The European Commission proposes a one-year delay for high-risk AI obligations and softens AI literacy to encouragement

The European Commission has presented the Digital Omnibus on AI regulation proposal, a targeted amendment to the AI Act designed to simplify implementation and adjust key timelines. It was published alongside the broader Digital Omnibus Regulation Proposal, which updates the GDPR, the Data Act and NIS 2 and repeals the Data Governance Act (see our blogpost on this proposal), as well as a separate proposal to establish European Business Wallets, marking a coordinated effort to reshape the EU’s digital governance framework.

While this new AI-specific Omnibus proposal offers additional breathing room for companies working with high-risk AI systems, it also introduces new layers of uncertainty. Beyond the revised timelines the requirements for high-risk AI systems, the proposal includes several targeted adjustments.

Delays to the AI Act’s high-risk regime

There are two Omnibus proposals because the AI Omnibus faces greater time pressure, given that the high-risk rules start applying in August 2026. Under the AI Act’s original timeline, the high-risk obligations apply from 2 August 2026 for Annex III (context specific) AI systems and from 2 August 2027 for Annex I (harmonised sector specific) AI systems (see our blogpost: 7 steps to identify if your AI system is high-risk under the AI Act).

The biggest adjustment introduced by the Digital Omnibus proposal on AI is the additional delay for these obligations, which is reassuring for companies developing or deploying high-risk AI systems.

The Commission proposes these delays because many of the technical standards, common specifications and alternative guidance that companies need in order to comply with the AI Act’s high-risk requirements are still under development and not yet published. Without these technical standards, businesses would face significant uncertainty, making the original deadlines unworkable.

The adjusted timeline in the proposal works in two layers:

1. Acceleration clause

High-risk obligations start earlier once the Commission adopts a decision confirming that adequate compliance measures are available.

· Annex III AI systems must comply with the high-risk AI obligations 6 months after the Commission decision.

· Annex I AI systems must comply with the high-risk AI obligations 12 months after the Commission decision.

This means the Commission reserves the right to bring the application date forward whenever it considers that sufficient compliance tools are in place, such as harmonised standards, common specifications or administrative guidance.

2. Fixed dates

If no Commission decision is adopted, the obligations still start on the following fixed dates:

· Annex III AI systems must comply by 2 December 2027.

· Annex I AI systems must comply by 2 August 2028.

AI literacy shifts from obligation to encouragement

AI literacy requirements are significantly softened. Rather than a binding obligation on providers and deployers, the responsibility shifts to the Commission and the Member States, who must now foster AI literacy and encourage organisations to take appropriate measures. In effect, the AI literacy obligation is no longer enforced.

The role of the EU AI Office is expanded

The EU AI Office becomes the authority responsible for supervising certain AI systems built on general-purpose models when the same provider develops both the model and the system.

Article 6(3) exception no longer requires public disclosure

Providers no longer need to register AI systems used in high-risk domains when they have documented that the system is not in fact high-risk due to its narrow or procedural use. They must still provide the assessment upon request, but they are no longer required to publish a short summary of the reasons for considering the system non-high-risk under the Article 6(3) procedure. In practice, this is a significant change, as invoking an Article 6(3) exception previously carried considerable legal and reputational risk.

Proportionate penalties for small mid caps

Smaller and more proportionate penalties are introduced and simplified compliance measures previously limited to SMEs are extended to small mid caps.

Bias detection exception broadened

The proposal introduces a new Article 4a that replaces Article 10(5) of the AI Act and creates a broader legal basis allowing both providers and deployers of AI systems and AI models to process special categories of personal data for the sole purpose of detecting and correcting bias, instead of limiting this possibility to providers of high-risk AI systems only.

A window of legal uncertainty as August 2026 approaches

The extended deadlines will only apply if the co-legislators adopt the Digital Omnibus on AI in time. Otherwise, the high-risk regime will continue to apply as of August 2026. If negotiations in the Parliament and the Council continue beyond August 2026, the EU risks entering a period in which the high-risk obligations technically apply while lawmakers are still debating whether to postpone them. This creates significant uncertainty around enforcement and raises the question of whether any retroactive legislative correction would be legally accepted.

And if a deal is reached before the August 2026 deadline, the Commission can trigger the obligations earlier through the acceleration clause. Timelines may shift, but the obligations will not disappear. Preparing early remains the safest path, especially for companies developing or deploying high-risk AI systems.