EU AI Act Timeline After the Digital Omnibus: What Changed for Compliance Teams

On 24 July 2026 the Official Journal carried Regulation (EU) 2026/1744, the Digital Omnibus on AI. It came into force three days later, on 27 July. For most compliance teams the headline reads like relief: the heaviest high-risk obligations under the AI Act now land in December 2027 and August 2028 rather than 2026. Budget cycles get breathing room. Vendor selection gets a second look. The internal steering committee can slow down.

That reading is half right, and the other half is where teams get caught. A deferred compliance deadline changes when your governance documentation is audited. It does not change what your staff wrote in an email this morning, or what your model surfaced to a customer this afternoon. The obligations that touch day-to-day language, transparency and the new prohibitions, arrive on the earlier dates and stay. This post gives you the exact timeline and a way to brief your organization on it. It is general information, not legal advice.

What actually moved, and what did not

The Omnibus is a sequencing change. It pushes back the two heaviest tranches of obligations while leaving the near-term, behavior-facing duties untouched. The distinction that matters for planning is between duties that govern your systems (documentation, risk management, conformity assessment) and duties that govern your outputs and conduct (transparency to users, banned practices).

The dated timeline after the Omnibus

Read the table top to bottom and the shape is clear. The two dates that involve heavy engineering and paperwork moved out. The two dates that involve what a person or a system says to another person did not. Transparency at 2 August 2026 and the new prohibitions at 2 December 2026 govern conduct, and conduct happens every day regardless of what the audit calendar says.

The gap the deferral opens

Here is the practical trap. When a deadline slips 18 months, attention slips with it. The governance workstream that was tracking toward a 2026 conformity milestone loosens, and the loosening quietly extends to controls that were never deferred at all. The organization tells itself it has time. Meanwhile the transparency duty is already binding, and the ordinary output of a well-meaning employee still carries the same exposure it always did. Regulators do not read your project plan before they read your messages, and neither does a claimant’s counsel. The two are on entirely separate clocks, and only one of them was reset in July.

That exposure has a track record that predates the AI Act entirely. Consider an aircraft manufacturer whose internal instant messages, written quickly and never meant to leave the room, included lines like “designed by clowns, who in turn are supervised by monkeys” and “I basically lied to the regulators.” Those messages became central to a USD 2.5 billion deferred prosecution agreement. No regulation deferral would have helped, because the risk was in the sentence, not in the compliance framework around it. A generated draft, a customer-facing chatbot reply, or an internal note that a colleague fires off today sits in exactly the same category: written in seconds, stored forever, discoverable later.

A one-page brief for your steering committee

Use this decision table to keep the deferral from being misread across your organization. Each row is a duty; the column that matters is whether the Omnibus actually bought you time.

The bottom row is the one people forget. It was never on the AI Act clock, so no deferral touches it. It is the line an employee sends today. For a fuller working resource on the Act’s tiers, prohibitions, and transparency duties, our EU AI Act resource hub breaks each section down with checklists and self-assessment tools.

Where a pre-send check fits, honestly

A pre-send check reads a draft at the moment before it is sent and flags the phrase that creates exposure, then offers a short, safer way to say the same thing. On the aircraft example above, a scan of that text flags the admission and the disparagement at phrase level:

• CRITICAL, legal: “I basically lied to the regulators” → admission of misleading a regulator. Recommended: remove the sentence.
• HIGH, reputational: “designed by clowns, who in turn are supervised by monkeys” → disparaging language about your own team. Recommended: remove the sentence.

Be clear about the boundary. This is a front-end shield for accidental human risk, the careless line a well-intentioned person does not notice before hitting send. It is not an adversarial security control: it will not stop a determined bad actor or a prompt-injected agent that is trying to do harm. It complements your archiving and supervision stack (Smarsh, Proofpoint) rather than replacing it. Those systems catch and store what already went out; a pre-send check reduces how much problematic content reaches their queues in the first place. Fewer issues to review, fewer to explain later.

That framing also maps cleanly onto the transparency duty going live on 2 August. Article 50 is, in practice, a set of rules about wording: telling a person they are talking to a system, and labelling AI-generated or manipulated content so it is not passed off as human or authentic. Those are disclosure decisions made in the copy itself, so the point of communication is the natural place to reinforce them. A draft that quietly presents a generated reply as a colleague’s own words is precisely the kind of accidental slip a pre-send check is built to surface.

The takeaway

Do two things this quarter. First, split your AI Act programme into the two tranches the Omnibus created, and protect the momentum on the near-term duties (transparency from 2 August 2026, prohibitions from 2 December 2026) so the deferred 2027 and 2028 dates do not drag them backward. Second, treat everyday message and output risk as a standing control that lives outside the timeline entirely, because it always did. The regulation moved. The sentence your team writes today did not. This is general information and not legal advice; confirm specifics with your own counsel.