It's Official: The Digital Omnibus Passed. Here's What Changed in the EU AI Act (and What Didn't)

For months, every article about the Digital Omnibus — including ours — carried the same caveat: it's only a political agreement, it isn't law yet, treat the current rules as binding until it's adopted. That caveat is now spent. The Omnibus has been adopted.

The European Parliament endorsed it on June 16, 2026, and the Council gave its final approval on June 29. It enters into force on the third day after publication in the Official Journal, which is imminent. This is the first substantive amendment to the EU AI Act since it was adopted in 2024, and it changes real dates and real obligations. Here's what's settled now.

It's adopted, not proposed

The distinction matters because it changes how you plan. A proposal can shift during negotiation, so the responsible move was to keep planning to the original text. An adopted law doesn't shift. The deadlines and wording below are now the ones you build your compliance programme around, not a forecast of what they might become.

What actually changed

Three changes matter for most companies.

The high-risk deadline moved to December 2, 2027.The obligations for stand-alone Annex III high-risk systems — risk management, technical documentation, human oversight, conformity assessment — are deferred from August 2026 to December 2, 2027, a 16-month push. For AI embedded in regulated products under Annex I, the deadline moves to August 2, 2028. This is the headline change and the one being widely misread as "the AI Act got delayed." It didn't. One track did.

AI literacy softened. Article 4 changes from a duty to ensure a sufficient level of AI literacy to a duty to take measures to support the development of it. That moves it from an outcome obligation to an effort one. We covered the nuance when it was still a proposal in this breakdown — the practical advice hasn't changed, but it's now confirmed rather than pending.

New prohibitions were added.Article 5 now bans AI systems that generate non-consensual intimate imagery ("nudifiers") and child sexual abuse material. These are added to the list of outright prohibited practices.

What did not change

This is the part that gets lost in the "deadline moved" headlines, and it's the most important line in this whole post: the Article 50 transparency obligations still apply from August 2, 2026. The Omnibus left them untouched.

So the deadline that applies to the widest set of companies — anyone with a chatbot, anyone generating content, anyone building on a foundation model — did not move. If you took "the AI Act got delayed to 2027" at face value and relaxed, you relaxed about the wrong deadline. The one that's a month away is still a month away.

So what do you do now

• Treat August 2 as real and near. Transparency disclosures, chatbot notices, content labelling, and GPAI obligations all still land then. Our Article 50 checklist is the fastest way to scope it.
• Re-plan the high-risk track around December 2027, but don't shelve it. Sixteen extra months is time to do it properly, not permission to start in 2027. The documentation is a marathon.
• Right-size your AI literacy effort. The softer standard is now confirmed. A proportionate, documented training effort satisfies it.
• Check the new prohibitions apply to nothing you do. If any product feature touches synthetic intimate imagery, that's now a prohibited practice, full stop.

The Omnibus is a genuine simplification, and for high-risk builders it's real breathing room. But the story most people are telling themselves about it — "we got more time" — is only true for one track. For the deadline that hits first and hits widest, nothing changed. Plan accordingly, and if you're not sure which track you're on, start with a free classification.