The EU Pushed Back Its Deadline for High-Risk AI Systems — Not the Duty to Govern Them

On July 24, 2026, the EU published the Digital Omnibus regulation (2026/1744) in its Official Journal; it entered into force three days later. Its headline effect is a deferral of mandatory compliance for "high-risk" AI systems: standalone systems under Annex III now have until December 2, 2027 instead of August 2, 2026, and AI embedded in products already covered by other EU product-safety law (Annex I) has until August 2, 2028. The stated reason is that member states hadn't finished designating national supervisory authorities, and the harmonized standards needed for conformity assessment weren't ready.

The detail easy to miss behind headlines about a "delay": not everything moved. Transparency and AI-content-labeling requirements under Article 50 took effect exactly as originally scheduled, on August 2, 2026 — alongside the ban on certain AI practices (in force since February 2025) and the obligations for providers of general-purpose AI models (in force since August 2025).

For companies working with EU-facing products or clients, or simply using models from foreign providers, that's a useful reminder not to confuse "deadline pushed" with "can wait." It's the exact confusion we see most often in COBIT audits: a formal deadline moves, and the underlying work — who's accountable for AI decisions, how it's documented, what happens with the data — quietly gets treated as postponed too, even though part of it is already in force. On our retainer support, we help clients keep those two things separate: what the regulator actually deferred, and what needs doing now.