Timelines after the Digital Omnibus

Regulation (EU) 2026/1744, the Digital Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved two of the AI Act's application dates and left the rest alone. Getting this distinction right is the difference between a programme that is ahead of its obligations and one that has quietly stopped work on a duty that is already live.

What moved

Standalone high-risk systems under Annex III now apply from 2 December 2027. High-risk AI embedded as a safety component in products under Annex I now applies from 2 August 2028.

That is the whole of the deferral. It bought an insurer with a life underwriting model roughly a year of additional runway, and an industrial products group with embedded AI rather more.

What did not move

The prohibitions were not deferred. GPAI obligations were not deferred; they applied from 2 August 2025, the GPAI Code of Practice was finalised on 10 July 2025, and it is enforceable with fines from 2 August 2026.

And Article 50 was not deferred. The transparency duties applied from 2 August 2026 and are live now. This is the single most consequential misreading of the Digital Omnibus in circulation, because it is the duty that touches the largest number of systems in a typical firm: chatbots, correspondence drafting, marketing content, synthetic media, and anything generating text put in front of a customer.

Article 50 in operational terms

Four duties, addressed to different parties. People must be informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed and observant person. Providers of systems generating synthetic audio, image, video or text must mark the output in a machine-readable format detectable as artificially generated. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them. And deepfake content must be disclosed, with a limited exception for evidently artistic, creative, satirical or fictional work, alongside a disclosure duty for text published to inform the public on matters of public interest unless the content underwent human review with a named person or entity holding editorial responsibility. All of it must be given at the latest at the time of first interaction or exposure, clearly and distinguishably.

The trap is specific and expensive. A deployer cannot discharge the Article 50(4) disclosure duty by relying on the provider's machine-readable marking. The Commission's guidance requires a visible or audible label understandable without a detection tool. The two duties look similar, sit in adjacent paragraphs, fall on different parties, and are satisfied by different artefacts. A firm whose synthetic content control consists of "our vendor watermarks everything" has not complied.

One grace period applies: systems already on the market before 2 August 2026 have until 2 December 2026 for the marking obligation. The Code of Practice on Transparency of AI-Generated Content was confirmed adequate and the Article 50 guidelines were published on 20 July 2026.

Incident reporting deadlines, which have their own clocks

Article 73 sets three: 15 days generally; 10 days where a person has died; and 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure. An initial incomplete report followed by a complete one is permitted, which is the provision to rely on rather than missing a deadline while an investigation runs.

The clock does not start when someone feels concerned. It starts on establishing the causal link, or its reasonable likelihood, between the AI system and the incident. Firms without a pre-agreed definition of a serious incident spend the two-day window debating whether the two-day window applies.

Worked example: a programme plan that survives the deferral

A European insurance group's AI Act plan, written in early 2026, had everything landing on a single date. After the Digital Omnibus the group's first instinct was to reprofile the whole plan to December 2027. That is wrong in both directions.

The corrected plan has three streams. Live now: Article 50 disclosure and labelling across the chatbot, the correspondence assistant and marketing content, with a visible label distinct from any vendor watermark, and the marking grace period for pre-August systems closing on 2 December 2026. Article 4 AI literacy across staff and contractors. GPAI obligations where the group provides a model, and contractual assurance where it does not.

To 2 December 2027: the Annex III systems, which for this group means life underwriting, health pricing and HR screening. Conformity work, technical documentation, Article 27 impact assessments and registration.

To 2 August 2028: AI embedded in products the group's equipment-finance arm places on the market under Annex I.

Splitting the plan this way also makes the prohibitions visible as a standing screen rather than a project milestone. Prohibited practices were never deferred and have no compliance route, so they belong in intake as a hard gate, not in a workstream with a delivery date.

As of 24 September 2026.