Has the AI Act been postponed? What the Digital Omnibus really changed

In late July a wave of headlines announced that the EU rules on artificial intelligence had been postponed. In a lot of companies that was read one way: we have time, this comes back in a year or two.

That reading is expensive, because it is wrong. The AI Act has not been postponed. One specific part of the regulation was moved, and it is a part that never applied to most companies in the first place.

What actually happened on 27 July

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force. It was adopted on 8 July, published in the Official Journal on 24 July, and has applied since 27 July 2026. It is the first amendment to the AI Act since its adoption.

The reason for the delay is mundane and worth remembering, because it says something about what to expect next. The harmonised standards were not ready, and without them a conformity assessment of a high-risk system is largely guesswork. It is hard to enforce compliance with a standard that does not yet exist.

What was actually moved

Two dates, both concerning high-risk systems only:

• 2 December 2027 - obligations for stand-alone high-risk systems, i.e. those classified by use case. That is Annex III: recruitment, education, credit scoring, access to public services, critical infrastructure. This date previously fell in August 2026.
• 2 August 2028 - obligations for AI embedded in products covered by Annex I, i.e. products already subject to separate EU safety legislation.

If your company has no system in either category, the delay changed nothing at all for you.

What applies unchanged

This is the part the headlines skipped.

The AI literacy obligation has applied since 2 February 2025. That is over eighteen months. It covers any organisation where people use AI tools at work, regardless of sector or size.

The prohibited practices in Article 5 have applied since the same date and carry the highest penalty thresholds in the regulation. Two further prohibitions join them on 2 December 2026.

The transparency obligations took effect on 2 August 2026, exactly as originally planned. A chatbot has to identify itself, AI-generated content has to be marked, deepfakes have to be disclosed. On the same day the European Commission announced that the AI Office and national authorities had begun enforcing the regulation.

The penalties are unchanged. Up to EUR 35 million or 7% of global turnover for prohibited practices, up to EUR 15 million or 3% for breaches of other obligations.

One change worth knowing about

The Digital Omnibus did change the wording of the training obligation in Article 4, and that change affects everyone.

Previously the provision required companies to ensure a sufficient level of AI literacy among staff. It now speaks of taking measures to support the development of that literacy, and the regulation states outright that it does not require anyone to guarantee a specific level of knowledge.

Lawyers will call this a shift from an obligation of result to an obligation of diligent conduct. In practice it means one thing: what stops mattering is whether an employee genuinely knows enough, and what starts mattering is whether the company can show what it did to get them there.

The softening is only apparent. An obligation of diligent conduct is easier to meet but harder to prove without documentation. Before, you could argue that your team knows its business. Now you need to show the training you ran, the dates and the acknowledgements.

Where the postponement myth came from

From three things at once.

First, for two years 2 August 2026 was described as the date the AI Act would apply in full. When the loudest part of it moved five days beforehand, "they postponed the AI Act" became the natural shorthand.

Second, high-risk systems are the most newsworthy part. Facial recognition and credit scoring write better than a training obligation.

Third, the name. "Omnibus" and "simplification" sound like deregulation, even though the change concerned deadlines and one piece of wording, not the scope of the obligations.

What this means in practice

If you use AI in ordinary ways - chat tools, content generators, customer service software, assistants built into your office suite - your to-do list has not changed by a single item.

• Establish what your teams actually use. Without that you cannot check any of the other points.
• Check whether any use case falls into the high-risk category. Classification is done today, even though the obligations start in 2027.
• Train your people and keep the evidence that you did.
• Check that your chatbot and AI-generated content are marked in line with Article 50.

If, on the other hand, you have a recruitment tool, a performance evaluation system or a scoring model, then sixteen months of headroom looks different than it sounds. The advisory and audit market will be booked solid through the second half of 2027, and you will be standing in the same queue as everyone else.

What comes next

The next date in the calendar is 28 October 2026, when the Polish rules on inspections, proceedings and penalties take effect and KRiBSI gains real powers. Then 2 December 2026: two new prohibitions in Article 5.

Not sure which obligations apply to your organisation? The AI Ready Check is a free preliminary diagnosis, three minutes, no commitment.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.