Omnibus (provisionally agreed on May 7, 2026, then formally adopted by the European Parliament on June 16 and the Council on June 29, 2026) moved the Annex III high-risk obligations, including Article 12 automatic logging, Article 14 human oversight, and Article 19 log preservation, from August 2026 to December 2, 2027. Annex I obligations for AI in regulated products follow on Aug 2, 2028. Nothing else moved: prohibitions and GPAI duties stay in force, and Art. 50 transparency still lands on Aug 2, 2026.
What applies today
- Art. 5 prohibitions have applied since Feb 2, 2025, with fines up to €35M or 7% of global turnover.
- GPAI obligations have applied since Aug 2, 2025.
- GDPR (including Art. 9 special-category data rules) and DORA apply now, independent of the AI Act timeline.
What to do before December 2, 2027
Article 12 logs must be generated at the moment of use; they cannot be reconstructed retroactively. Evidence you start accumulating now is evidence you will have when the obligations bite. Teams that route AI traffic through a gateway today get the audit chain as a side effect of cutting their provider bill: the cost savings fund the compliance readiness.
The high-risk deadline moved once, by 16 months, after a multi-year legislative fight. Planning on a second delay is not a strategy.