Has the EU AI Act actually been delayed?

A proposal to amend the timetable is not an amendment. Changing dates written into the AI Act requires a new legal act that clears the ordinary legislative procedure — Commission proposal, European Parliament position, Council position, then agreement between them. Until that is adopted and published in the Official Journal, the dates in the AI Act as enacted are the dates that bind you. Treat any headline about a delay as a signal about direction, not as a change in your obligations.

Which parts of the AI Act are already in force and cannot be delayed away?

The prohibited-practices list and the AI literacy duty applied first and are already live. The general-purpose AI obligations and the governance architecture followed. Postponement debates have consistently centred on the high-risk regime in Annex III and on the surrounding documentation machinery, not on the bans. A company that reads 'the AI Act is delayed' and stops work is usually stopping work on the parts that were never in question.

Does a delay help a US company selling software into Europe?

Less than it looks. The transparency obligations that most SaaS products actually trip — telling a person they are interacting with an AI system, marking synthetic content — are cheap to implement and were never the bottleneck. The expensive item is high-risk classification, and the honest question is whether your system lands in Annex III at all. Most do not. Spending the extra months on the classification memo is worth more than spending them waiting.

What should we do while the amendment is still pending?

Freeze a dated classification decision for each AI system you provide or deploy, keep the evidence that supports it, and build the transparency surface now because it does not depend on the outcome. Do not cancel work; re-sequence it. If the dates move, you have spent the time on the one artefact — a defensible classification record — that every version of the timetable still requires.

Do customers care about the legislative timetable?

Enterprise buyers in Europe are asking AI questions in procurement regardless of what Brussels does with the dates. A vendor who can hand over a classification memo, a data-governance summary and a human-oversight description closes faster than one who explains that the deadline moved. The commercial deadline is your next security review, and that one has not been postponed.

The EU AI Act Digital Omnibus 2026: What a Delay Does and Doesn't Buy You

What a "Digital Omnibus" Actually Is

An omnibus is a single legislative vehicle that amends several existing instruments at once. The Commission uses them to make coordinated changes across a policy area — trimming reporting duties, aligning definitions, adjusting application dates — without reopening each regulation separately. In the digital file that means the AI Act sitting in the same package as data and privacy instruments, which is why coverage of it tends to blur several different changes into one headline.

The mechanics matter more than the contents. A Commission proposal is the opening position. The European Parliament adopts its own position, the Council adopts the member states' position, and the three institutions then negotiate a common text. Any of those stages can change what a "delay" means, attach conditions to it, or split it apart. Only when the agreed act is published in the Official Journal does a date in the AI Act actually move.

The Two Halves of the Act, and Only One Is in Play

Already applying — plan around it

•Prohibited practices: social scoring, untargeted face scraping, workplace emotion inference
•AI literacy: staff operating AI systems must be adequately trained
•General-purpose AI model duties for providers of the models themselves
•Governance structures at EU and member-state level
•Nothing here is contingent on a future amendment passing

Where the delay argument lives

•Annex III high-risk classification and the duties that follow from it
•Conformity assessment, technical documentation, registration
•Risk and quality management systems for high-risk providers
•Deployer duties attached to high-risk use
•The argument: harmonised standards are late, so the runway should move with them

The Standards Argument, Stated Fairly

The case for moving the high-risk dates is not lobbying noise. The AI Act was built assuming that harmonised European standards would exist by the time obligations bite, so a provider could follow a published standard and earn a presumption of conformity. Those standards have run late. Without them, a company is asked to demonstrate conformity against a target nobody has finished drawing, and then to redo the work when the standard is finally cited.

The counter-argument is equally real: obligations do not wait for standards. A presumption of conformity is a convenience, not the only route. You can conform by documenting your own approach and defending it. That is more expensive and less certain, which is exactly why the delay is being argued for — but it is not impossible, and a regulator is not obliged to accept "the standard wasn't ready" as a reason nothing was done. We covered that split in more detail in the harmonised-standards piece linked below.

How Teams Lose Money on a Delay

The damage from a mis-read postponement is rarely a missed deadline. It is three quieter failures. The first is stopping work on obligations that were never postponed — most commonly the transparency duties, which are cheap, and the prohibited-practices review, which is free and existential. The second is losing the classification memo: the single document that says which of your systems are high-risk and why, dated and signed, is what turns a future deadline into a small project instead of a fire drill.

The third is commercial. European enterprise buyers put AI questions into procurement long before the law compelled anyone to answer them. When your security review asks how the model was trained, who reviews its outputs, and what happens when it is wrong, "the regulation was postponed" is not an answer that keeps a deal moving. The compliance deadline may slip. The sales deadline does not.

What to Do While the Text Is Still Moving

Do Now — Outcome-Independent

☐Run the prohibited-practices screen across every AI feature you ship or use
☐Write the classification memo: system, role, Annex III analysis, date, owner
☐Ship the Article 50 transparency surface — telling a user they're talking to an AI is not expensive
☐Confirm staff operating AI systems have documented training
☐Inventory third-party AI inside your product, including features a vendor turned on for you

Hold — Re-Sequence, Don't Cancel

☐Notified-body engagement, until your classification is actually settled
☐Full Annex IV technical files for systems you believe are not high-risk
☐Tooling purchases priced against a date that may move
☐Formal conformity assessment work that a cited standard would change
☐Track the file at Parliament and Council stage, not through press coverage

Reading the File Yourself

Three checks separate a real change from a headline. Has the Commission published a proposal, or is this a leak of a draft? Has Parliament adopted a position, and does it match the Council's? Is there an adopted act in the Official Journal with a new date in it? Only the last one changes your calendar. Everything before it changes your forecast, which is useful for sequencing work and useless as a reason to stop.

Frequently Asked Questions

Has the EU AI Act been delayed?

A proposal to move dates is not a moved date. Amending the AI Act's timetable takes a new legal act through the ordinary legislative procedure: Commission proposal, Parliament position, Council position, negotiated text, publication in the Official Journal. Until that happens the enacted dates are the ones that bind you. Track the file, not the coverage.

Which obligations are already live regardless?

The prohibited-practices list and the AI literacy duty applied first, followed by the general-purpose AI obligations and the governance architecture. Postponement debates have centred on the Annex III high-risk regime. If you read 'delayed' and paused everything, you probably paused work on obligations that are already enforceable.

Why is the delay being argued for at all?

Because the harmonised European standards that were supposed to give providers a presumption of conformity have run late. The argument is that obligations should track the tools that make them satisfiable. The counter is that conformity is still demonstrable without a cited standard — just more expensively and with more uncertainty.

Are we high-risk?

Most business software is not. High risk is a defined set: products with AI safety components under existing EU product law, plus the Annex III use cases covering areas like employment, education, essential services, creditworthiness, law enforcement and biometrics. The output you need is not a yes or no in a meeting — it is a dated memo that records the analysis and the evidence behind it.

Does any of this reach a US company with no EU office?

Yes, if your AI system is placed on the EU market or its output is used in the EU. The territorial reach is the reason the Act shows up in procurement questionnaires sent to American vendors who have never registered an EU entity, and an authorised representative may be required for some roles.

What is the cheapest thing we can do this quarter?

Two things. Screen every AI feature against the prohibited-practices list, because that is free and the penalties sit at the top of the scale. Then ship the transparency surface — a person interacting with an AI system should be told, and synthetic content should be marked. Neither depends on how the timetable debate resolves.

Start With What Your Site Already Says

The transparency half of this is the part you can finish before the legislative question resolves, and it lives on pages you already own — the chat widget, the AI-assisted form, the generated content, the accessibility and disclosure statements nobody has read since launch.

Seeing what your pages actually present to a visitor is the same discipline the Act asks for. Run a free scan of your site and start from what is live today rather than from what the deck says.

The EU AI Act Digital Omnibus: What a Delay Does and Doesn't Buy You