The EU AI Act after the Digital Omnibus: what actually changes for your AI roadmap

What moved

The AI Act itself, Regulation (EU) 2024/1689, set a staged timetable, with most obligations for high-risk systems due on 2 August 2026¹. As reported by several firms tracking the Omnibus, the amending regulation was published in the Official Journal on 24 July 2026 and entered into force on 27 July, just days before those obligations would have applied²³.

Some commentators also report a short grace period, to 2 December 2026, for machine-readable marking of AI-generated content on systems already on the market before August, and two new prohibitions phasing in that same December⁴⁶.

What didn't move

This is the part that gets lost in the headlines. Transparency obligations under Article 50 kept their date⁴. If your product has a chatbot that talks to the public, generates synthetic images, audio or text, or uses emotion recognition, those duties are live now.

In engineering terms that means three things that are easy to underestimate:

• Disclosure in the interface. Users need to know they are dealing with an AI system. That is a product and design change, not a policy document.
• Marking generated content. Machine-readable marking has to be built into your generation pipeline, which touches every model call that produces media.
• Knowing where AI is used. You can't disclose what you haven't inventoried. Many companies still lack a register of where models sit in their products.

Deferred is not cancelled

The Omnibus changes dates. It does not remove the requirements for high-risk systems or make them lighter⁵. When I map those requirements onto systems, almost all of them are architecture work: risk management, data governance for training and evaluation data, automatic logging, technical documentation, human oversight, and accuracy and robustness testing¹.

The extra time is a gift if you use it to build these capabilities properly, into the platform, once. It is a trap if it becomes another reason to postpone them.

How I would adjust a roadmap now

1. Build the AI inventory this quarter. Every model, every vendor API, every place a model's output reaches a user or a decision. Classify each one against the Act's risk categories with legal input.
2. Ship the Article 50 work first. It already applies, and it is usually small: interface disclosure and content marking.
3. Put logging and lineage into the platform, not each product. An AI gateway that every model call passes through gives you traceability, cost control and PII redaction in one place. I describe the pattern in my notes on private LLMs.
4. Make evaluation a release gate. Accuracy and robustness evidence is much easier to produce if every release already runs an evaluation suite. My RAG production checklist covers how.
5. Write documentation as you build. Architecture decision records and model cards written at the time are worth far more than documents reconstructed for an auditor.
6. Re-plan the high-risk work against the new dates, with a buffer. Dates have moved once already; build so that you are ready early.

Healthcare and medical devices

For teams building AI into medical devices, the move of Annex I systems to August 2028 is the biggest change³. These teams already work under medical device regulation, so the AI Act adds a layer on top of an existing quality system rather than starting from nothing.

My advice here is to align the AI Act evidence with what your quality system already produces: design history, risk files, clinical evaluation. Then the extra obligations become additional sections in documents you already maintain. The data side matters just as much. Clinical AI needs provenance back to standardised, governed data, which is why I keep coming back to architectures like FHIR to OMOP for the analytical layer.

For teams outside the EU

I work with teams in the United States and the UAE, and the question I hear most is whether this applies to them. The Act applies to providers placing systems on the EU market and to deployers in the EU, regardless of where the provider is based¹. If you have EU customers, assume it matters.

Even if you have none, the engineering controls it asks for are the same ones that make AI systems safe to run anywhere: inventory, logging, evaluation, oversight. In the UAE, data protection rules such as the federal PDPL and the regimes in DIFC and ADGM push in the same direction. Building those controls once into a shared platform is far cheaper than meeting each regime separately.

How I can help

If your AI roadmap still has an August 2026 line on it, it's a good moment to re-plan. I run short AI architecture reviews that produce an inventory, a risk-ranked roadmap and a platform design for logging, evaluation and governance. For investors assessing AI companies, the same lens is part of my technical due diligence. Or analyse your challenge first and bring the result to a call.