EU AI Act delayed: what the Digital Omnibus to 2027 really means

Update of 15 October 2026. When I wrote this text in June, the Digital Omnibus was still in the legislative procedure. It is now binding law: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, in force since 27 July 2026. The table and the questions still treated the change to the AI literacy duty as a proposal and the labelling under Article 50 as open. Both have been settled law since the summer. The table, the paragraph below it and the questions now give the state of 15 October 2026.

The EU AI Act was billed as the world's most ambitious AI rulebook. Now it is being stretched in time and freed from overlapping requirements through the so-called Digital Omnibus. Many headlines read like an all-clear. That is the wrong lesson. What moves are mainly the deadlines for high-risk systems, the risk-based core stays, and in places Brussels is even tightening.

What has actually changed

The official reason for the deferral is that the necessary tools were missing: harmonised standards were not ready and national authorities not fully designated. On top came significant industry pressure. What moves and what stays, at a glance:

Worth being precise: the AI literacy obligation is not abolished. The Omnibus rewrote Article 4: providers and deployers take measures to support the development of AI literacy among their staff and do not have to guarantee a specific level. So “abolished” would be wrong, “rewritten” is correct.

Why the delay happened

It was driven by an open letter from around 46 European corporations calling for a two-year stop, including names such as ASML, SAP and Siemens, with political backing from Germany for an exemption of industrial AI. The Siemens CEO made public that most of a billion-euro investment in industrial AI would go to the United States if the AI Act is not adapted. That unrealistic deadlines and missing standards are being stretched is understandable, not a scandal but a dose of realism.

The wrong lesson: delayed means done

Turning this into “let's just wait” is a mistake for three reasons. First, prohibitions and GPAI duties already apply, and from 2 December 2026 new bans are even added, for example on AI that generates intimate images of a person without their consent. Second, the real pressure does not hang on Brussels alone: customers, supply chains, liability and insurers ask for evidence regardless of any deadline. Third, December 2027 arrives faster than mid-sized companies think, and building a robust management system takes months, not days.

The right lesson: build on a system, not on a date

Precisely because the rules drift with the political wind, it is a mistake to build your AI system to a Brussels date. What is robust is a management system to ISO/IEC 42001: it makes you audit-ready independent of the exact deadline and adapts whether the rules tighten or loosen. Governance then is a capability, not a box ticked on a date. And speed needs guardrails, not bureaucracy: ISO 42001 enables speed with provability, instead of banning speed or racing blind.

In short: the AI Act gains more time, not less relevance. Those who build their AI management system now are ahead whether the rules loosen or tighten. How that looks in your organisation, we clarify in a free initial call.