Three weeks before the 2 August 2026 deadline, the EU AI Act timeline has just changed. A European deal called the Digital Omnibus pushes back the heaviest obligations, those that fall on high-risk systems, by more than a year. For an SME leader wondering how to be ready in time, some of the pressure eases. But be careful: certain rules still apply on 2 August 2026. Here is the real timeline, dated and sourced.

Key points

• The Digital Omnibus, a provisional deal reached on 7 May 2026, pushes the deadline for Annex III high-risk systems from 2 August 2026 to 2 December 2027.
• This delay covers sensitive uses: recruitment, credit scoring, education, law enforcement, border control.
• 2 August 2026 stays active for transparency rules (Article 50): flagging that content is AI-generated, warning users they are talking to a machine.
• Machine-marking of synthetic content gets a grace period until 2 December 2026 for systems already in service.
• The deal remains provisional: it only takes legal effect once formally adopted and published in the EU Official Journal. Nothing is final until that text is published.

The Digital Omnibus, in one sentence

The Digital Omnibus is a simplification package proposed by the European Commission to adjust the AI Act timeline. EU negotiators reached a provisional agreement on 7 May 2026, confirmed on 13 May. Its stated goal: give companies and authorities more time to prepare, without removing the safeguards. It does not rewrite the law, it shifts when it applies.

What is delayed

The major change concerns Annex III high-risk systems. These are AI tools used in sensitive areas where an error can affect a person's rights: screening applications, rating a customer's creditworthiness, assessing a student, assisting a police or border decision.

According to law firm Gibson Dunn, the compliance deadline for these systems moves from 2 August 2026 to 2 December 2027, sixteen extra months. High-risk systems embedded in already-regulated products (medical devices, machinery, vehicles), covered by Annex I, see their deadline slide from 2 August 2027 to 2 August 2028.

What still applies on 2 August 2026

The delay does not empty the deadline of meaning. The transparency obligations of Article 50 are still expected on 2 August 2026. In practice, they require two simple reflexes.

First, warn users when they interact with an AI: a chatbot on your site must flag itself as such. Second, signal that content has been generated or altered by AI. For the machine-marking of synthetic content, an extra grace period runs until 2 December 2026 for systems already in service, per Gibson Dunn's reading.

Why it matters for an SME

Most SMEs are AI users, not providers. They deploy ChatGPT, Copilot or a Mistral AI model without building the underlying system. Their obligations are therefore lighter than those of large vendors. The delay on high-risk rules gives them time, but two points deserve attention now.

First point: if your SME uses AI to screen CVs or rate customers, you enter the high-risk scope as a deployer. The delay to December 2027 gives you room, not an exemption. Second point: the 2026 transparency obligations apply to you if you expose AI to your customers (chatbot, generated content). They are simple to meet and worth anticipating.

The summary table

Three useful reflexes today

These three steps cost almost nothing and put you ahead of the timeline. Above all, they avoid the last-minute panic that the delay is meant to defuse.

FAQ

Is the AI Act delayed as a whole?

No. Only certain obligations are delayed, mainly those of Annex III high-risk systems, now expected on 2 December 2027. The transparency rules still apply on 2 August 2026.

Is the delay final?

Not yet. The Digital Omnibus deal is provisional. It only takes legal effect once formally adopted by the EU institutions and published in the EU Official Journal. Until that text is published, the original timeline remains theoretically in force.

My SME uses ChatGPT: am I affected on 2 August 2026?

If you expose AI to your customers, yes, through the transparency rules: warn them they are talking to a machine and flag generated content. If you use AI internally with no high-risk use, your obligations stay limited.

What is a high-risk system, concretely?

It is AI used in a sensitive area where an error can affect a person's rights: recruitment, credit scoring, education, law enforcement, border control. These uses carry reinforced obligations, now delayed to late 2027.

Conclusion

The Digital Omnibus gives European SMEs a welcome breather on the AI Act's heaviest obligations. But the delay excuses nothing: transparency is still expected in 2026, and high-risk returns in December 2027. The right use of this window is not to wait, it is to calmly map your AI uses. To go further, explore our other regulatory analyses in the LUWAI Mag or see how SMEs have already structured their AI in our success stories.