The EU defers AI Act high-risk rules in the Digital Omnibus (2026)

In late 2025 and early 2026 the European Union amended its own AI Act before much of it had taken effect. The change came through what the European Commission’s regulatory-framework page calls the “AI omnibus,” part of a broader Digital Omnibus simplification package. The Commission states that the proposal “has been adopted on 19 November 2025 and a political agreement was reached on 7 May 2026.” The headline effect was to defer the AI Act’s high-risk obligations, the part of the law that the 2024 regulation had originally set to apply in full on 2 August 2026.

The two new application dates the Commission sets out are later than the original schedule. Per the regulatory-framework page, “Rules for systems used in certain high-risk areas — including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027,” and “For systems integrated into products such as lifts or toys, the rules will apply from 2 August 2028.” In its own announcement of the political agreement, the Commission frames the package as making “the implementation of the AI Act for EU businesses easier while maintaining its benefits for European society, safety and fundamental rights,” and explains the postponement as a matter of sequencing: “This sequencing will help ensure that technical standards and other support tools are in place before the rules start to apply.”

Not everything moves. The earlier-phased pieces of the AI Act stay in force on their original timing: the Commission’s page states that “the prohibitions became effective in February 2025” and “the AI Act rules on GPAI became effective in August 2025.” The deferral reaches the high-risk tier, not the unacceptable-risk prohibitions or the general-purpose-AI obligations.

Why business readers should care: the EU enacted the world’s first comprehensive AI law (see 2024-eu-ai-act) and then, before its central high-risk provisions bound anyone, pushed them back by more than a year. For organizations building or deploying high-risk AI systems in Europe, the compliance clock the 2024 regulation set has moved: the practical deadlines are now December 2027 and August 2028 rather than August 2026. The GPAI rules and the prohibitions remain the parts already live and enforceable.