The EU AI Act "Delay" Is Real. So Is Everything It Didn't Delay.

What actually changed

The Digital Omnibus on AI, now Regulation (EU) 2026/1744 and in force since late July, made targeted amendments to the AI Act. The headline changes:

• High-risk systems under Annex III (think hiring and HR tools, credit scoring, biometrics, critical infrastructure) moved from August 2, 2026 to December 2, 2027.
• High-risk AI embedded in regulated products under Annex I moved from August 2, 2027 to August 2, 2028.

That's the part everyone read. Here's the part a lot of people skipped.

What did not move

• Article 50 transparency obligations applied from August 2, 2026, on schedule. People must be told when they're interacting with an AI system, and AI-generated or manipulated content (deepfakes, certain AI-generated text published to inform the public) must be disclosed.
• Machine-readable marking of synthetic content gets only a short grace period for generative AI systems already on the market before August 2, 2026. That grace period ends December 2, 2026. Systems placed on the market after August 2 get no grace period at all.
• General-purpose AI model obligations have applied since August 2025.
• Prohibited practices and AI literacy have been on the books since February 2025 (the Omnibus touched Article 4, so check the current text before you rely on an old memo).
• The EU AI Office's enforcement powers are live.

The Omnibus didn't cancel the exam. It moved one section to next year and left the rest on the schedule.

Why in-house teams should care even if you're "not an AI company"

You don't have to build a foundation model to be in scope. If your company deploys a customer-facing chatbot in the EU, publishes AI-generated marketing content, or uses AI tools in recruiting, some part of the Act likely touches you. And the high-risk category most likely to catch ordinary enterprises is exactly the one that got delayed: employment-related AI. HR has probably bought something with "AI" in the name since you last checked.

Your practical to-do list

Before December 2, 2026

1. Inventory customer-facing AI. Chatbots, virtual agents, AI-assisted support. Confirm each one discloses that it's AI.
2. Check your content pipeline. Marketing, comms, and product teams using generative tools to create public-facing images, video, or audio need a labeling approach. Your marketing compliance review process is the natural checkpoint.
3. Ask your vendors about marking. If you deploy generative AI from a third party, find out how they're handling machine-readable marking and what they need from you.

Use the 16-month runway for high-risk

4. Map every AI system touching hiring, promotion, performance, or termination. Get vendor documentation now, while you still have leverage.
5. Assign ownership. Someone in legal, HR, and IT should each know what they're accountable for.
6. Build documentation habits early. Risk assessments, human oversight procedures, and logging are much easier to design in than to retrofit.

Ongoing

7. Make AI literacy real. A single training slide deck from 2025 won't cut it. Tie training to the specific tools people actually use.
8. Track the rest of the Digital Omnibus. Broader amendments touching GDPR and other EU digital laws are still moving through the process.

The bottom line

The delay bought time for the hardest part of the AI Act, not a pass on the whole thing. GCs who use the next 16 months to build an inventory and a governance rhythm will be calm in December 2027. Everyone else will be buying a lot of outside counsel hours that month. If you need tools to track obligations across entities and jurisdictions, start with the corporate and regulatory compliance category on CorporateLegal.tech.

This article is general information, not legal advice. Confirm current obligations against the official text and your own counsel.