The EU AI Act's High-Risk Dates Moved. Two Obligations Didn't
The Digital Omnibus on AI is law, and it moved the date most AI Act compliance plans were built around. It is Regulation (EU) 2026/1744 of 8 July 2026, and EUR-Lex and the Commission’s own announcement both give 27 July 2026 as its entry into force. I’m writing this up because a lot of what I’ve read since mixes up what moved and what stayed put, and for a team running AI in sales, risk or payments, the second list is the one that applies first. I’m not a lawyer. Where I could only find a date in a law firm’s or consultancy’s summary and not on the Commission’s pages, I say so.
What moved
According to the Commission’s announcement and its AI Act policy page, rules for high-risk systems listed in Annex III, the standalone use cases such as credit scoring, now apply from 2 December 2027. Rules for systems embedded in regulated products, Annex I, apply from 2 August 2028. The Commission also says political agreement was reached on 7 May 2026, which is why anyone who planned around the original August 2026 date had a few months of warning.
If your roadmap has a line saying “high-risk compliance, August 2026”, that line is now sixteen months out. That is breathing room, not a cancellation. Nothing I read suggests the Annex III categories themselves were removed.
What didn’t
Two obligations are already live, and neither was pushed back.
The first is AI literacy, Article 4, which has applied since 2 February 2025. The Omnibus softened it. In the amended text as published on artificialintelligenceact.eu, providers and deployers must take measures to support the development of AI literacy among their staff and others using AI on their behalf, and the text says no specific level of literacy is required from any individual. Commentators disagree on how far the burden moved. Cooley reads the new wording as shifting emphasis to the Commission and member states supporting literacy; X Consulting reads it as organisations keeping the duty, with a Commission FAQ saying no certificate is needed and an internal training record is enough. I’d side with the second reading for planning purposes: the duty on companies is still there, in lighter language.
The second is transparency under Article 50, which the Commission says takes effect in August 2026 and which the Omnibus did not postpone. It covers, among other things, telling people they are interacting with an AI system. I wrote about what that means for AI in outbound sales in Putting an AI Agent in Front of a Prospect: What Article 50 Says.
Two smaller dates are worth knowing but I’d treat them as less certain. X Consulting and Cooley both report a grace period to 2 December 2026 for machine-readable marking of AI-generated content on systems already on the market before August. I couldn’t confirm that on the Commission’s page, and the EUR-Lex pages I could reach showed metadata but not the operative text. And a new ban on systems that generate non-consensual intimate content or child sexual abuse material is described by Cooley, and the Commission’s policy page carries a December 2026 date for a new prohibition, which looks consistent, though I haven’t read the article itself.
What I’d do with it
I’d do three things. First, correct the dates in any plan, and write down which of them come from the Commission and which from a secondary source. Second, make sure there is a record of AI training for anyone in sales, support or risk who uses AI tools at work, since that duty has applied for nearly two years. Third, list every system that talks to a person, because that is the Article 50 question, and it is live now.
The same pattern shows up in payments rules more often than people expect: a headline date moves, and the obligations underneath it that were already live get forgotten. I wrote about it in a different setting in Visa’s VAMP Ratio, Read From the Merchant Side, where a threshold change was the news but the counting method was what mattered.