EU AI Act and Email Compliance: What Changes for Written Communication

On 29 June 2026, the Council gave final approval to the Digital Omnibus, the package that pushes the EU AI Act’s high-risk obligations from August 2026 to 2 December 2027. Most compliance teams read that as a reprieve and moved on. It is not. One deadline in the original text was never touched by the Omnibus, and it lands in about four weeks: 2 August 2026, when the Article 50 transparency duties become enforceable. Teams that spent the last month tracking the deferred date are now four weeks from a live one they stopped watching.

What the Omnibus actually changed

The Digital Omnibus is not yet published in the Official Journal. Until it is, the original AI Act text remains binding law, though the political outcome is settled enough that most legal teams are already planning against it. Here is what moved and what did not.

What moved:

• High-risk duties under Annex III (hiring, credit, biometrics, insurance, essential services): from 2 August 2026 to 2 December 2027.
• High-risk duties under Annex I (AI embedded in regulated products): from 2 August 2027 to 2 August 2028.
• The AI literacy duty under Article 4: softened from an obligation to ensure a level of literacy to a duty to support and promote it through proportionate measures.
• Two new prohibitions were added, covering non-consensual intimate imagery and CSAM generators, effective December 2026.
• SMEs and start-ups got sandbox relief: more time and priority access.

What did not move:

• Prohibited practices under Article 5 (social scoring, manipulative or exploitative systems, workplace or school emotion recognition): in force since February 2025.
• The AI literacy duty itself, now in its softer form: also since February 2025.
• GPAI model rules (documentation, copyright, training-data transparency): in force since August 2025.
• Transparency duties under Article 50: 2 August 2026, unchanged.
• The penalties framework: up to €35,000,000 or 7 percent of global annual turnover, whichever is higher, for violations of the prohibited practices in Article 5.

Where a written communication tool actually sits

The Act sorts AI systems into four tiers, and the question a compliance officer usually asks is which tier an email or writing-compliance tool falls into.

Annex III’s employment category is the one worth reading carefully, because it does not cover every tool that touches an employment relationship. It covers AI systems used to make or materially inform decisions on recruitment, promotion, termination, or task allocation based on individual behavior, personality traits, or performance monitoring. A tool that flags a risky sentence in a draft email, before it is sent, and leaves the decision to the person writing it, is not making or materially informing an employment decision about that person. A tool that scores individual employees and feeds those scores into a promotion or termination decision is a different thing entirely, and worth checking against Annex III regardless of the December 2027 date, since building toward that use case now means designing for high-risk duties from day one.

This is a real distinction, not a technicality to route around it. Anonymized, department-level signal and individual behavioral scoring answer different questions, and the Act treats them differently for a reason.

What still applies to you, regardless of the Omnibus

Four things do not wait for Annex III, whatever your organization deploys:

• AI literacy (Article 4). Since February 2025, softened but not removed. If staff use AI tools, including public ones like ChatGPT or Copilot, there is a live duty to support their understanding of what those tools do and where the risk sits.
• Transparency for AI-generated content (Article 50). Four weeks out. If any AI-generated or AI-assisted content reaches a person who reasonably needs to know an AI was involved, that disclosure duty is close to live, not deferred.
• Shadow AI as a data protection question. Staff pasting confidential or personal data into public AI tools is a GDPR and confidentiality problem today. The Act’s deferral of Annex III does not touch this; it was never an Annex III question to begin with.
• Everyday communication risk. A single sentence in an email, a Slack message, or a LinkedIn reply can create regulatory exposure, from a misleading claim to a confidentiality breach, independent of any AI Act deadline. This exposure was live before the Act existed and stays live regardless of the Omnibus.

A useful test for any AI-assisted process in your organization: does a person decide, or does the system decide? If a human reviews the flag and chooses whether to act on it, you are far more likely sitting in the minimal or limited tier. If the system’s output becomes the decision, without a person meaningfully able to override it, look at Annex III now rather than in 2027.

Deployer or provider: a distinction worth getting right

The GPAI rules that took effect in August 2025 apply to providers of general-purpose AI models: documentation of training data sources, copyright compliance summaries, technical information for downstream integrators. Most organizations reading this are not providers. If your writing-compliance tool, your email assistant, or your internal chatbot runs on a model from OpenAI, Anthropic, Google, or another foundation model provider, the GPAI documentation duty sits with that provider, not with you.

What does sit with you, as a deployer, is narrower but still real: knowing which models power the tools your staff rely on, keeping a record of that for when a customer or auditor asks, and reading the provider’s own transparency documentation rather than assuming it does not apply because you did not build the model. A vendor that cannot point to its own GPAI documentation, or that is vague about which model does the underlying work, is telling you something worth noting before the contract is signed, not after.

Where a pre-send check fits, and where it stops

VerbaPulse is not an AI Act compliance platform. It does not classify AI systems, run conformity assessments, or replace legal obligations. What it does sit under is the human-use layer the Omnibus deferral does not touch: it supports AI literacy in the moment a person is writing, gives department-level visibility into where AI-assisted communication carries risk, and flags language before a message sends, leaving the decision to the person writing it. That last part matters for the distinction above: the person stays in the loop, which is also the design choice that keeps a pre-send check out of Annex III’s individual-decision territory rather than a way of avoiding the question.

The EU AI Act toolkit on our site has a role-based self-assessment and a checklist for what applies to you today, separate from what is coming in 2027. It is orientation, not legal advice, and the usual caveat applies: confirm specifics with counsel before you rely on any of it.

The one thing to do this week

Do not wait for the Official Journal publication to act. Four weeks is short enough that Article 50 exposure needs checking this week, not planned for next quarter. Then, separately and on its own timeline, decide whether anything you are building toward touches Annex III’s individual-decision territory. Those are two different clocks, and the Omnibus only reset one of them.