The AI Omnibus: what the 2026 amendment did to the clock

Lesson 3 of 5 in The EU AI Act Interface: Harmonized Standards and the 42001 Playbook.

By late 2025 the mismatch had become politically untenable: high-risk obligations were due to bite in August 2026, while the standards meant to make compliance practicable were still in drafting. The Commission’s answer arrived on 19 November 2025 as part of the Digital Package on Simplification — universally nicknamed the AI Omnibus. Political agreement followed on 7 May 2026, and the amending act entered into force on 27 July 2026.

Its headline move was surgical: postpone the high-risk obligations, leave the rest of the Act running. The Annex III use-case obligations (employment, credit, education, essential services and the rest) moved from 2 August 2026 to 2 December 2027. The Annex I obligations — AI embedded in regulated products like machinery and medical devices — moved to 2 August 2028. Everything else stayed on schedule: the prohibitions and AI-literacy duties had applied since 2 February 2025, the GPAI rules since 2 August 2025, and the bulk of the remaining Act became applicable on 2 August 2026 as planned. The Omnibus also added substance: a ninth prohibition — AI-generated non-consensual intimate imagery and CSAM — applicable 2 December 2026, a strengthened AI Office, expanded regulatory sandboxes, and simplifications for SMEs and small mid-caps.

Read the delay strategically, not as a holiday. Three implications matter for anyone running an AI governance program.

The window is for building, and it is shorter than it looks. An organisation starting an AIMS in late 2026 has roughly a year to stand up governance, run it long enough to generate evidence, and map that evidence to Arts 8–15 before December 2027. That is a normal 42001 implementation timeline with zero slack.

Drafts are load-bearing but unstable. Building against prEN 18286 and its siblings today is rational — they signal where the cited standards will land — but drafts change through public enquiry and formal vote. Sensible programs track the deltas and architect controls so that a changed clause means a config change, not a rebuild. Betting the entire compliance narrative on a draft’s exact text is how you rebuild twice.

Art 41 is the wildcard. If the ENs slip again, the Commission can adopt common specifications — regulator-written, faster, less consensual. A program aligned to the Act’s own article text (with standards as implementation detail) survives either ending; a program aligned only to a draft EN does not.

Tool: Regulatory Time Machine — Scrub the 2023–2028 timeline yourself: at any date, see which AI Act provisions apply, which standards exist, and whether presumption of conformity is available — including the Omnibus before/after toggle.

Key terms: Digital Omnibus, Annex III, implementation timeline (EU AI Act), regulatory sandbox

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.