Digital Omnibus: Are AI Act High-Risk Rules Being Pushed to December 2027?

On November 19, 2025, the European Commission published the Digital Omnibus — a legislative simplification package proposing simultaneous amendments to the AI Act, GDPR, Data Act and other digital texts. For companies subject to the AI Act (Regulation EU 2024/1689), the headline proposal is significant: obligations for high-risk AI systems listed in Annex III may not apply in August 2026 as originally planned, but at the earliest in December 2027.

However — this is a proposal. The August 2026 deadline remains the legally binding date today.

Why the Commission Is Proposing This Delay

The Commission's reasoning is pragmatic: the compliance ecosystem is not ready. The harmonised standards needed to guide companies — developed by the CEN-CENELEC Joint Technical Committee 21 — are unlikely to be available before late 2026. Without these standards, companies cannot know with certainty whether their technical documentation is compliant. Imposing an obligation whose implementation tools do not yet exist creates legal uncertainty.

The Commission also identified structural delays in the designation of national competent authorities and conformity assessment bodies across Member States. The proposed delay is therefore not a regulatory retreat, but what the Commission itself calls a "structural recalibration".

What the Digital Omnibus Changes in Practice

A conditional timeline, not a fixed date

The proposed mechanism is more nuanced than a simple postponement. The application of high-risk obligations (Annex III) would be linked to a Commission decision confirming that compliance support tools are available (standards, guidelines, common specifications). Once that decision is taken:

• 6 months additional time for Annex III systems (e.g., AI in recruitment, education, essential services)
• 12 months additional time for Annex I systems (embedded in regulated products: medical devices, machinery, vehicles)

Absolute backstop dates are set regardless: December 2, 2027 for Annex III and August 2, 2028 for Annex I, even if standards have not been published by then.

Relief for SMEs and small mid-caps

The Digital Omnibus introduces a new category: "small mid-caps", defined as companies with fewer than 750 employees and less than €150 million in annual turnover. These companies would benefit from the same reliefs as classic SMEs, including:

• Simplified technical documentation for high-risk systems
• Lighter quality management system (QMS) requirements
• Adapted fine calculation methods based on company size

Article 50: AI content marking delayed by six months

Providers of generative AI systems placed on the market before August 2, 2026 would have until February 2, 2027 to implement machine-readable marking of AI-generated content (Article 50(2) — watermarks, metadata). The remaining transparency obligations under Article 50 continue to apply from August 2026.

Strengthening the AI Office

The Digital Omnibus strengthens the role of the AI Office as the central supervisory authority, particularly for systems based on general-purpose AI models (GPAI) and very large online platforms. This centralisation aims to prevent fragmentation across the 27 Member States.

What Doesn't Change

The Digital Omnibus does not alter the fundamental structure of the AI Act. The following remain unchanged:

• Prohibited practices (Article 5): enforceable since February 2, 2025 — not affected
• GPAI obligations (Articles 51–56): in force since August 2, 2025
• Risk classification: Annex III, risk levels, criteria — nothing changes
• Basic transparency obligations (Article 50 excluding §2): maintained from August 2026
• Penalty levels: up to €35M or 7% of global turnover for prohibited practices

The Digital Omnibus does not simplify the requirements — it delays their enforcement. The Annex IV technical documentation, risk management (Art. 9), data governance (Art. 10): these obligations still exist. Only their enforceability date changes.

Where Does the Legislative Process Stand?

The Digital Omnibus follows the ordinary legislative procedure, requiring several steps before adoption:

• March 18, 2026: vote in the IMCO and LIBE parliamentary committees on the compromise report — the key milestone expected in the coming days
• Spring 2026: vote in European Parliament plenary, then trilogue negotiations with the Council
• Mid-2026: expected final adoption, under pressure from the August 2026 deadline

Positions diverge between political groups. The EPP, Renew and ECR broadly support the proposal, while members of the S&D, Greens and the Left question the need for these changes, with some raising concerns about external geopolitical pressure. Amendments are virtually certain.

What Should You Do While Waiting for Adoption?

The temptation to slow down compliance efforts is understandable. It would, however, be a strategic mistake for three reasons:

1. The Digital Omnibus has not been adopted yet. If trilogues run late, August 2026 applies by default. Companies that are not compliant will have no recourse.
2. The potential delay gives months, not years. The absolute backstop date is December 2027 — that is 21 months away. Companies that start compliance now will be far better positioned than those who wait.
3. Risk classification doesn't change. Knowing whether your system is high-risk is a prerequisite for any compliance effort — and it doesn't depend on any harmonised standard.

The safest strategy: prepare as if August 2026 is real, plan as if December 2027 is the likely enforcement date. The free AiActo diagnostic lets you classify your AI systems and identify your obligations right now — whatever the final date turns out to be.

Frequently Asked Questions

Has the Digital Omnibus been adopted?

No. The Commission's proposal, published on November 19, 2025, is currently under review by the European Parliament and the Council. A key committee vote in IMCO and LIBE is scheduled for March 18, 2026. Final adoption, after trilogues, is not expected before mid-2026 at the earliest.

Do the August 2026 AI Act obligations still apply?

Yes, as long as the Digital Omnibus has not been officially adopted. The date of August 2, 2026 remains the legally binding deadline for high-risk systems (Annex III). If the simplification text is not adopted before that date, the original obligations apply automatically.

Which companies benefit from the new SME exemptions?

The Digital Omnibus extends reliefs to classic SMEs (fewer than 250 employees, less than €50M turnover) and introduces a new category: "small mid-caps", defined as companies with fewer than 750 employees and less than €150M in annual turnover. These companies will benefit from simplified technical documentation and quality management requirements.

Are GPAI obligations affected by the delay?

No. Obligations for providers of general-purpose AI models (Articles 51 to 56) have been in force since August 2, 2025 and are not modified by the Digital Omnibus. Only a grace period until February 2, 2027 is granted for updating documentation of GPAI models already on the market before August 2026.

What does the parliamentary rapporteurs' report propose?

The report published on February 5, 2026 by rapporteurs Arba Kokalari (EPP) and Michael McNamara (Renew Europe) proposes setting fixed backstop dates: December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems, while reinstating the AI literacy obligation for providers and deployers.

The Digital Omnibus does not change the substance of the AI Act — it adjusts its enforcement timeline to reflect a concrete reality: the compliance tools were not ready. But the potential delay does not change the direction. Classifying your AI systems, inventorying your obligations and structuring your documentation remain unavoidable steps, whatever the final date. Check the AI Act timeline on AiActo to follow regulatory calendar updates in real time.