Digital Omnibus: AI Act Deadlines Pushed to 2027

On 7 May 2026, the Council, the European Parliament and the European Commission reached a provisional agreement on the Digital Omnibus on AI. The deal pushes several of the heaviest obligations under the EU AI Act months into the future. For SMBs that is good news, but it does not mean you can sit back and wait.

The Digital Omnibus is an EU simplification package that streamlines parts of the AI Act and defers a number of its deadlines, giving businesses and regulators more time to prepare. The package is meant to make the rules more workable, especially for smaller companies, without abandoning the core of the law. Some obligations move; others stay exactly where they were.

This article explains what changes, what it means for your business, and which dates still stand. One note up front: this is general information, not legal advice. For your own situation we recommend consulting a lawyer or a specialised advisor. We build on our complete explainer on AI legislation in the Netherlands and the EU AI Act, so read that first if you need the fundamentals.

What exactly changes?

The heart of the Digital Omnibus is deferral. Several deadlines that originally fell in August 2026 or 2027 move later, giving businesses that use high-risk AI more breathing room. Here is the overview in a table:

A few of these deserve a closer look.

High-risk Annex III moves more than a year

The obligations for so-called Annex III systems shift from 2 August 2026 to 2 December 2027. That is roughly 16 months later. Annex III covers AI that counts as high-risk based on how it is used: think of AI in recruitment and selection, credit scoring, or biometric identification. For many SMBs this is the most relevant category, because AI in hiring or in assessing customers falls directly under it.

High-risk Annex I moves a year

Annex I systems are AI already covered by existing product regulation, such as medical devices, lifts and radio equipment. That deadline moves from 2 August 2027 to 2 August 2028. This mainly affects manufacturers and companies that put physical products with embedded AI on the market.

Transparency and marking: partly deferred

There is an important nuance here. The duty to mark synthetic, AI-generated content is split by timing:

• For content placed on the market before 2 August 2026, the obligation moves from 2 August 2026 to 2 December 2026.
• For content placed on the market after 2 August 2026, the transparency duty simply applies from that point.

In other words, the deferral does not cover everything. New AI content you publish after August 2026 still has to meet the marking rules right away. For what that duty actually involves, read our article on the AI transparency requirements for businesses.

Two new prohibited practices

The Digital Omnibus also adds two prohibitions that take effect on 2 December 2026. It becomes prohibited to use AI to:

• Generate or manipulate non-consensual intimate imagery.
• Produce child sexual abuse material.

These are additions to the list of prohibited practices that the AI Act already contained. For most SMBs this is not a practical concern, but it is worth knowing that the list of banned uses has grown. The same technology behind manipulated media is also abused for scams: read how to protect your business against deepfakes and CEO fraud.

Simplification for SMBs

Beyond deferral, the Omnibus includes several simplifications that help SMBs directly:

• The existing exemptions and relief for SMBs are extended to "small mid-caps" (SMCs), a category just above the classic small-business bracket.
• Companies get broader room to process sensitive data for detecting and reducing bias in AI systems.
• The powers of the AI Office (the European oversight body) are reinforced.

Which deadlines still stand?

Not everything moves. Two things stay firmly on the old date of 2 August 2026:

1. GPAI obligations. The rules for general-purpose AI models (the large, broadly usable models) remain on track. Providers of these models still have to meet the transparency and documentation requirements from 2 August 2026.
2. The AI Office's full enforcement powers. The fines, information requests and enforcement tools of the regulator take effect as planned on 2 August 2026. These were not deferred.

That is a meaningful signal. The EU is delaying the heaviest compliance burden for users of high-risk systems, but keeps the enforcement machinery and the rules for the large model providers fully in place.

There is one more critical caveat. The new dates only become legally binding once the Digital Omnibus is formally adopted and published in the EU Official Journal. At the time of writing, publication is expected before 2 August 2026, but that is not guaranteed. Until that publication, the old dates formally remain in force. So do not plan your compliance solely around the new dates until the text is officially published.

Want to understand what the original August deadline meant and how to prepare for it? Read our article on the EU AI Act in August 2026 and what to do now.

What does this mean for your business?

For most SMBs, here is what changes in practice.

More breathing room for high-risk uses. Do you use AI in recruitment and selection, in assessing creditworthiness, or for biometrics? Then you have until 2 December 2027 instead of 2 August 2026 to meet the high-risk obligations. That buys more than a year of preparation time for documentation, risk assessments and human oversight.

The transparency rules are still coming. The deferral for marking AI content is limited and partial. If you publish new AI-generated text, images or video after August 2026, you have to mark it. This affects companies that use AI for marketing, content or customer communication. Those same companies also run into questions about AI and copyright, and who actually owns AI content.

Don't stop preparing. A delay is not a cancellation. The obligations are coming, just later. Companies that start now by mapping their AI use will be in a much stronger position than companies that wait until the deadline is in sight. The extra time is meant for getting prepared properly, not for ignoring the topic.

Many business owners lose a lot of time figuring out which rules actually apply to them, especially because the dates keep shifting. A focused intake with an advisor takes that legwork off your plate.

What you mainly need to do now is get clarity on which category your AI use falls into. Most SMB use cases fall under limited or minimal risk, for which the heavy high-risk obligations do not apply. But you have to be able to back that up. A solid AI Act compliance checklist helps you do that systematically.

How do you stay prepared?

The Digital Omnibus shows that the regulation is still very much in motion. That is exactly why it makes sense to keep a steady routine, regardless of whether a deadline moves or not.

Keep an AI inventory. Maintain an up-to-date list of every AI system you use or develop: which vendor, which purpose, which data, and which risk category it falls into. That inventory is the foundation of any compliance approach, and you will need it either way.

Watch the transparency duty. This is the obligation that reaches SMBs fastest, because so many companies use AI for content and customer communication. Make sure you mark AI content and that your chatbots make clear that users are talking to AI.

Track the official publication. Keep an eye on whether the Omnibus actually appears in the Official Journal. Only then are the new dates final. Build that into your planning.

Get advice where needed. The rules are complex and change quickly. A short advisory session can save you a lot of misdirected effort and prevents you from either missing obligations or overestimating how heavy they are.

The Digital Omnibus gives SMBs some air, but it does not change the direction. The AI Act is coming, just on a slightly more generous timeline for high-risk uses. The smartest approach is to use the extra time: map your AI use, handle the transparency that already applies now, and build toward compliance steadily instead of forcing it at the last minute. Unsure about your own situation, or want to know which obligations concretely apply to you? Our AI consulting team helps you translate the rules into a practical plan, without legal jargon and without panic.