The Digital Omnibus Delay: Your December 2027 High-Risk AI Deadline Is Already Ticking

On 29 June 2026, the Council of the European Union gave final approval to the Digital Omnibus regulation. The headline change: high-risk obligations for Annex III AI systems — including employment, education, credit, and insurance AI — are now due by 2 December 2027 instead of 2 August 2026. That gives mid-market companies roughly 15 months of additional runway beyond the original date.

But the runway does not cover what many assume. Prohibitions, AI literacy duties, GPAI model obligations, and transparency requirements are already enforceable. If your board is treating the delay as a blanket reprieve, the gap between perception and legal reality is where regulatory and commercial risk accumulates.

What the Digital Omnibus is

The Digital Omnibus is a legislative package that bundles amendments to several EU digital regulations, including the AI Act. Its purpose is to reduce administrative overlap, clarify enforcement timelines, and align the AI Act’s phased implementation with the broader EU digital compliance landscape.

The AI Act entered into force on 1 August 2024 on a staggered schedule. The Omnibus adjusted one piece of that schedule: the application date for high-risk obligations tied to Annex III systems.

Importantly, the Omnibus did not rewrite the AI Act’s substance. It did not narrow the definition of high-risk, exempt any sector, or soften penalties. It moved a date.

What got delayed — and what did not

This distinction is where most mid-market compliance teams get it wrong. The Omnibus created two tiers: obligations that are already live, and obligations that are now deferred. Conflating them is the single most common — and most dangerous — misreading of the current landscape.

Obligations that remain on their original enforcement dates

Obligations delayed to 2 December 2027

The Omnibus pushed back high-risk obligations for Annex III systems only. The affected categories include:

• Employment and worker-management AI: CV screening, candidate ranking, promotion and termination decisions, performance monitoring
• Education AI: Admissions, proctoring
• Creditworthiness and credit scoring
• Life and health insurance risk assessment and pricing
• Benefits eligibility determination
• Biometric identification and categorisation
• Critical infrastructure management
• Law enforcement, migration, and justice

Deployers of these systems now have until 2 December 2027 to meet the full Article 26 obligations: human oversight, input-data relevance checks, automatic logging with six-month retention, informing workers’ representatives and affected workers, and ongoing monitoring. Article 27 FRIA requirements for public bodies, private providers of public services, and credit-scoring or insurance-pricing deployers also shift to the same date.

Why the delay is an opportunity, not an excuse

Fifteen months sounds generous. It is not. High-risk compliance is not a single procurement decision — it is a cross-functional programme touching legal, IT, HR, procurement, and operations. The companies that use the runway strategically will be audit-ready with minimal disruption. The companies that treat December 2027 as “far away” will face the same scramble that GDPR preparation produced in early 2018 — except with higher fines and more complex technical requirements.

The delay also offers something rare in regulatory compliance: a defined budgeting window. Board-level approval for investment is substantially easier when you can point to a fixed deadline rather than a vague “sometime soon.” The 15-month runway converts AI compliance from an indefinite cost centre into a time-bounded capital project with clear milestones and measurable progress.

Your readiness timeline: now through December 2027

Phase 1 — Discover and inventory (Months 1–3)

1. Conduct a full AI-system inventory across all departments. Pull 18 months of SSO logs, procurement records, and SaaS spend data.
2. Survey department heads about shadow AI — free-tier tools, browser extensions, plugins that never hit procurement.
3. Document every tool’s purpose, data inputs, vendor, and whether it influences decisions about natural persons.

Phase 2 — Classify and assess (Months 3–6)

1. Complete formal risk classification for each system against the AI Act’s risk tiers.
2. Determine provider vs. deployer roles for each tool. This determines which obligations apply and when.
3. Flag anything touching employment, education, credit, insurance, or biometrics as a candidate Annex III high-risk system.
4. For systems confirmed as high-risk, map every Article 26 obligation to a responsible function.

Phase 3 — Remediate and document (Months 6–10)

1. Negotiate contractual provisions with vendors: logging capabilities, human-oversight interfaces, data-relevance guarantees, and incident-reporting commitments.
2. Build or configure automatic-logging infrastructure. Ensure logs are retained for at least six months.
3. Draft internal policies: human-oversight protocols, escalation procedures, and worker-notification templates.
4. Run a GDPR DPIA for systems that process personal data in ways that also trigger Article 35. The two analyses overlap and should be coordinated, not duplicated.
5. Conduct a FRIA if you are a public body, a private provider of public services, or a deployer of credit-scoring or insurance-pricing AI.

Phase 4 — Train and embed (Months 10–13)

1. Deliver role-specific AI literacy training. System operators need different training from decision-makers who act on AI outputs.
2. Integrate high-risk AI obligations into existing management-system processes. ISO 42001 alignment is a natural fit.
3. Test human-oversight and logging workflows before the compliance date, not after.

Phase 5 — Audit and maintain (Months 13–15, then ongoing)

1. Conduct an internal audit or mock assessment against Article 26 and Article 27 requirements.
2. Establish quarterly review cycles for the AI register.
3. Assign a named compliance owner with board-level reporting line.

What happens if you ignore it

Non-compliance with the AI Act carries real financial exposure. For prohibited practices, fines reach €35 million or 7% of global annual turnover. For most other obligations — including the high-risk duties now due in December 2027 — the cap is €15 million or 3% of turnover. Beyond fines, deployers face reputational risk: the enforcement framework includes market surveillance action, mandatory corrective measures, and withdrawal of AI systems from service.

For mid-market companies selling to enterprise clients, the practical risk is equally severe. Enterprise vendor questionnaires already ask for AI-system inventories and risk classifications. ISO 42001 audits require documented AI governance. If you cannot demonstrate an AI register and a compliance roadmap, you lose deals — regardless of whether the regulator has knocked on your door.

The delay buys you time. It does not buy you safety. Use it well.

To accelerate your AI inventory and risk classification against the December 2027 deadline, explore how Renomira can help your team turn the runway into a compliance programme.

Frequently asked questions

Does the Digital Omnibus delay apply to all AI Act obligations?

No. The delay applies specifically to high-risk obligations for Annex III systems. Prohibited practices, the AI-literacy obligation, GPAI model duties, Article 50 transparency requirements, and the penalty framework are all unaffected. They remain on their original enforcement dates.

If I do not deploy any Annex III high-risk AI, do I have obligations right now?

Yes. If your employees use AI tools at all, the Article 4 AI-literacy obligation has applied since 2 February 2025. If your systems interact with natural persons — for example, chatbots serving customers — Article 50 transparency duties have applied since 2 August 2026. And if any system falls under Article 5’s prohibited practices, that prohibition has been enforceable since February 2025.

Does the delay change the definition of what counts as high-risk?

No. The Omnibus moved a date, not a definition. Annex III still covers the same categories — employment, education, credit, insurance, biometrics, critical infrastructure, law enforcement, migration, and justice. If your AI system falls within those categories, it is high-risk. The only change is when compliance obligations become enforceable.

How does the AI Act interact with GDPR for employment AI?

Several Article 26 obligations — input-data relevance, automatic logging, and human oversight — overlap with GDPR requirements for automated decision-making under Article 22 and data-protection impact assessments under Article 35. Employment AI that screens CVs or monitors performance likely triggers both regimes simultaneously. Coordinating these analyses avoids duplication and ensures consistency.

What should my board be asking about right now?

Three questions: (1) Which of our AI systems fall within Annex III? (2) What is our compliance roadmap against the 2 December 2027 deadline? (3) What is the budget and who owns delivery? If your team cannot answer these within 48 hours, the runway is already shorter than it should be.