Short answer
The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force 27 July 2026 — postponed the EU AI Act's high-risk duties to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 50 transparency, GPAI model duties and the prohibited-practices ban are unchanged and already apply. For most AI startups the next real deadline is 2 December 2026 for generative-AI output marking on pre-existing systems.
If you build or sell AI into the EU, the picture changed in late July 2026. The Commission's Digital Omnibus on AI, published as Regulation (EU) 2026/1744, pushed back the application dates for the AI Act's high-risk obligations by more than a year. Reporting in the days after focused on the fact that “the AI Act was delayed,” but that framing is wrong: most of the Act is already in force. What changed is the schedule for the heaviest obligations — conformity assessments, EU-database registration, post-market monitoring for Annex III and Annex I systems — and even those still have a hard legal deadline in 2027 and 2028.
This piece sets out the new timeline, what has not moved, and what a 1–50 person AI startup should actually do in the next twelve months. We link out to the full compliance checklist for depth, and to ISO 42001 and SOC 2 for AI startups for how to turn the Act's obligations into audit-ready evidence.
What the Digital Omnibus actually changed
Regulation (EU) 2026/1744 is a targeted amendment to the AI Act, not a rewrite. It shifts three things:
- Annex III high-risk systems — AI in HR, credit scoring, education, essential services, biometric categorisation, law enforcement — now apply from 2 December 2027 instead of 2 August 2026.
- Annex I high-risk systems — AI as a safety component of regulated products such as medical devices, machinery and in-vehicle systems — now apply from 2 August 2028.
- Legacy generative-AI marking — systems that were already on the market before 2 August 2026 must apply the Article 50 output marking from 2 December 2026.
Everything else — definitions, risk categories, the fine framework, the AI Office, the EU AI database — is unchanged. The Commission framed the omnibus as giving providers time to complete conformity assessments while harmonised standards and guidance from the AI Office are still being finalised.
What did not change: the ban on prohibited AI practices (in force 2 Feb 2025), the AI literacy duty for providers and deployers (2 Feb 2025), the GPAI model duties (2 Aug 2025), Article 50 transparency for chatbots, synthetic content and emotion recognition (2 Aug 2026), and the full penalty framework.
The new timeline at a glance
| Date | What applies | Who it hits |
|---|---|---|
| 2 Feb 2025 (live) | Prohibited AI practices + AI literacy duty | All providers and deployers |
| 2 Aug 2025 (live) | GPAI model obligations (technical documentation, copyright policy, training-data summary) | Foundation-model providers |
| 2 Aug 2026 (live) | Article 50 transparency (chatbot disclosure, synthetic content marking, deepfake labels, emotion recognition notices) | Any provider or deployer of generative or interactive AI |
| 2 Dec 2026 | Output marking for generative-AI systems already on the market before 2 Aug 2026 | Any provider with legacy generative-AI products in the EU |
| 2 Dec 2027 | Annex III high-risk obligations (conformity, logging, oversight, EU database) | Providers and deployers of HR, credit, education, biometric and public-service AI |
| 2 Aug 2028 | Annex I high-risk obligations | AI as a safety component of medical devices, machinery, vehicles, toys and other Annex I products |
2 December 2026: the deadline most startups miss
If your AI product generates text, images, audio or video and was already on the EU market before 2 August 2026, you have four weeks past this article's publish date to meet Article 50's machine-readable output marking rules. The Act requires providers of synthetic-content systems to mark outputs in a machine-readable format and to make them detectable as artificially generated. For most startups that means watermarking images and video (SynthID-style), embedding C2PA Content Credentials or equivalent metadata, and documenting the technique in your technical documentation.
If you launched your generative product after 2 August 2026, you were already on the hook; the 2 Dec 2026 date only matters for grandfathered products. The LowerPlane Article 50 transparency checklist walks through the full set of obligations (chatbot disclosure, deepfake labels, emotion-recognition notices).
Provider or deployer? It changes which duties you own
The AI Act splits obligations between providers (you develop or materially modify an AI system and put it on the market under your name) and deployers (you use an AI system supplied by a third party in a professional context). Most AI SaaS startups are both:
- Provider for your own product — even if it's built on OpenAI, Anthropic or an open-weight model, the moment you ship it to EU customers under your brand you take on provider duties for that system.
- Deployer for every third-party AI tool you use internally — code assistants, meeting summarisers, HR screening tools, marketing content generators. Deployer duties include human oversight, log retention and (for high-risk use cases) a fundamental rights impact assessment.
- GPAI provider only if you train or materially fine-tune a general-purpose model yourself. Prompt-engineering or RAG on top of GPT-4 or Claude does not make you a GPAI provider.
If a deployer substantially modifies a high-risk AI system or puts a general-purpose system to a high-risk use not foreseen by the provider, the deployer becomes the provider for that modified system — and takes on all provider duties.
What a 10-person AI startup should do this quarter
The Digital Omnibus bought you time on Annex III and Annex I. It did not buy you time on the parts of the Act that enterprise buyers actually ask about. Here is the practical shortlist for the next 90 days:
- Build an AI system inventory. One row per system (your product, each third-party AI tool), with purpose, risk category (prohibited/high/limited/minimal), provider vs deployer role, data flows, and whether it processes personal data. This document gets requested in every AI vendor questionnaire now.
- Confirm you are not in Annex III scope by accident. HR-adjacent features (resume ranking, candidate matching), credit-related features (fraud scoring, pricing based on risk) and education features (automated grading) often slip into Annex III. If one of yours does, you have until 2 Dec 2027 to be conformity-ready — the clock is already running.
- Ship Article 50 disclosures. Chatbot “you are talking to an AI” notice, output marking on anything generative, deepfake labels for anything that depicts a real person. These are already overdue if you launched after Aug 2026.
- Stand up an AI governance baseline. AI use policy, acceptable use for employees, model inventory, risk register, incident response plan, vendor review for every LLM subprocessor. ISO 42001 clauses 6–9 are the cleanest checklist for this.
- Collect evidence once, map to many frameworks. The same risk register, change log, access review and vendor DPA satisfy AI Act, ISO 42001, SOC 2 and (for personal data) GDPR. Running these as four separate projects is how early-stage teams waste the next twelve months.
How ISO 42001 and SOC 2 evidence maps to the AI Act
You do not need a different compliance programme for the AI Act. The Act expects providers of high-risk systems to maintain a risk management system, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, and post-market monitoring. ISO 42001 defines a management system that produces exactly these artefacts. SOC 2 CC-series controls cover the security, change management and monitoring the Act requires around the AI.
| AI Act obligation | ISO 42001 clause | SOC 2 criterion |
|---|---|---|
| Risk management (Art. 9) | 6.1, 8.2 — AI risk assessment and treatment | CC3.1 — risk assessment |
| Data governance (Art. 10) | Annex A A.7 — data for AI systems | CC6.1, CC6.7 — data access, data in transit |
| Technical documentation (Art. 11) | 7.5 — documented information | CC2.2 — information system documentation |
| Record-keeping / logging (Art. 12) | Annex A A.6 — operation records | CC7.2 — monitoring |
| Human oversight (Art. 14) | Annex A A.9 — use of AI systems | CC5.3 — policies and procedures |
| Post-market monitoring (Art. 72) | 9.1, 10.1 — monitoring and improvement | CC7.3, CC7.4 — incident evaluation and response |
In practice, teams that stand up ISO 42001 first get about 70% of what the AI Act expects for free, and 50–60% of what SOC 2 asks for. See the deeper AI Act × NIST AI RMF × ISO 42001 mapping.
Frequently asked questions
Was the EU AI Act delayed?
Only the high-risk obligations were delayed. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — moved Annex III high-risk duties to 2 December 2027 and Annex I (safety-component) duties to 2 August 2028. The ban on prohibited practices (Feb 2025), the GPAI model duties (Aug 2025), the Article 50 transparency duties (Aug 2026) and the penalty framework are unchanged.
What is the next EU AI Act deadline after the Digital Omnibus?
For most AI startups the next concrete deadline is 2 December 2026, when generative AI output marking requirements apply to systems already on the market before 2 August 2026. The next big-ticket deadline is 2 December 2027 for Annex III high-risk systems.
Does the Digital Omnibus mean we can wait on AI governance?
No. Article 50 transparency has applied since 2 August 2026, GPAI duties have applied since 2 August 2025, and the prohibited-practices ban has applied since 2 February 2025. Buyers also increasingly require ISO 42001 and AI vendor questionnaire answers in contracts regardless of what the Act says.
Are we a provider or a deployer under the AI Act?
If you develop or materially modify an AI system and put it on the market under your own name, you are a provider. If you use an AI system supplied by a third party in a professional context, you are a deployer. Most AI SaaS startups are providers for their own product and deployers for every third-party AI tool they use internally.
How does the AI Act fit with ISO 42001 and SOC 2?
ISO 42001 is the AI management system standard that most closely maps to the Act's risk management, data governance, documentation and post-market monitoring expectations. SOC 2 covers the security, availability and confidentiality of your service around the AI. A startup pursuing both can reuse 60–70% of evidence (risk register, change management, access control, incident response, vendor management) across the Act, ISO 42001 and SOC 2.
What are the EU AI Act fines?
Up to €35M or 7% of worldwide annual turnover (whichever is higher) for prohibited practices, up to €15M or 3% for most other breaches, and up to €7.5M or 1.5% for supplying incorrect information. The penalty framework was not changed by the Digital Omnibus.
Turn AI Act duties into audit-ready evidence
LowerPlane runs your ISO 42001, SOC 2, GDPR and AI Act programmes on one evidence base so the same risk register, change log and vendor review satisfy every buyer who asks. See how it works on the ISO 42001 page, or compare pricing against the big incumbents on /pricing/.