Managing the EU AI Act Omnibus (a 5-part series)

Managing the EU AI Act Omnibus: Staggered Timelines and Compliance Steps

Understanding the Extraterritorial Compliance Triggers

The European Union’s AI Act has a wide geographic reach, applying to any organization whose AI models are accessed by users in the EU, or whose model outputs affect European citizens. Under these criteria, non-EU businesses—such as software-as-a-service (SaaS) developers or financial institutions processing European client data—must comply with the Act even if they have no physical presence in Europe.

EU AI Act Compliance Road Map

  |

  +---> Feb 2025: Basic AI bans & mandatory employee literacy active.[11]

  |

  +---> Aug 2025: General Purpose AI (GPAI) registry obligations apply.[20]

  |

  +---> Dec 2026: Prohibitions on non-consensual synthetic media active.

  |

  +---> Dec 2027: Delayed deadline for high-risk use-case systems (Annex III).

  |

  +---> Aug 2028: Delayed deadline for product-regulated high-risk systems (Annex I)

Navigating the May 2026 Digital Omnibus Postponements

The provisional agreement on the Digital Omnibus on AI, reached on May 7, 2026, introduced important changes to the Act's implementation schedule. This update provides businesses with extended transition periods for high-risk applications:

• High-Risk Use Cases (Annex III): The compliance deadline for use-based systems, such as AI used in credit scoring and hiring, has been postponed from August 2, 2026, to December 2, 2027.

• Product-Regulated Systems (Annex I): The compliance deadline for AI embedded in medical devices, aviation, and machinery has been extended to August 2, 2028.

• National Sandboxes: The requirement for EU member states to establish operational regulatory sandboxes has been deferred by one year to August 2, 2027.

Active Requirements That Mandate Immediate Action

While these extensions provide useful planning flexibility, several key requirements are already active. Strict bans on unacceptable AI systems—such as those using manipulative social scoring or unauthorized biometric profiling—took effect on February 2, 2025.

Furthermore, the requirement for organizations to provide basic AI literacy training to all employees remains fully active.

Global enterprises must use this extended transition period to audit their training datasets, build robust technical logs, and ensure their systems are prepared for the high-risk rules ahead.