Search for a command to run...
The European Commission's AI Omnibus proposal pushes high-risk AI rules to late 2027. Here's why smart teams won't slow down — and what to do with the extra runway.
Senior Freelancer & Technical Lead
Working as a Golang developer since 2020. Working as a mobile developer since 2013.
Focussed on architecture, testability and clean code. Open minded & product driven. Based in Rhede, available world-wide
No comments yet. Be the first to comment.
How to implement comprehensive software supply chain tracking using Open Component Model that captures dependencies, deployment artifacts, signatures, and version constraints across distributed systems.
A practical framework for evaluating and migrating from deprecated ingress controllers to Gateway API or Envoy Gateway, including risk assessment and zero-downtime migration patterns.
How modern software supply chains use component models to track dependencies, artifacts, and metadata across distributed systems, moving beyond traditional SBOMs to comprehensive delivery tracking.
How to implement comprehensive software supply chain tracking using the Open Component Model that captures dependencies, deployment artifacts, configurations, and runtime bindings across multi-repository environments.
Master React performance optimization through systematic profiling, efficient rendering patterns, and smart bundle splitting strategies for production applications. Learn practical techniques that actually move the performance needle.
On this page
In February 2026, the European Commission published its Digital Omnibus proposal — a legislative package that, among other things, pushes back the enforcement dates for high-risk AI systems under the EU AI Act.
The new timeline:
The reason? Harmonised standards aren't ready. National authorities haven't been designated. Conformity assessment bodies are still being set up. The infrastructure for enforcement doesn't exist yet.
In short: the regulators aren't ready to regulate.
If your reaction is "great, we can push AI governance to next year" — think again.
The EDPB and EDPS joint opinion on the Omnibus makes the tone clear: the data protection authorities are uncomfortable with these delays. They explicitly warned that postponement may "harm fundamental rights and undermine legal certainty." They'd prefer the original timeline to remain in place.
Here's what this means practically:
The GPAI rules already apply. General-purpose AI model obligations — transparency, documentation, copyright compliance — took effect in August 2025. The AI Office can begin enforcement from August 2026. That's five months away.
The Omnibus is a proposal, not law. It still needs European Parliament and Council approval through trilogues. The final timeline could change in either direction.
NIS2 deadlines are converging. The Cybersecurity Act 2 and amended NIS2 Directive proposals are open for feedback until April 2026. If your AI systems touch critical infrastructure, you're dealing with overlapping regulatory waves.
Your customers won't wait. Enterprise procurement teams are already including AI Act compliance in RFPs. "We'll be ready by 2027" isn't going to win deals in 2026.
Beyond the timeline shift, the proposal makes substantive changes worth understanding:
Currently, you can only process special category data (ethnicity, health, etc.) for bias detection in high-risk systems under strict necessity. The Omnibus would extend this to all AI systems and lower the threshold from "strictly necessary" to "necessary and proportionate."
The EDPB pushes back hard here — they see this as weakening GDPR safeguards. If you're building AI systems that touch sensitive categories, expect this provision to be heavily debated.
The current AI Act requires all Annex III systems to register in the EU high-risk database, even if a provider self-classifies them as non-high-risk under Article 6(3). The Omnibus would remove this for self-classified non-high-risk systems.
The EDPB strongly opposes this, arguing it reduces visibility and incentivises "overly optimistic self-assessment." Translation: companies will classify themselves out of obligations if given the chance.
The proposal creates EU-level regulatory sandboxes run by the AI Office. National sandboxes already existed, but cross-border sandboxes could help smaller companies test AI systems without navigating 27 different regulatory environments. The catch: data protection authority involvement isn't explicitly required, which the EDPB wants fixed.
AI systems integrated into very large online platforms (VLOPs/VLOSEs) would move under the AI Office's exclusive supervision. This centralisation makes sense — nobody wants 27 national authorities independently auditing the same platform's AI.
The extra runway is a gift, but only if you use it. Here's the play:
You can't comply with rules you can't map. Most companies still don't have a clear picture of which AI systems they run, where they got the models, and what data they process. Start here.
Risk assessments, documentation templates, human oversight procedures — this stuff takes months to get right in practice. The organisations that'll be ready by late 2027 are the ones starting in Q1 2026, not Q1 2027.
If your AI touches critical infrastructure sectors (energy, transport, health, finance), NIS2 obligations are arriving on a parallel track. Your compliance architecture needs to handle both.
The proposal is open for trilogues throughout 2026. Industry input shapes the final text. If a specific provision affects your business, now is the time to make your position known — through trade associations, consultations, or direct engagement.
The Commission already extended once. Another push-back is politically difficult. Plan for December 2027 as a hard stop, and build buffer into your timeline.
The EU AI Omnibus is an honest acknowledgment that the regulatory infrastructure isn't where it needs to be. The Commission chose pragmatism over symbolic enforcement — which, frankly, is the right call. Enforcing rules nobody can verify benefits no one.
But the direction hasn't changed. The AI Act will be enforced. The question was never if, only when and how strictly.
Companies that treat this delay as extra preparation time will come out ahead. Companies that treat it as permission to ignore AI governance will have a very expensive 2027.
Your call.