The EU AI Act Omnibus: What Changed, What Didn't, What SMEs Should Actually Do

Update (July 2026): The Digital Omnibus has since been adopted. The European Parliament approved it on 16 June 2026 (423–57–174) and the Council gave final sign-off on 29 June 2026; publication in the Official Journal is expected in July, with entry into force three days later. The deferred dates below are now settled: Annex III high-risk applies from 2 December 2027, Annex I from 2 August 2028, and the national AI-sandbox deadline moves to 2 August 2027. Article 50 transparency still applies on 2 August 2026. For the current picture, see The Digital Omnibus Is Adopted.

On 7 May 2026 the European Parliament and Council reached a provisional political agreement on the Digital Omnibus. After the 28 April trilogue failed, this one produced consensus. The headline most outlets ran with: high-risk AI rules postponed 16 months. The headline is correct. It is also incomplete. Here is what actually changed, what stayed exactly where it was, and what European SMEs should do this week.

The new timeline

Obligation	Old deadline	New deadline
Article 50(2) transparency / AI content marking	2 Aug 2026	2 Aug 2026 (unchanged) — 3-month grace for systems already on market, compliance by 2 Dec 2026
Article 5 new prohibition (non-consensual sexual content, CSAM)	n/a	2 Dec 2026
National AI regulatory sandboxes	2 Aug 2026	2 Aug 2027
Annex III high-risk AI (HR, finance, education, healthcare, etc.)	2 Aug 2026	2 Dec 2027
Annex I high-risk AI (embedded in regulated products)	2 Aug 2027	2 Aug 2028

Formal Council and Parliament votes are expected in June or July 2026 to lock the Omnibus into law. Until then the original 2 August 2026 deadline is still technically on the books. In practical terms the delay is happening, but it is not yet legally binding.

What survived the Omnibus

Three things did not move with the headline deadline, and one thing got tighter.

Article 50(2) transparency stayed put. Every provider of generative AI shipping into the EU still owes a 2 August 2026 deadline for content marking, watermarking, and disclosure of AI-generated material. If you ship a ChatGPT wrapper, an image generator, a voice tool, an agent that responds to customer messages, your clock did not stop on 7 May. The grace period for systems already on market was actually shortened from six months to three months — compliance by 2 December 2026 at the latest.

Article 4 AI literacy was already enforceable. Since 2 February 2025. Every operator of AI systems, regardless of risk tier, must ensure staff have sufficient understanding of the systems they use. The Omnibus did not touch this.

A new Article 5 prohibition lands 2 December 2026. AI used to generate non-consensual sexual or intimate content, including CSAM, is added to the list of prohibited practices. Penalty exposure under Article 99(3) is up to €35 million or 7% of global annual turnover. If your product has image or video generation, you have seven months to make sure your guardrails work.

The high-risk classification guidelines got tighter, not looser. On 19 May 2026 the European Commission published its long-overdue draft guidelines on Article 6 and Annex III classification. Three documents, public consultation open until 23 June 2026. The clarifications matter:

• Human in the loop alone does not remove a system from the high-risk regime. If the intended purpose falls inside an Annex III use case, a human reviewer is not a get-out clause.
• The Article 6(3) filter (the "does not materially influence decision-making" exception) is to be interpreted narrowly and does not apply to profiling systems at all.
• The definition of "safety component" for Annex I products was narrowed: AI that merely assists users or optimises performance without creating health or safety risks now sits outside high-risk.

In other words: compliance got more rigorous, not less. The deadline moved. The standard tightened.

The procurement problem

Here is the part the legal coverage missed.

European SMEs shipping AI into B2B contexts already have customers asking about AI Act readiness. They were asking in April, before the Omnibus. They are still asking in May, after the Omnibus. Enterprise procurement teams write requirements with timelines that have nothing to do with the regulator's timeline. A bank running a vendor onboarding cycle does not pause its compliance questionnaire because the Council postponed something. A hospital signing a five-year contract for triage AI wants to see the FRIA today, not in late 2027.

The 2 December 2027 deadline is for the regulator. The customer's deadline is their procurement cycle. Those are two different clocks.

If you are an SME selling AI into HR, finance, healthcare, education, legal, public services, or critical infrastructure, the procurement reality has not shifted. Your enterprise customers will keep asking for the documentation, the classification, the literacy programme, and the audit trail. The Omnibus gave you breathing room with the regulator. It did not give you breathing room with your buyer.

There is also a quieter consequence. The 16-month delay means buyers can be more selective. Six months ago an enterprise compliance team might have accepted a half-built compliance story from a vendor under deadline pressure. Now they can wait for the vendor that actually has the full Annex IV documentation in hand. The delay tilts the playing field toward the prepared.

What SMEs should do today

The Omnibus is not an excuse to delay. It is an opportunity to do this properly the first time.

1. Classify your AI systems now, before procurement asks. Run them through a classifier. Know which fall under Annex III, which under Annex I, which under Article 50, which are minimal-risk. The classification dictates everything else. This is a five-minute task with the right tool.
2. Lock in Article 50(2) if you ship GenAI. Templates, watermarking strategy, disclosure language. The deadline is 2 August 2026 and that has not moved. If you ship a generative feature into the EU, this is your one near-term clock.
3. Start the Article 4 AI literacy programme. It has been enforceable since February 2025. Most companies have not done it. Auditors and customers know that. A documented programme — even a thin one — is a credibility marker.
4. Document the AI systems you already have. Annex IV technical documentation, Article 9 risk management, Article 26 deployer obligations, Article 27 FRIA where applicable. The Omnibus gives you 16 months to draft this properly. Use them. Don't draft it in October 2027 under panic conditions.
5. Revisit the classification annually. The Commission will keep publishing guidance, the draft high-risk guidelines will be finalised, the FRIA template will eventually land. Your classification today might shift after a single Commission clarification. Treat compliance documentation as living, not done.

The discipline here is to treat the Omnibus as runway, not relief. Sixteen months of runway lets you do this without rushing. Sixteen months of relief means you do it in panic mode in October 2027.

Where Witness fits

Witness is the self-service EU AI Act compliance platform built for European SMEs. The classifier runs in five minutes and tells you exactly which articles apply to your systems. The documentation generator produces an Annex IV section that cites the specific paragraph it is grounded in. The audit trail is tamper-evident. The whole thing is bilingual EN and DE from day one and hosted in the EU.

Founding Member pricing runs until 30 June 2026: Starter €99 once + €79 per year for limited-risk systems and Article 50(2) transparency obligations. Professional €249 once + €199 per year for high-risk systems with the full Annex IV, Art. 9, Art. 27 stack. Team €499 once + €399 per year for multi-user organisations.

Run the classifier — free, no email required.

— Kevin Miller, Founder · Witness · [email protected]

Sources

• European Council press release (7 May 2026): Artificial intelligence: Council and Parliament agree to simplify and streamline rules
• European Commission draft guidelines on classification of high-risk AI systems (19 May 2026): digital-strategy.ec.europa.eu
• Bird & Bird analysis: Digital Omnibus on AI — provisional agreement reached at the May trilogue
• Hogan Lovells: EU legislators agree to delay for high-risk AI rules
• IAPP: AI Act Omnibus — what just happened and what comes next
• Inside Privacy summary: EU AI Act update — timeline relief, targeted simplification, and new prohibitions
• Full consolidated AI Act text (Regulation 2024/1689): EUR-Lex