The Digital Omnibus Is Law: The Compliance Clock Restarts

Across the board tables we work with, spring 2026 was dominated by a single date: August 2nd. Compressed remediation plans, vendors questioned about system classification, compliance budgets approved in a hurry, with a widespread feeling that time was running out. On July 24th, the Official Journal of the European Union changed that calendar.

Regulation (EU) 2026/1744, the AI Digital Omnibus, entered into force on July 27th, 2026. It amends the AI Act (Regulation 2024/1689), the Machinery Regulation and the civil aviation framework, while leaving the risk-based architecture untouched. Deadlines move, prohibitions expand, supervision becomes more centralised. Reading this as a simple postponement means grasping half of the news.

The Dates Move, the Framework Does Not

The core of the amendment is the rewriting of Article 113 of the AI Act. Obligations for high-risk systems under Annex III, the standalone ones used in areas such as recruitment, credit, education and essential services, shift from August 2nd, 2026 to December 2nd, 2027. For high-risk systems embedded in already regulated products, Annex I, the new deadline is August 2nd, 2028.

What stays in place: the prohibitions applicable since February 2025, the regime for general-purpose AI models, the sanctions framework and the general application date of August 2nd, 2026. The transparency obligations of Article 50, the ones covering the marking of AI-generated content, gain a grace period until December 2nd, 2026 for systems already on the market.

And something new comes in, largely overlooked in this week's commentary: from December 2nd, 2026, systems designed to generate non-consensual intimate material or child sexual abuse material, including so-called nudification apps, will be prohibited. The legislator loosens the calendar and, in the same act, raises the bar on what it considers unacceptable.

Sixteen Extra Months, to Do What

The most comfortable reading of the deferral is also the most dangerous one: we have time, let's revisit this in 2027. That is the same logic that produced the numbers we already know. According to the Artificial Intelligence Observatory of Politecnico di Milano (February 2026), 71% of large Italian companies have active AI projects, yet only 9% have structured governance in place. The gap between those two figures does not come from a lack of time, it comes from a lack of decisions.

A company that would have arrived unprepared in August 2026 will arrive just as unprepared in December 2027, if it uses the extension to freeze the topic. A company that treats the sixteen months as a working window can do what the tight deadline made nearly impossible: map the systems in use, understand which ones will fall under Annex III, measure its actual maturity on data and capabilities, and only then build the remediation plan. Compliance done under deadline produces documents, governance built with method produces capability.

AI Literacy, From Obligation to Choice

There is a second passage in the Regulation that deserves more attention than it is getting. The AI literacy obligation of Article 4 is softened: the prescriptive wording gives way to measures necessary to develop AI literacy, leaving organisations a wider margin of interpretation.

In our experience the need stays intact, what changes is who carries the responsibility for it. When training was a formal requirement, many companies treated it exactly as such: a recorded course, a certificate, a box ticked. Now that the formal constraint loosens, the difference will be made by those who train their people because they need to, because without a shared language between business, IT and risk, projects stall at the pilot stage, and stalled pilots are precisely what 71% of companies already have in house. Training chosen out of conviction is worth more than training endured out of obligation, and from September onwards it will become visible who belongs to which group.

Supervision Moves to the Centre

The Regulation gives the AI Office clearer and more centralised oversight powers over systems integrating general-purpose models and over those connected to very large online platforms. At the same time, the deadline for national regulatory sandboxes slips to August 2nd, 2027, and simplification measures are introduced for SMEs and small mid-caps.

Read as a whole, the design describes enforcement shifting towards Brussels while the national level buys time. For a European company this means something concrete: the authority scrutinising the most relevant systems will be a central one, with extended powers, and the quality of internal documentation, registers, impact assessments, decision logs, will weigh more than local interpretations. Preparing for a centralised supervisor requires traceability, and traceability cannot be improvised on the eve of a deadline.

From Here to December 2027

The reasonable calendar for a board, seen from the tables where we operate, has three stages. By the end of 2026: a census of AI systems in use and in procurement, with a first classification against Annexes I and III, because the extension only helps those who know what they have. Through 2027: measurement of organisational maturity, gap analysis on governance and processes, explicit decisions on what to scale and what to stop, and on what deserves a prototype before full investment. Close to the deadline: formal remediation, which by then is the easy part.

The reference remains the published text: Regulation (EU) 2026/1744, Official Journal of the European Union, L series, July 24th, 2026, together with the consolidated AI Act and ISO/IEC 42001 for those who want a structured management system. Everything else, commentary included, should be checked against the source.

The Union has reset the compliance clock without switching it off. The question that matters now is not about Brussels, it is about companies: how many will use these sixteen months to decide, and how many will use them merely to wait?