AI Omnibus amending the EU AI Act enters into force, delaying high-risk rules

The AI Omnibus, a targeted amendment to the EU AI Act, entered into force on 27 July 2026. Its headline effect was to push back the start dates for high-risk AI obligations.

What it is

The Commission proposed the measure on 19 November 2025 inside its wider digital omnibus package, describing it as simplification that keeps safeguards for safety and fundamental rights. Parliament and Council reached a political agreement, which the Commission welcomed on 7 May 2026, about five months after the proposal.

What it requires

High-risk rules for areas such as biometrics, critical infrastructure, education, employment, migration and border control now apply from 2 December 2027. Rules for AI built into products like lifts or toys apply from 2 August 2028. The Commission said the sequencing gives standards and support tools time to arrive. The amendment also bans systems that generate non-consensual intimate imagery or child sexual abuse material, permits processing of special categories of personal data to detect and correct bias, and widens AI Office oversight to systems built on general-purpose models inside large platforms and search engines.

What security leaders should do

A delay is not a reprieve for security controls. Use the extra time to finish the inventory, logging and robustness work the high-risk rules will demand, and to test it before the new dates rather than after. Update your compliance roadmap with the December 2027 and August 2028 dates, and brief the board on which obligations moved and which kept their original dates. If the bias-detection provision leads your data team to process special-category data, make sure access controls and retention limits for that data are set before the work starts.