The Digital Omnibus and the AI Act: what moved to 2027/2028, and what still applies from 2 August 2026

The Digital Omnibus — the EU package simplifying digital legislation, endorsed by the European Parliament on 16 June and approved by the Council on 29 June 2026 — defers the AI Act obligations for high-risk systems: Annex III (recruitment, credit scoring, education, among others) moves from 2 August 2026 to 2 December 2027, and Annex I (regulated products) to 2 August 2028. The general application of the AI Act from 2 August 2026 is unchanged. A lot of confusion has grown around the package — below is only what follows from the adopted text.

What exactly was deferred

• Annex III (high-risk systems): obligations were due 2 August 2026 — they now apply from 2 December 2027. This covers AI in recruitment and HR, credit scoring, education and access to services, among others.
• Annex I (AI as a safety component of regulated products): deferred to 2 August 2028.
• Content marking (Article 50(2)) for systems already on the market: generative systems placed on the market before 2 August 2026 received a transition period for the machine-readable marking obligation — until 2 December 2026. Systems placed on the market from 2 August 2026 must mark from day one.
• Regulatory sandboxes: the member-state obligation to set them up moved to 2 August 2027.
• The package enters into force upon publication in the EU Official Journal — only then are the new deadlines formally binding.

What was NOT deferred

• 2 February 2025 — prohibited practices (Article 5) and the AI-literacy obligation (Article 4): long in force.
• 2 August 2025 — obligations of GPAI model providers: unchanged.
• 2 August 2026 — the general application of the AI Act: unchanged. That includes the Article 50 transparency obligations (a chatbot must disclose it is AI; generated content must be marked) and the supervision and penalties framework.

The most common mistake: “we’ve got 16 quiet months”

The deferral concerns only the obligations for high-risk systems. To even know whether any of your systems is high-risk — and whether the deferral applies to you — you first need an inventory and a classification. We show that work step by step, and the vocabulary is in the AI Act glossary. For most companies in Poland — deployers of off-the-shelf tools — the calendar for 2 August 2026 looks exactly as it did before the Digital Omnibus.

What it means in practice

• AI in recruitment, HR, credit scoring? You gain time until 2 December 2027 for the full high-risk obligations — but transparency, AI literacy and classification apply regardless.
• “Only” using ChatGPT, Copilot, chatbots? Nothing changes for you: Article 4 already applies, Article 50 arrives on 2 August 2026.
• Building your own AI systems? The risk classification decides which calendar applies to you — and it is better to know the answer before August.

What next

The full readiness checklist for 2 August 2026 is in the board-level checklist. If you want the inventory, the risk classification and a gap-closure plan done within weeks — start with an AI Act compliance audit.