From the journal

EU Digital Omnibus 2026/1744 Defers High-Risk AI Deadlines, In Force 27 July 2026

Regulation (EU) 2026/1744, the EU Digital Omnibus on Artificial Intelligence, entered into force on 27 July 2026, amending the AI Act's implementation schedule. Mandatory compliance with Annex III high-risk AI system requirements is deferred to 2 December 2027. Annex I systems embedded in regulated products move to 2 August 2028. National sandbox establishment shifts to 2 August 2027. Article 50 transparency obligations and the prohibited practices ban remain on their original schedules.

3 min read

Regulation (EU) 2026/1744, the EU Digital Omnibus on Artificial Intelligence, entered into force on 27 July 2026 following publication in the Official Journal of the European Union. It amends the AI Act (Regulation (EU) 2024/1689) with immediate effect on its implementation timeline. The European Parliament and Council reached the provisional agreement in May 2026, responding to delays in designating national competent authorities, establishing conformity assessment bodies, and developing harmonised standards.

The Omnibus amends the AI Act's transitional provisions on two points. Providers of stand-alone high-risk AI systems listed in Annex III, covering remote biometric identification, critical infrastructure management, employment screening, access to essential services, law enforcement, migration, and administration of justice, must comply from 2 December 2027, extended from the original 2 August 2026 deadline. Providers of AI systems serving as safety components in, or themselves constituting, regulated products listed in Annex I, covering machinery, medical devices, in-vitro diagnostics, aviation, motor vehicles, marine equipment, rail, lifts, and pressure equipment, must comply from 2 August 2028. The obligation for member states to establish AI regulatory sandboxes under Article 57 of the AI Act shifts to 2 August 2027.

The deferral directly affects two groups of market participants. AI developers building Annex III category systems gain 16 months to complete technical documentation, conformity assessment, EU AI database registration, and fundamental rights impact assessments. Manufacturers embedding AI into Annex I regulated products, primarily medical device and machinery makers, gain 24 months. Financial institutions deploying AI in credit scoring, insurance risk assessment, and access-to-credit decisions under Annex III, points 5(b) and 5(c), move from an imminent compliance date to a 2027 deadline.

The Omnibus does not defer all AI Act obligations. The ban on prohibited AI practices, covering social scoring, real-time biometric surveillance in public spaces, and subliminal manipulation systems, applied from 2 February 2026 and is unchanged. Article 50 transparency duties applied from 2 August 2026 on schedule. General-purpose AI model obligations under Chapter V are also unaffected. The Omnibus separately shortened the grace period for AI-generated content marking under Article 50(2) from six months to three months, resetting the compliance deadline for pre-existing systems to 2 December 2026.

Licentium advises AI developers, product manufacturers, and regulated industry clients on revised AI Act timelines, high-risk system classification, and conformity assessment planning. We may assist with this matter directly or through our partner network. Work we undertake includes AI Act compliance roadmapping, technical documentation preparation, Annex III and Annex I classification analysis, and regulatory strategy for EU and non-EU market entry.

Source: Council of the EU, Artificial Intelligence: Council and Parliament agree to simplify and streamline rules, 7 May 2026

More from the journal

See all

UK payment orchestration regulation for an Egyptian checkout supplier

An Egyptian payments-technology company proposes to supply checkout and payment-routing software to UK online marketplaces. This hypothetical case asks, under UK payment-services law, whether it can remain a technical supplier, provide managed payments for an authorised provider, or obtain its own UK payment permission. The answer distinguishes merchant-controlled software from a service that accepts payment obligations or exercises payment authority. Neither branch assumes an executed contract, an appointed provider or a regulator's approval.

ESMA publishes third Sanctions Report detailing 2025 enforcement actions

The European Securities and Markets Authority (ESMA) has published its third Sanctions Report, detailing over 950 administrative sanctions imposed across the European Economic Area (EEA) in 2025, with a total value of nearly €82 million.

Robo adviser licence UK for a South African ETF app

A South African wealth-tech company proposes an app that recommends exchange-traded fund (ETF) portfolios to UK residents and periodically rebalances their investments. This composite case asks whether the company should establish an FCA-authorised UK business, use an authorised principal, or supply software to a UK firm. The proposed launch serves adult UK retail clients through a UK investment firm, with investment decisions and client assets kept outside the South African supplier's control. It is a proposed operating model, not a client history or an assurance of authorisation.