# What the EU AI Act still asks of your product after the Omnibus > The Omnibus moved the high-risk deadlines, not the transparency duties or GPAI enforcement. What applies now, what lands in 2027-2028, and how to use the gap. _Mati Mouni, Sep 30, 2026._ ## What the Omnibus changed, and what it didn't If you sell an AI product into the EU, you probably spent the first half of 2026 watching the August 2 high-risk deadline get closer. Then it moved. A provisional agreement on the Digital Omnibus on AI was reached on May 7, 2026, and the European Parliament voted to adopt it on June 16, as [Sidley's Data Matters blog reported](https://datamatters.sidley.com/2026/06/22/eu-lawmakers-reach-provisional-agreement-to-delay-key-eu-ai-act-obligations/). The amending regulation [entered into force on July 27, 2026](https://usercentrics.com/knowledge-hub/eu-ai-act-high-risk-delay-article-50-transparency-consent/). A lot of teams read that as "the AI Act is paused". It isn't. The Omnibus pushed back the obligations for high-risk systems, which are the expensive ones: risk management, data governance, technical documentation, conformity assessment. It did not delay the transparency duties that started on August 2, 2026, and it did not delay enforcement of the rules for general-purpose AI models, which began the same day. So the honest summary for a product team is this. Some of your obligations moved by 16 months. Some are live today. And the companies that will have an easy time in December 2027 are the ones that start collecting evidence now. We have built compliance software for clients (an AI-driven GRC platform, a compliance system for French financial institutions, a privacy layer for LLM traffic), so we read the final text with one question in mind: what does a product team need to have running, and by when? ## The dates that matter Orrick's [summary of the final text, Regulation (EU) 2026/1744](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes), is the clearest we've found. These are the dates that will drive most roadmaps: | Date | What applies | |---|---| | August 2, 2026 (passed) | Article 50 transparency duties; AI Office enforcement for general-purpose AI models | | December 2, 2026 | Bans on nudifier apps and CSAM generators; end of the Art. 50(2) watermarking grace period for systems already on the market | | December 2, 2027 | Annex III high-risk systems (previously August 2, 2026) | | August 2, 2028 | Annex I high-risk systems | | August 2, 2030 | High-risk systems used by public authorities | Annex III is the list most SaaS companies care about: AI used in hiring, credit scoring, education, access to essential services and similar areas. Annex I covers AI that is part of products already regulated by EU product-safety law, such as machinery or medical devices, which is why it gets more time. Two details in the final text deserve more attention than they've had. The watermarking grace period only covers systems placed on the market before August 2, 2026. If you launched a generative feature in September, there is no grace period for that feature. The marking obligation applies to it now. The text also creates a "small mid-cap" category for companies with fewer than 750 employees. If you're a scale-up that has outgrown the EU's SME definition (fewer than 250 people), read those provisions before you budget for the full regime. Some of the simplifications that used to stop at SMEs may now reach you. ## Already live: disclosure, content marking and GPAI enforcement Article 50 has applied since August 2, 2026. Jones Day's [note on the final Code of Practice on marking and labeling AI-generated content](https://www.jonesday.com/en/insights/2026/06/european-commission-publishes-final-code-of-practice-on-marking-and-labelling-aigenerated-content), which the Commission published on June 10, 2026, sets out the three duties most product teams will hit: - tell users when they are interacting with an AI system; - mark AI output in a machine-readable format; - label deepfakes. The first is a UI change, and most teams have already made it. The second is an engineering job, and it's the one we see underestimated. A machine-readable mark is only useful if it survives your own pipeline: the image resize, the PDF export, the CDN that strips metadata, the user who copies text into another tool. Somebody has to own that end to end, with a test that fails when the mark goes missing. Enforcement for general-purpose models started the same day. According to a [Cloud Security Alliance research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-gpai-enforcement-20260803-csa-st/), the AI Office can now demand documentation, commission evaluations of a model, order corrective measures up to withdrawal from the market, and fine up to 3% of worldwide turnover or €15 million, whichever is higher. If you train or distribute a foundation model, that is your exposure today, not in 2027. ## When fine-tuning makes you a "provider" Most of our clients don't train foundation models. They call one through an API, or they take open weights and fine-tune them. The second group should read the CSA note closely: deployers that substantially fine-tune a model may be treated as providers, with the obligations that come with that status. "May" is carrying a lot of weight in that sentence, and where "substantial" begins is the thing to watch as guidance develops. Our practical advice is to document every fine-tuning run as if you'll have to show it to a regulator: the base model and version, the training data and where it came from, the compute used, the evaluations you ran before and after, and who approved the release. If the modification turns out to be minor, you've spent a day on paperwork. If it doesn't, you already have the file the AI Office would ask for. The same goes for the less obvious cases. A model distilled from a larger one, a merged checkpoint, a LoRA adapter you ship to customers. Write down what you did while you still remember why you did it. ## Using the 16-month reprieve Between August 2, 2026 and December 2, 2027 there are 16 months. For an Annex III system, that's roughly the time it takes to build the evidence a conformity assessment needs, if you start now and run it as an engineering project. What slows teams down is rarely the policy writing. It's the evidence. An auditor or a market-surveillance authority won't accept "we test for bias" as an answer. They want the test, the dataset it ran on, the result, the date and the person who signed off, for every release. If that evidence lives in Slack threads and personal notebooks, reconstructing it in late 2027 will take longer than producing it as you go. This is the kind of work we've built tooling for. On [SecureLabs](/work/securelabs), we built a GRC platform whose AI assistants evaluate uploaded evidence against specific controls across ISO 27001, SOC 2, NIST and GDPR. On [Azia](/work/azia), compliance teams at regulated French institutions run yearly control plans, risk maps and regulator-ready reports in one place instead of spreadsheets. On [Logikol](/work/logikol), a privacy vault tokenizes PII before it leaves the customer's systems, which matters when your training or evaluation data contains personal data. The pattern underneath all three is the one the AI Act asks for: controls, evidence attached to each control, and a report you can produce on demand. Whatever tooling you use, the goal is to make evidence a by-product of the pipeline. Your evaluation job writes its results somewhere permanent, tagged with the model version and a hash of the dataset. Your release process refuses to ship a model version that has no evaluation record. Your incident log links to the version that was live at the time. Do that, and when December 2027 arrives, most of your technical documentation is a query. ## A practical checklist for AI product teams Here is what we'd put on the board on Monday: 1. **Classify every AI feature you ship.** Annex III, Annex I, general-purpose model, or none of these. Most features will be none, and writing that down with the reasoning is useful evidence too. 2. **Close the Article 50 basics.** AI-interaction disclosure in the UI, machine-readable marking on generated content, deepfake labeling. Check the launch date of each generative feature against the August 2, 2026 cutoff for the grace period. 3. **Audit your fine-tuning.** List every model you've modified and decide, with counsel, whether any of them could make you a provider. 4. **Check your headcount.** Under 750 employees, read the small mid-cap provisions before planning the budget. 5. **Wire evidence into CI.** Evaluation results, data lineage and release approvals stored per model version, automatically. 6. **Name an owner.** One person accountable for the AI Act file, with a date in mid-2027 for a dry-run assessment. 7. **Ask your model vendors.** If you build on a third-party model, find out what documentation the provider will give you, and put it in the contract. None of this needs to wait for further guidance from Brussels. Items 1, 2 and 7 are a few weeks of work for most teams, and they cover what already applies. If you'd like a second opinion on any of it, from classifying your features to building the evidence pipeline, [tell us what you're shipping](/contact). Our view is that most teams will read the Omnibus delay as a reprieve, and that this is a mistake. The deadline moved; the amount of evidence an auditor will ask for did not. Teams that wire it into CI now will spend late 2027 shipping features. The ones that wait will spend it rebuilding test results from old notebooks. ## Sources - [EU lawmakers reach provisional agreement to delay key EU AI Act obligations](https://datamatters.sidley.com/2026/06/22/eu-lawmakers-reach-provisional-agreement-to-delay-key-eu-ai-act-obligations/), Sidley Austin (Data Matters), June 22, 2026 - [EU AI Act update: Digital Omnibus finalizes 8 compliance changes](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes), Orrick, July 29, 2026 - [EU AI Act high-risk delay and Article 50 transparency](https://usercentrics.com/knowledge-hub/eu-ai-act-high-risk-delay-article-50-transparency-consent/), Usercentrics, undated - [Research note: EU AI Act GPAI enforcement](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-gpai-enforcement-20260803-csa-st/), Cloud Security Alliance, August 3, 2026 - [European Commission publishes final Code of Practice on marking and labeling AI-generated content](https://www.jonesday.com/en/insights/2026/06/european-commission-publishes-final-code-of-practice-on-marking-and-labelling-aigenerated-content), Jones Day, June 2026 ## Related - All articles: https://matious.com/insights.md - Case studies: https://matious.com/work.md - Start a project: https://matious.com/contact ## Canonical URL https://matious.com/insights/eu-ai-act-omnibus-what-applies-2026 --- _Matious - AI engineering studio, founded 2017, Mohammedia, Morocco._ Contact: contact@matious.com | +212 661 790 436 | https://matious.com/contact Machine-readable: [llms.txt](https://matious.com/llms.txt) - [agent instructions](https://matious.com/agents.md) - [sitemap](https://matious.com/sitemap.xml) Every page is also available as Markdown: send `Accept: text/markdown`, or append `.md` to the URL.