ZetrixwebWhat changed, and what did not
According to law-firm summaries of the legislative record, the European Parliament adopted the Digital Omnibus on AI in mid-June 2026, the Council approved it at the end of June, and it entered into force in late July 2026. The headline change is timing: obligations for stand-alone high-risk systems listed in Annex III now apply from 2 December 2027, and for AI embedded in regulated products under Annex I from 2 August 2028.
Not everything moved. The transparency duties in Article 50 and the AI Office's enforcement powers over general-purpose AI providers took effect on 2 August 2026 as originally scheduled. If you have not yet looked at what those transparency rules require, our earlier article on them covers the practical changes.
Where to spend the extra months
The work that takes longest is rarely the legal reading. It is the engineering and organizational groundwork: knowing which of your systems are in scope, producing technical documentation that matches how the system really behaves, building event logging, and designing human oversight that a reviewer can genuinely exercise.
Starting now also gives you something valuable during enterprise sales. Buyers in regulated sectors are already asking suppliers how they will meet the high-risk rules, and a credible, dated plan answers that question better than a promise to check later.
| Workstream | Why start now | Output |
|---|---|---|
| Inventory and classification | You cannot plan for systems you have not identified | A list of AI systems with a provisional risk tier |
| Technical documentation | It must reflect real behavior, which takes iteration | Living documents per system |
| Logging and traceability | Retrofitting logs into a running system is costly | Defined events, retention, access |
| Human oversight design | Oversight has to be usable, not nominal | Review points with authority to reject |
| Supplier due diligence | Your obligations depend on what your providers give you | Questions and evidence requests sent |
What not to assume
Do not assume the supporting technical standards you would build against are finished, and do not wait for them. Design to the stated requirements, keep your approach flexible, and adapt as guidance matures. Equally, do not treat the omnibus as the last word: this is an active area, and further simplification proposals are still moving through the EU institutions.
A practical rhythm is a short quarterly review that checks the official sources for changes, re-confirms your system inventory, and tracks progress on each workstream.
Want a plain-English AI Act readiness review for the systems you build or buy? Talk to our team.
Key takeaways
- The Digital Omnibus on AI is in force: Annex III high-risk obligations now apply from 2 December 2027 and Annex I from 2 August 2028.
- Article 50 transparency duties and AI Office powers over general-purpose AI were not delayed and applied from 2 August 2026.
- The requirements did not get lighter; use the time for inventory, documentation, logging, oversight design, and supplier diligence.
- Design to the requirements without waiting for every standard, and review official sources quarterly.