Digital Omnibus: The EU Simplification Package That Moved the AI Act's High-Risk Deadline
Digital Omnibus: the EU package that deferred high-risk Annex III duties to 2 December 2027. What it is, its status, and what it leaves untouched.
The Digital Omnibus is an EU simplification package — a single legislative instrument that amends several existing EU digital-economy laws at once to cut compliance burden. Among its measures, it defers the EU AI Act's stand-alone high-risk Annex III obligations from 2 August 2026 to 2 December 2027. That re-timing is what most people mean when they reference the Digital Omnibus, but the package itself is broader. It is Regulation (EU) 2026/1744 of 8 July 2026: the European Parliament adopted it on 16 June 2026 and the Council on 29 June 2026, and it was published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
This page defines the term, explains why it is called an "omnibus", sets out exactly what it changes in Regulation (EU) 2024/1689, and states its current legal status. It is a definition page, not a full walkthrough of the deferral mechanics — that lives on the sibling deep-dive linked at the end.
What is the Digital Omnibus?
One-paragraph definition
The Digital Omnibus is an EU simplification package: one legislative instrument that bundles amendments to multiple separate EU digital-economy laws into a single bill, with the aim of reducing overlapping compliance burden. For the EU AI Act specifically, its load-bearing measure is a re-timing of the high-risk application dates — it pushed the stand-alone high-risk Annex III obligations from 2 August 2026 to 2 December 2027, and the product-embedded high-risk obligations from 2 August 2027 to 2 August 2028.
The package touches several EU digital files, not just the AI Act. For the purposes of this page, the change that matters is the AI Act re-timing — so the term is defined broadly first, then narrowed to the Regulation (EU) 2024/1689 angle that brings most readers here.
Why it is called an "omnibus"
In EU law-making, an "omnibus" is a single bill that carries amendments to several separate laws at once, rather than a stand-alone reform of one statute. The Latin sense — "for all" — captures it: one vehicle, many passengers. The Digital Omnibus bundles changes across multiple EU digital-economy regulations into one instrument, with the EU AI Act being just one of the laws it touches.
That bundling is the defining feature of the term. It signals a package of simultaneous amendments aimed at trimming compliance burden across files, not a dedicated AI Act reform. When you read "Digital Omnibus", read "one bill amending many laws" — the AI Act content is the headline, not the definition.
What does the Digital Omnibus change in the EU AI Act?
The headline change — high-risk deferral
The single most-cited change is the high-risk deferral. Stand-alone high-risk systems — those classified through the Article 6(2) route by reference to the Annex III use-case list — moved from 2 August 2026 to 2 December 2027.
A second, separate date sits alongside it. High-risk AI embedded as a safety component of an Annex I regulated product — the Article 6(1) route — moved from 2 August 2027 to 2 August 2028. Two routes, two dates: keep them apart when you plan.
These are fixed calendar dates, not a standards-contingent trigger. An earlier "stop the clock" variant, the Commission's November 2025 proposal, would have tied the high-risk start date to the availability of harmonised standards and support tools, with backstop dates. That variant was rejected. You cannot assume a further slip if the standards are late.
Stand-alone vs product-embedded high-risk
Frame the deferral correctly: the date change re-times when the obligations bite. The Omnibus also changed some substance, set out below.
| Classification route | Where it sits | Original date | New date |
|---|---|---|---|
| Stand-alone high-risk (Article 6(2)) | Annex III use-case list (e.g. recruitment) | 2 August 2026 | 2 December 2027 |
| Product-embedded high-risk (Article 6(1)) | Safety component of an Annex I product | 2 August 2027 | 2 August 2028 |
The Article 9 risk-management system, the Article 10 data-governance measures, and the Article 11 / Annex IV technical documentation keep their core requirements. But the Omnibus did more than move dates: it inserted Article 6(1a) and (1b), which narrow the Annex I safety-component test, replaced the Article 4 AI literacy text with a softer duty, and deleted points 7 and 9 of Annex VIII Section B.
Is the Digital Omnibus law yet?
Yes. The European Parliament voted on 16 June 2026 and the Council adopted it on 29 June 2026. As Regulation (EU) 2026/1744 of 8 July 2026, it was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026.
Adopted and published
The European Parliament and Council formally adopted the Digital Omnibus in June 2026. It was published in the Official Journal (OJ L) on 24 July 2026.
In force since 27 July 2026
The Omnibus entered into force on 27 July 2026, the third day after its publication in the Official Journal. The European Parliament adopted the package in its plenary vote on 16 June 2026, and the Council adopted it on 29 June 2026. The new dates are law.
Which date you plan against today
Plan against 2 December 2027 for stand-alone high-risk Annex III. The deferral is law, in force since 27 July 2026.
What does the Digital Omnibus NOT change?
The deferral is narrow. Of the existing dates, it moves only the high-risk application dates. The other dates in the timeline stand.
Obligations already in force
The Article 5 prohibited practices have applied since 2 February 2025 and were not deferred. The Article 4 AI literacy obligation — also in force since 2 February 2025 — was not deferred, though its text was replaced with a softer duty. General-purpose AI model obligations under Articles 51–55 have applied since 2 August 2025 and were not deferred either. "The AI Act was delayed" is misleading shorthand; the prohibitions, literacy duty, and GPAI rules are live regardless of the Omnibus.
A new 2 December 2026 date the package adds
Not everything moved later. The package also adds two Article 5 bans from 2 December 2026: point (ba), AI that generates non-consensual intimate imagery of an identifiable person, and point (bb), AI that generates child sexual abuse material. Article 50, including the 50(2) content-marking duty, was not deferred and has applied since 2 August 2026; only generative systems already on the market before then have until 2 December 2026 (Article 111(4)). So treating the Digital Omnibus as a blanket delay is inaccurate.
The penalty architecture under Article 99 is unchanged. Breaches of the Article 5 prohibitions carry fines up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). Most other obligation breaches carry up to €15 million or 3% (Article 99(4)). Supplying incorrect, incomplete or misleading information to authorities carries up to €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount.
Digital Omnibus at a glance: original vs current dates
The before-and-after table
| Obligation | Original statutory date | Current date | Legal status (October 2026) |
|---|---|---|---|
| Article 5 prohibitions | 2 February 2025 | unchanged | Binding, in force |
| Article 4 AI literacy | 2 February 2025 | unchanged | Binding, in force |
| GPAI obligations (Articles 51–55) | 2 August 2025 | unchanged | Binding, in force |
| Article 50 incl. 50(2) content-marking | 2 August 2026 | unchanged (2 December 2026 for generative systems on the market before 2 August 2026) | Binding, in force |
| New Article 5 bans, points (ba) and (bb) | new | 2 December 2026 | Law (Digital Omnibus) |
| High-risk Annex III stand-alone (Art 6(2)) | 2 August 2026 | 2 December 2027 | Law (Digital Omnibus) |
| High-risk Annex I product-embedded (Art 6(1)) | 2 August 2027 | 2 August 2028 | Law (Digital Omnibus) |
How to read the legal-status column
"Binding, in force" means missing the obligation is current non-compliance — enforceable today. "Law (Digital Omnibus)" means the date is set by Regulation (EU) 2026/1744, in force since 27 July 2026; the obligation applies from that date.
The load-bearing point, restated: the deferral is law — so plan against the new dates.
Worked example: what the Digital Omnibus means for one company
The company and its AI systems
Northwall Talent is a 140-person EU recruitment-software company. Its flagship product is an automated CV-screening and candidate-ranking tool that employers use to filter and order job applicants.
Which date applies to which system
The CV-screening tool sits in Annex III, point 4 (employment and recruitment) and is a stand-alone high-risk system under Article 6(2). Its application date is 2 December 2027 under the Digital Omnibus. The date is settled, so Northwall plans against 2 December 2027.
The Digital Omnibus was adopted by the European Parliament in its plenary vote on 16 June 2026 and by the Council on 29 June 2026; it was published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
What is live for Northwall now, regardless of the deferral: Article 4 AI literacy for staff (since February 2025), and Article 50 transparency where candidates interact with the system. If any feature crosses an Article 5 line — say, inferring emotions of applicants in the workplace — it is already unlawful, today, with no grace period.
The takeaway: the deferral gives Northwall more runway to build the Article 11 / Annex IV technical file and the Article 9 risk-management records — not permission to pause. A realistic high-risk programme runs many months, and because the date is fixed rather than standards-contingent, there is no cushion to fall back on.
How Confir helps
Confir's classification workflow asks structured, plain-English questions about each AI system your organisation builds or operates, then derives the obligations and the dates that attach to it. For a stand-alone high-risk Annex III system, it surfaces the 2 December 2027 date, so you plan against the right one. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake produces the same finding, with every Article and Annex cited back to Regulation (EU) 2024/1689.
Related terms
- how the 2027 high-risk deferral works in detail
- whether the EU AI Act is actually delayed
- what counts as a high-risk AI system
- the full EU AI Act deadline list
- the EU AI Act implementation timeline
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →