EU AI Act 2026: What Actually Changed

For a year that was supposed to bring the EU AI Act's toughest rules into force, 2026 delivered something closer to a reprieve. On 27 July 2026, the so-called "Digital Omnibus" package entered into force, and it pushed back exactly the deadlines that had been keeping compliance teams up at night — though not as many of them as some headlines suggested.

The deadlines that moved

The obligations for high-risk AI systems under Annex III — think recruitment tools, credit-scoring models, law-enforcement systems, education and border-control AI — were due to bite on 2 August 2026. The Omnibus pushes that to 2 December 2027, a delay of roughly sixteen months.

AI embedded in regulated physical products (Annex I: machinery, medical devices, vehicles, lifts, toys) gets a similar reprieve, moving from 2 August 2027 to 2 August 2028.

The deadline for EU member states to stand up regulatory sandboxes — supervised environments where companies can test AI systems under regulator oversight — also slipped a year, from August 2026 to August 2027, alongside a new EU-level sandbox meant to give smaller companies a single point of entry rather than twenty-seven different national ones.

What didn't move

Here's the part worth flagging to anyone who reads "AI Act delayed" and assumes the whole thing is on ice: Article 50 transparency obligations are still on track. If your product interacts with users in a way that could be mistaken for a human, or generates synthetic audio, video, image or text content, you still need to disclose that around the original 2 August 2026 timeline. There's a narrower grace period — until 2 December 2026 — specifically for watermarking already-deployed systems under Article 50(2), but the core disclosure duty itself wasn't pushed to 2027 the way the high-risk provisions were.

The Act also picked up a new, narrowly-targeted prohibition: AI systems that generate non-consensual intimate imagery or child sexual abuse material are now explicitly banned under Article 5, with a short transition period running to December 2026.

The quieter changes

A few adjustments matter less for headlines but more for anyone actually building a compliance program:

• Who counts as "small." The lighter-touch compliance track that used to apply only to SMEs now extends to small mid-cap companies too — a meaningful widening of who gets the easier path.
• AI literacy got softer, not stronger. Article 4 originally implied organizations had to guarantee their staff reached a certain literacy bar. The revised text asks organizations to support staff development instead — a lower bar to clear on paper, though arguably it makes a genuine training program more of a differentiator than a compliance checkbox, not less.
• Bias-detection data processing widened. Organizations can now process special-category data to detect and correct algorithmic bias across all AI systems and general-purpose AI models, not just the high-risk ones — a practical allowance that acknowledges you often can't fix what the old rules didn't let you measure.
• The AI Office's reach grew. Enforcement authority over general-purpose AI models and large online platforms was expanded, even as obligations elsewhere were being relaxed — worth noting as a sign of where regulatory attention is actually concentrating.

What this means if you're not a lawyer

None of this is a reason to stop preparing. Every legal analysis of the Omnibus says roughly the same thing in different words: the extra runway is for building real compliance infrastructure, not for shelving the project. If anything, a longer timeline with a still-live transparency deadline in the middle of it is a harder needle to thread than one clean deadline would have been — you now need a phased plan rather than a single push.

Worth being precise about the legal status here: the Digital Omnibus was formally published in the EU's Official Journal on 24 July 2026 (as Regulation (EU) 2026/1744) and entered into force three days later, on 27 July — so the dates above are the binding legal text, not just a political agreement awaiting paperwork.