This is general information, not legal advice. Dates below are as reported by law firms and compliance publications after the Digital Omnibus agreement; confirm against the Official Journal text and with qualified counsel before relying on them.
Many B2B teams assumed the EU AI Act's main obligations would apply from August 2026. The EU's Digital Omnibus changed that timetable for the high-risk rules. Understanding what moved, and what did not, saves both panic and complacency.
What changed
- Stand-alone high-risk systems (Annex III), such as AI used in hiring, credit scoring or education, were moved from 2 August 2026 to 2 December 2027.
- High-risk AI embedded in regulated products (Annex I) was reported as moved to 2 August 2028.
- Watermarking of AI-generated content (Article 50(2)) was reported as moved to 2 December 2026, making it one of the nearest live obligations.
What did not change
The Act is still law. Prohibited practices and AI literacy duties have applied since 2025, and the rules for general-purpose AI models are in force. The Omnibus also kept the principle that the rules follow the use case, not the technology. And the GDPR is unaffected: if your AI processes personal data of people in the EU, it applies today. Our guide to AI consulting, GDPR and the EU AI Act covers the data side.
Is your product high-risk?
Most B2B SaaS features are not. A support agent, a document search tool or a sales-email assistant is typically limited-risk or minimal-risk. You move toward high-risk when the system makes or materially influences decisions about people in listed areas, for example screening job candidates, assessing creditworthiness or grading students. If your product touches those, treat the new date as a runway, not an exemption.
A practical checklist
- Inventory your AI features and note which models they use, what data they see and who they affect.
- Classify each one against the Act's categories, and record the reasoning.
- Check transparency duties. If users interact with an AI system, or you generate synthetic content, plan the disclosures and labelling.
- Keep logs and documentation. Evaluation results, data sources and human oversight design are useful whether or not a rule currently demands them. They also answer enterprise security questionnaires.
- Review vendor contracts with your model providers for data use, retention and where processing happens.
- Assign an owner. Someone should track the Official Journal and your regulator's guidance.
Why the delay is not a reason to wait
European enterprise buyers already ask for evidence of testing, oversight and data handling in procurement. Building those habits now is cheaper than retrofitting them, and it speeds up sales. Evaluation and monitoring are built into every AI agent we deliver, see how to evaluate an AI agent before production. For a broader view see our AI consulting for Europe page.
Frequently asked questions
Was the EU AI Act delayed?
Part of it. The Digital Omnibus moved the high-risk obligations for stand-alone systems to 2 December 2027, with embedded product systems reported as 2 August 2028. Prohibited practices and general-purpose AI rules were not postponed.
Does the EU AI Act apply to a company outside the EU?
It can. The Act applies to providers and deployers whose AI systems are placed on the EU market or whose output is used in the EU, regardless of where the company is based.
Does the delay affect GDPR?
No. GDPR applies now to any processing of personal data of people in the EU, including by AI systems.
Is a customer-support AI agent high-risk?
Usually not, because it is not making decisions in the Act's listed high-risk areas. It may still carry transparency duties, and you should confirm the classification for your specific use.
Related: AI consulting for Europe · GDPR and the EU AI Act guide
Want a straight answer for your project?
Book a 30-minute call. I will tell you what I would do, and a fixed price if it makes sense.