By Marcus Venn | Digital Rule Book | March 2026 TL;DR — Key Points The EU Digital Omnibus Package, proposed 19 November 2025, is the most significant change to EU digital regulation since the AI Act itself. It proposes to simplify GDPR, delay the AI Act's high-risk deadlines by up to 16 months, merge cybersecurity reporting into a single entry point, and modernise cookie rules. For most EU businesses, the Omnibus will reduce compliance burden — but it has not been passed into law yet, and current deadlines still apply. The Digital Omnibus is not a weakening of the AI Act. It is a restructuring of the rollout to align with the actual readiness of the compliance ecosystem. This article explains every major proposal in plain English, so you know what is changing, when, and what it means for your business. DISCLAIMER: This article is for informational purposes only. The Digital Omnibus Package is a legislative proposal subject to amendment and rejection. Information ...
By Marcus Venn | Digital Rule Book | March 2026
There is a question circulating among compliance teams, small business owners, and digital operators across Europe right now: given that there is a war in the Middle East, a global energy crisis, and the EU's own Digital Omnibus Package proposing to delay AI Act deadlines — does the August 2026 EU AI Act enforcement deadline still apply?
The answer requires precision rather than a simple yes or no. This article gives you that precision.
What the EU AI Act August 2026 Deadline Actually Means
The EU AI Act entered into force on 1 August 2024. Its obligations apply in phases, based on the risk level of the AI system:
Banned AI applications (Unacceptable Risk): applied from 2 February 2025.
General-purpose AI (GPAI) model obligations: applied from 2 August 2025.
High-risk AI system obligations: scheduled to apply from 2 August 2026.
Full Act application including remaining provisions: 2 August 2027.
The August 2026 date is the deadline for high-risk AI systems — those used in credit scoring, hiring decisions, medical diagnosis, educational assessment, law enforcement, and critical infrastructure. If your business uses or deploys AI in any of these categories, 2 August 2026 was your compliance deadline.
What the Digital Omnibus Package Proposes
On 19 November 2025, the European Commission proposed the Digital Omnibus Package — a broad legislative initiative designed to simplify and streamline EU digital regulation. One of its most significant proposals is a delay to the AI Act's high-risk obligations.
The proposed delay works as follows:
For Annex III high-risk AI systems (credit scoring, hiring, emotion recognition, educational assessment, and similar): a six-month grace period after the Commission issues its decision confirming that harmonised standards are in place, with a backstop of 2 December 2027.
For Annex I high-risk AI systems (AI used as safety components in products regulated under EU product safety laws): a twelve-month grace period, with a backstop of 2 August 2028.
For general-purpose AI providers whose systems were placed on the market before August 2026: until February 2027 to update documentation and governance processes.
What the Iran War Changes About This Calculation
There is a common assumption that major geopolitical crises cause regulators to pause enforcement. This assumption is incorrect for EU digital regulation — and the historical evidence is clear.
EU digital regulation has consistently accelerated in response to crises, not slowed down. GDPR gained political urgency after the 2013 Snowden revelations. NIS2 was pushed through after major European cyberattacks in 2016. The AI Act gained momentum after the proliferation of generative AI in 2023. The Iran conflict, which has involved AI-assisted cyberattacks and AI-powered disinformation at scale, validates the AI Act's necessity rather than providing grounds for delay.
There is one legitimate way in which the Iran conflict changes the AI Act compliance calculation: it adds urgency to the high-risk AI obligations for critical infrastructure operators. For NIS2-regulated entities that also use high-risk AI systems, the conflict creates pressure to accelerate compliance, not delay it.
The Political Risk of Waiting for the Omnibus Delay
The Digital Omnibus Package faces a compressed legislative timeline. The European Commission has explicitly stated that if the amendments to the AI Act do not take effect before 2 August 2026, the original deadline will apply. The risk matrix for compliance teams looks like this:
The correct risk-adjusted strategy is clear: continue AI Act compliance preparation at pace. Treat any Omnibus-based delay as a potential bonus that gives you more time to complete work you should be doing anyway. Do not treat it as a guaranteed extension that removes the urgency.
What High-Risk AI Obligations Actually Require
If you use or deploy high-risk AI systems — and many more businesses fall into this category than realise — you need to understand what the August 2026 obligations require.
For Providers (Businesses That Develop or Market High-Risk AI)
Establish a quality management system covering risk management, data governance, technical documentation, and post-market monitoring.
Register your high-risk AI system in the EU-wide AI database (note: the Omnibus proposes removing mandatory registration for systems performing only minor, procedural, or narrowly constrained tasks).
Implement fundamental rights impact assessments where required.
Ensure human oversight mechanisms are built into the system.
Apply CE marking to covered products.
For Deployers (Businesses That Use High-Risk AI Developed by Others)
Ensure you have the technical and organisational capacity to use the AI system as intended.
Monitor the system's operation for unexpected risks.
Maintain logs of the AI system's operation where technically feasible.
Provide affected individuals with information about AI-assisted decisions where required.
Implement AI literacy training for relevant staff.
The Practical Compliance Steps for August 2026
Whether or not the Omnibus delay is passed before August 2026, the following steps represent minimum viable AI Act compliance for businesses using high-risk AI systems:
Map all AI systems you develop, deploy, or use against the EU AI Act's Annex III risk categories. This is a documentation exercise that takes days, not months.
Identify which of your AI systems involve hiring, credit, healthcare, education, law enforcement, or critical infrastructure. These are your high-risk categories.
Check whether your AI vendors have issued AI Act compliance documentation. If they have not, contact them now — they have the same August 2026 obligation as you.
Implement an AI use policy for your organisation. This can be a simple document explaining which AI systems you use, for what purpose, and what human oversight is in place.
Add AI Act awareness to your employee training programme. The general AI literacy obligation under Article 4 has been in force since August 2024 — if you have not addressed this, start now.
Frequently Asked Questions
Q: Has the August 2026 deadline officially been delayed?
A: No. The Digital Omnibus Package proposes a delay, but it has not been passed into law. Unless and until the Parliament and Council approve the amendments, the 2 August 2026 date remains the legal deadline for high-risk AI obligations.
Q: Does the EU AI Act apply to my business if I am not based in the EU?
A: Yes, if you place AI systems on the EU market or if your AI systems are used in the EU, the Act applies. Its geographic reach is similar to GDPR — it follows the data subject, not the company's location.
Q: What is an AI literacy obligation?
A: Article 4 of the EU AI Act requires organisations deploying AI to ensure their staff have sufficient understanding of the AI systems they work with. This obligation has been in force since August 2024. It does not require formal certification — it requires demonstrable, contextual understanding.
Q: What happens if I miss the August 2026 deadline?
A: For serious violations, fines can reach 30 million euros or 6 percent of global annual turnover, whichever is higher. For providers of high-risk AI systems, non-compliance can also result in market withdrawal obligations. Member state authorities are responsible for enforcement.
The EU AI Act's August 2026 deadline exists in a state of legitimate uncertainty. A delay is possible. It is not guaranteed. The businesses that will be best positioned — regardless of which way the legislative process goes — are those that continue their compliance work now.
Digital Rule Book will continue monitoring the Digital Omnibus Package as it moves through the European Parliament and Council. The next analysis in this series covers what the Cyber Resilience Act requires before September 2026.
AFFILIATE NOTE: This blog occasionally recommends tools and services. If you click a link and make a purchase, we may earn a small commission at no extra cost to you. We only recommend tools we genuinely find useful.