Heidelberg: The digital omnibus entered into force on 27 July, six days before the AI Act deadline it was written to move, and companies building high-risk systems now work to December 2027 instead of August 2026.
The Commission proposed the deferral in November 2025 and argued that the standards bodies had not delivered the harmonised technical specifications on which compliance depends. That argument held. Developers of high-risk systems were supposed to demonstrate conformity against European standards that did not exist, and notified bodies could not certify against a blank page. Parliament and Council agreed a compromise in May, and the text reached the Official Journal on 24 July.
What did not move deserves equal attention. Transparency obligations applied from 2 August as originally legislated. Providers must tell users when they interact with an AI system, label synthetic audio, image and video content in machine-readable form, and disclose when an emotion recognition or biometric categorisation system processes them. Those duties bind now, and they cover a far wider population of products than the high-risk annex ever did.
A further tranche arrives in December. From 2 December 2026 the act prohibits systems designed to generate or manipulate non-consensual intimate imagery and systems that produce child sexual abuse material. Those prohibitions sit alongside the original bans on social scoring and untargeted facial image scraping, and they carry the act’s heaviest penalties.
The deferral leaves an awkward middle. A company selling a recruitment screening tool, a credit scoring model or a medical triage system faces transparency duties today and conformity duties in late 2027. Legal advisers report that clients read the gap as permission to pause, which is a misreading. The transparency rules apply regardless of risk classification, and market surveillance authorities in several member states have already begun asking for labelling evidence.
Civil society groups treated the omnibus as a retreat and said so loudly. Their argument is that the Commission bundled a genuine standards problem with a broader deregulatory agenda, and that a sixteen-month delay in a fast-moving field effectively rewrites the law. Industry associations counter that enforcing an unworkable deadline would have produced paper compliance and nothing more. Both positions contain a defensible core, and the Commission’s own materials now carry two parallel timelines that confuse anyone reading them for the first time.
Standards work continues. CEN and CENELEC aim to deliver the core harmonised standards during 2027, which leaves developers a narrow window between publication and application. If that timetable slips again, the Commission will face the same choice it made this summer, and it will make it with considerably less political credit than it spent the first time.
