AI Act after the Digital Omnibus: what was delayed and what applies now

What actually happened in summer 2026

The Commission tabled the “AI Omnibus” proposal on 19 November 2025, a provisional political agreement followed on 6 May 2026, and the regulation entered into force on 27 July 2026. It was adopted on 8 July and published in the Official Journal on 24 July, nine days before the original 2 August 2026 deadline that companies had spent months preparing for.

The key point is that the originally proposed “floating” delay, tied to the availability of standards, was replaced by fixed dates. Recital 40 of the regulation says so directly: Sections 1, 2 and 3 of Chapter III apply from 2 December 2027 for systems under Article 6(2) and Annex III, and from 2 August 2028 for systems under Article 6(1) and Annex I.

The Omnibus is not just a delay. It also amends Article 4 on AI literacy, adds new prohibited practices, introduces relief for smaller businesses and strengthens the powers of the European AI Office. Above all, it leaves a lot of things untouched.

The timeline after the Omnibus

Dates are based on the Commission overview (updated 3 August 2026) and on analyses by Freshfields and Gibson Dunn.

What was delayed

The delay covers Sections 1 to 3 of Chapter III. These are the requirements for high-risk systems (risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity) and the obligations of both providers and deployers, including Article 26.

For a company that deploys AI, this mainly postpones the obligations under Article 26: use the system in accordance with its instructions, assign human oversight to competent people, monitor operation, keep automatically generated logs, inform employees and their representatives before deployment in the workplace, and inform the people about whom the system makes or assists decisions.

Where are you most likely to run into a high-risk use case in a company? Among the Annex III areas, the Commission lists biometrics, critical infrastructure, education and employment. In practice this typically means tools for screening job applicants or evaluating employees, not an internal assistant over your documentation.

What already applies

Prohibited practices (Article 5)

These have applied since 2 February 2025, and the Omnibus extends them. From 2 December 2026, a ban is added on systems that generate intimate material of identifiable persons without consent and child sexual abuse material. Under Article 99, penalties for breaching Article 5 are the highest: up to EUR 35 million or 7% of worldwide annual turnover.

AI literacy (Article 4): softened, but not repealed

The original wording required companies to “ensure” a sufficient level of AI literacy. The new wording requires them to take measures to support the development of AI literacy among staff and other persons operating the systems. According to an analysis of the Official Journal text, the regulation explicitly adds that the obligation does not require guaranteeing any specific level of literacy.

In practice: every provider and deployer still has the obligation; it has merely shifted from an outcome to a demonstrable effort. Training, internal policies and records of both still make sense, not least because security and HR practice expect the same thing.

GPAI models

The obligations of general-purpose model providers have applied since 2 August 2025, and the Omnibus did not touch them. According to Mayer Brown, from 2 August 2026 the Commission has enforcement powers, including fines. Companies that merely call a model via an API do not bear these obligations; they apply to model makers.

Transparency (Article 50)

This is the part that affects most IT teams the most. Article 50 splits the obligations as follows:

• Para. 1, provider: a system intended to interact directly with people must be designed so that people know they are communicating with AI (unless this is obvious from the context).
• Para. 2, provider: outputs of generative systems (audio, image, video, text) must be marked in a machine-readable format. Only here does a transitional period apply until 2 December 2026, and only for systems placed on the market before 2 August 2026.
• Para. 3, deployer: inform the people concerned when using emotion recognition or biometric categorization.
• Para. 4, deployer: label deepfakes and, in certain cases, AI-generated text published to inform the public on matters of public interest.

Under para. 5, the information must be clear, distinguishable and provided at the latest at the first interaction. The Commission guidelines of 20 July 2026 clarify that a general mention in the terms and conditions or in a footer is usually not enough. On 10 June 2026 the Commission also published a voluntary code of practice for marking AI-generated content. According to Stibbe, breaching Article 50 can lead to fines of up to EUR 15 million or 3% of turnover.

Deployer or provider? The line runs through your code

The difference between a “deployer” and a “provider” determines the scope of your obligations. And it is not decided by whether you train your own model.

The second row is the most common blind spot. Stibbe lists chatbots, voice assistants and coding agents among the examples of systems covered by Article 50(1). A team that assembles its own agent from a model, prompts and tools and lets customers use it finds itself in the provider role for that system, even though someone else built the model. For purely internal tools the interpretation is less clear-cut, and it is worth checking with a lawyer.

The Czech context: supervision without an act

The AI Act is a directly applicable regulation, so its obligations apply regardless of Czech legislation. The national implementing act is mainly meant to designate authorities, procedures and sanction proceedings. As of October 2026 it has not been passed: on 6 August 2026 the Government Legislative Council (Legislativní rada vlády) suspended its discussion of the draft. According to available sources, the bill has therefore not yet reached the Chamber of Deputies.

The division of roles is nevertheless known from the published implementation concept and from the draft act. According to an overview by Vlivoskop (as of 10 August 2026), the main market surveillance authority is to be the Czech Telecommunication Office (ČTÚ), with the Czech National Bank (ČNB) for the financial sector and the Office for Personal Data Protection (ÚOOÚ) for personal data; the Ministry of Industry and Trade (MPO) is the national coordinator of implementation, and the notifying authority role is to be performed by the Czech Office for Standards, Metrology and Testing (ÚNMZ).

ČTÚ is already preparing for its supervisory role: in a press release of 31 July 2026 it highlighted the Article 50 transparency rules and urged companies to assess their obligations in good time. How quickly and how firmly supervision will work without the implementing act is an open question. Relying on it not working, however, is a bad plan: the obligation exists, and for some systems it is enforced directly by the European AI Office.

What to do now: an inventory, not a legal analysis

Most of the work the AI Act requires from IT is technical record-keeping. Without a list of AI systems you cannot determine roles, risk classes or where labeling is missing. A simple register in a version-controlled repository is enough:

# ai-inventory/customer-chatbot.yaml
name: customer-chatbot
owner: team-digital
model: external GPAI model via API (vendor, EU region)
role: provider            # own system under own name
users: public
purpose: answering questions about orders
risk_class: transparency  # prohibited | high | transparency | minimal
art50:
  ai_disclosure: "opening message + persistent label in UI"
  output_marking: n/a
personal_data: true
logging: "prompt, response, model version; 180-day retention"
human_escalation: true
last_review: 2026-10-01

The values are illustrative. What matters is that the record is created in the same process as the deployment, ideally as a mandatory part of the pull request that introduces the AI feature. If deployment is not controlled, that is the first thing to fix; the article on infrastructure chaos before adopting AI covers the background.

The last item also has a purely operational reason. The logs you will have to keep under Article 26 cannot be backfilled, and their design overlaps with what security monitoring and logging already covers.

When less is enough, and where the interpretation is uncertain

Not every company needs a compliance programme. If you only use off-the-shelf tools for internal productivity, run nothing public-facing and nothing in Annex III applies to you, your current obligations essentially come down to Article 4 and an Article 5 check. In that case, a one-page inventory is a proportionate response.

Conversely, the “let’s wait until December 2027” argument has three weaknesses. First, transparency and the prohibitions were not delayed. Second, systems deployed today will still be running in 2027, and retrofitting logging and oversight is more expensive. Third, the classification itself is uncertain: the Commission guidelines on high-risk classification under Article 6 were published on 19 May 2026 only as a draft.

Several other things also remain uncertain: what the Czech sanctions regime will look like, how supervisory authorities will interpret the provider role for internal agents, and how the transitional provisions for systems placed on the market before the new deadlines will work in practice. This article is not legal advice; borderline cases call for an assessment of the specific system.

Key takeaways

• The delay is fixed, not conditional. High-risk systems under Annex III from 2 Dec 2027, under Annex I from 2 Aug 2028.
• Article 50 was not delayed. Disclosure of interaction with AI and deepfake labeling apply from 2 Aug 2026; only machine-readable marking for older systems has until 2 Dec 2026.
• AI literacy softened, it did not disappear. Instead of “ensure”, the obligation is to “take measures to support”, and you still need to be able to prove it.
• Your role is defined by what you built. Your own chatbot on top of someone else’s model makes you the provider of an AI system, with all the obligations of Article 50(1).
• The Czech implementing act is missing. The regulation applies directly nonetheless, and ČTÚ has already publicly drawn attention to the Article 50 obligations.
• The first step is an inventory. A register of AI systems tied to the deployment process covers most of what will be needed now and in 2027.