EU delays high-risk AI rules but keeps disclosure date

By Diana Trent · 2026-07-30

What the omnibus changed and what it left alone

Three days after publication in the Official Journal, Regulation (EU) 2026/1744 entered into force on 27 July 2026verifiedVerified Source: data.europa.eu, reshaping the compliance calendar that European and foreign businesses had been working against for two years.^[1] The change does not touch the AI Act's architecture or its risk classifications. It moves deadlines.

What the omnibus left alone matters as much as what it shifted. Transparency and disclosure obligations under Article 50 of the original AI Act remain enforceable from 2 August 2026, and the European Commission published practical guidelines to help providers and deployers meet those requirements just twelve days before the regulation entered into force.^[4] For Australian companies exporting AI-touched products into the EU, that date is now days away.

Three compliance tracks: dates, scope and who they cover

The omnibus creates three distinct tracks, each with its own deadline. The first covers stand-alone high-risk AI systems listed in Annex III of the original AI Act, systems deployed in high-stakes domains such as employment screening, education assessment, access to essential services and law enforcement support. Application of Chapter III, Sections 1 to 3 of the AI Act for those systems is postponed to 2 December 2027verifiedVerified Source: boe.es, a shift of roughly sixteen months from the original 2 August 2026 date.^[2]

The second track covers AI embedded in products already regulated under separate EU harmonisation legislation, the so-called Annex I category. Think AI modules inside medical devices, industrial machinery or civil aviation components. Those systems now have until 2 August 2028 to meet high-risk obligations, the longest extension the omnibus grants.^[2] Those products travel through existing conformity assessment pathways that are themselves still adapting to the AI Act's requirements.

The third track is Article 50, and it moves for no one. Transparency obligations covering things like disclosing when a user is interacting with an AI system, labelling AI-generated content and marking deepfakes apply from 2 August 2026 across every product category.^[4] A business that exports a chatbot, an image generator or an emotion-recognition tool into the EU sits inside that track regardless of whether its product is classified as high-risk.

Why the delay happened: missing standards and the co-rapporteurs' case

The justification offered by the omnibus co-rapporteurs is straightforward. Michael McNamara, MEP, said the harmonised standards that companies needed to demonstrate compliance with the high-risk chapter were simply not in place.^[5] Without those standards, companies faced the paradox of being legally required to comply with obligations they had no agreed method of demonstrating they were meeting.

Co-rapporteur Arba Kokalari, MEP, said the EU could move at the speed of the technology it was regulating, framing the outcome as evidence of regulatory agility.^[5] Both positions reflect the same underlying pressure: the European Standards Organisation had not delivered the technical specifications that national conformity assessment bodies and company compliance teams were waiting for. The Commission's own impact assessment, published in May 2026, confirmed that the original Annex III deadline was effectively unworkable in that environment.^[3]

The European Commission had proposed the Digital Omnibus on AI in November 2025, positioning it as a simplification measure that would reduce overlaps with sectoral legislation and introduce an EU-level sandbox. The fixed postponement dates that emerged from the co-rapporteurs' negotiations represent a more targeted intervention than the Commission's original proposal: rather than redrawing scope, the omnibus buys time for the standards infrastructure to catch up.

Article 50 transparency obligations: what businesses must do now

Article 50 covers four distinct obligations. Providers of AI systems designed to interact with natural persons must ensure those systems disclose that the person is talking to an AI, unless the context makes it obvious. The Commission published guidelines to assist providers and deployers in meeting those transparency obligations ahead of the 2 August 2026 application dateverifiedVerified Source: digital-strategy.ec.europa.eu.^[4] The guidelines address practical questions around timing, labelling formats and what constitutes adequate disclosure.

AI-generated audio, video, text and images must be marked with machine-readable signals indicating their artificial origin. Deepfakes depicting real people are subject to explicit labelling requirements. These are not soft obligations contingent on harmonised standards being finalised; they applied on the day the original AI Act passed through its general application date, and the omnibus left them there.

For companies using AI systems in employment or HR contexts within the EU, a separate read-across applies. Deployers of high-risk AI systems in that category benefit from the extended 2 December 2027 deadline for the full Chapter III compliance package, but Article 50 obligations apply immediately if the system interacts with or generates content about workers.

Practical implications for Australian businesses selling into the EU

Australian companies export to the EU under product liability and conformity frameworks that are already complex. The omnibus does not change the jurisdictional reach of the AI Act, which applies based on where a product is placed on the EU market, not where it is made. An Australian developer selling an HR screening tool, an education platform or an AI-assisted credit decision system into the EU sits inside the Annex III scope and now has until 2 December 2027 to meet full high-risk compliance.

That window is longer than the original timeline, but the standards companies need to navigate it are still being written. Businesses should begin technical documentation, conformity preparation and internal governance work now rather than waiting for the harmonised standards to be finalised, because those standards are expected to arrive well inside the remaining compliance period. Companies whose AI is embedded in physical products already regulated in the EU, machinery exporters or medical technology developers for instance, have until August 2028 but face the additional complexity of aligning with both the AI Act and the underlying sectoral regulation.^[2]

The Article 50 window, by contrast, has closed. Any Australian business already operating an AI chatbot, content generation tool or emotion-recognition product in the EU market needs to be meeting the disclosure requirements now, not at the end of a compliance planning cycle. The Commission's published guidelines are the operative document, and they offer no grace periods.^[4]

Diana Trent

Diana Trent writes about regulation, competition and the law as it meets technology. She reads the judgments and the regulator filings that most people skip, and finds the story in them.