What happened
The European Commission proposed the Digital Omnibus on AI in November 2025, and EU lawmakers reached agreement in May 2026. The amendment has been in force since 27 July 2026. It moves the obligations for stand-alone high-risk AI systems, such as those used in hiring, credit scoring, education and critical infrastructure, from August 2026 to 2 December 2027. High-risk AI embedded in regulated products, such as medical devices and machinery, moves to 2 August 2028.
What did not move
The bans on prohibited practices have applied since February 2025. Rules for general-purpose AI models have applied since August 2025. The transparency duties for AI that interacts with people or generates content apply on their original schedule. The delay changes when high-risk duties start, not what they require.
What it means for you
The Act applies to organisations outside the EU when their AI systems are placed on the EU market or their outputs are used there. Enterprises in India, the Gulf and Australia with European customers or employees should treat it as their own rulebook.
- BFSI: credit scoring and insurance pricing for individuals are high-risk uses.
- Healthcare: AI inside medical devices follows the August 2028 date.
- Professional services and SaaS: AI used in recruitment or for managing workers is high-risk.
What to do this quarter
- Classify each AI use against the Act's risk levels, and record why.
- Use the extra time to build documentation, human oversight and logging into agents now, rather than retrofitting in 2027.
- Check that transparency notices are already in place where agents talk to people.
Sources
This update is general information, not legal advice. Check how it applies to you with your legal team.
