EU AI Act After the Digital Omnibus: What Applies Now
The Digital Omnibus on AI did not freeze the AI Act. Regulation (EU) 2026/1744 moved most high-risk duties to 2 December 2027 and 2 August 2028, but bans, AI literacy, general-purpose AI (GPAI) model rules, and most transparency duties already bind providers and deployers in the EU. For companies in Bulgaria and the wider CEE region, the useful question is no longer “when does the Act start?” It is “which calendar line are we on?”
Why this matters in November 2026
On 4 November 2026, industry coverage again framed the Omnibus as buying time on high-risk systems while warning that delay is not a pause on governance. The European Post summarised the fixed 2027 and 2028 dates. SC Media stressed the same point from an enforcement angle: inventories, ownership and evidence already matter because authorities have powers for the rules that apply now.
The European Commission’s own AI Act overview confirms the split timeline after the Omnibus: Annex III high-risk systems from 2 December 2027, Annex I product-embedded high-risk systems from 2 August 2028, with earlier chapters already live.
What the Digital Omnibus changed
The Omnibus is a targeted amendment, not a rewrite. In practical terms it:
- Fixed the high-risk start dates instead of leaving them tied to a floating standards trigger.
- Rewrote Article 4 so organisations must support AI literacy, without guaranteeing a specific level for every individual.
- Extended several SME simplifications to small mid-cap enterprises (SMCs).
- Added prohibitions on AI systems that generate non-consensual intimate material or child sexual abuse material, applicable from 2 December 2026.
- Gave providers of generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the machine-readable marking duty in Article 50(2).
A consolidated reading of those amendments is available in the AI Act Explorer Digital Omnibus pages and in independent summaries such as Proofcan’s Omnibus note (reviewed 3 November 2026).
The calendar companies should keep on one page
| Date | What applies |
|---|---|
| 2 Feb 2025 | Prohibited practices (original list) and AI literacy duty |
| 2 Aug 2025 | GPAI model obligations and related governance |
| 27 Jul 2026 | Digital Omnibus enters into force |
| 2 Aug 2026 | Broader application, including most Article 50 transparency duties for new systems and deployers; national market surveillance and AI Office enforcement powers for applicable rules |
| 2 Dec 2026 | Marking transition for generative systems already on the market; new intimate-content / CSAM prohibitions |
| 2 Dec 2027 | High-risk rules for Annex III use cases |
| 2 Aug 2028 | High-risk rules for Annex I product-embedded systems |
This table is the numbers story. If your board still hears “AI Act means August 2026 for everything,” replace that sentence with the row that matches your systems.
What already binds you today
Treat these as live, not deferred:
- Prohibitions. The original banned practices remain in force. From 2 December 2026 they expand to the new intimate-content and CSAM system bans described by the Commission.
- AI literacy. Providers and deployers must take measures that support literacy for staff and others who operate or use AI on their behalf. The Omnibus wording removes the “guarantee a sufficient level for each person” reading, but it does not remove the duty to train and support.
- GPAI model rules. Providers of general-purpose models have been under obligations since August 2025.
- Transparency that already started on 2 August 2026. Interaction disclosure for chatbots and similar systems, deepfake labelling for deployers, and marking for new generative systems are not postponed by the Omnibus as a whole. Only the limited legacy-marking transition runs to 2 December 2026.
Fines remain material: up to €35 million or 7% of worldwide annual turnover for prohibited practices and certain data-related breaches, and up to €15 million or 3% for many other infringements, subject to proportionality and the SMC rule that uses the lower of the percentage or the absolute amount.
What is delayed — and what that delay is for
High-risk obligations for stand-alone Annex III systems move to 2 December 2027. High-risk obligations for systems that are themselves products or safety components under Annex I move to 2 August 2028. The Commission’s rationale, repeated in its public timeline, is that companies need standards and support tools before those duties bite.
Delay is useful only if you spend it. Risk management, data governance, technical documentation, human oversight, logging, robustness and cybersecurity for high-risk uses take months to put in place across a mid-sized group. Waiting until late 2027 creates a compliance queue exactly when authorities will expect evidence.
What 2 December 2026 still forces
Even with high-risk postponed, the next four weeks are not empty:
- Ask every generative-AI vendor whether systems placed on the market before 2 August 2026 will meet Article 50(2) marking by 2 December 2026, and keep the written answer.
- Check deployers’ visible labelling for deepfakes and public-interest AI text where Article 50 already requires it.
- Review any internal or customer-facing tool that could generate non-consensual intimate imagery or CSAM-like material; the new prohibitions are not a marketing footnote.
- Confirm who owns the AI inventory. Without inventory and role assignment (provider vs deployer), the later high-risk work has nowhere to land.
SME and small mid-cap reliefs that change the paperwork
The Omnibus does not create a free pass. It changes the shape of documentation:
- SMEs, start-ups and SMCs may use simplified technical documentation forms for high-risk systems once those duties apply.
- Certain simplified quality-management options remain for SMEs without partner or linked enterprises.
- SMCs get the lower of the percentage or absolute fine cap for several infringements.
If your group sits just above the classic SME thresholds, check the SMC definition in Commission Recommendation (EU) 2025/1099 before you assume “large company” paperwork by default.
A practical 90-day plan for Bulgaria and CEE
Bulgarian companies face the same Regulation as the rest of the EU. National market-surveillance designation can lag; that lag does not suspend directly applicable duties. A workable quarter looks like this:
- Build or refresh the AI inventory. System, purpose, owner, data classes, users affected, provider/deployer role, and a provisional risk class.
- Separate “live now” from “2027/2028”. Literacy, bans, transparency and vendor marking sit in the first bucket; full high-risk conformity work sits in the second.
- Assign one accountable owner. Legal, IT, security and HR all touch AI; one person still needs end-to-end ownership.
- Connect AI controls to existing risk programmes. ISO/IEC 27001, privacy, supplier risk and incident response already hold most of the evidence pattern you will need.
- Train the people who actually use the tools. Literacy under the rewritten Article 4 is a support duty, not a slogan. Structured AI training for operators and managers is the practical response.
- Pressure-test readiness. The free AI Act Readiness Test on Encorp.ai flags gaps before you write a long policy that nobody can prove.
For ownership and ongoing oversight after go-live, many mid-sized firms also need a named AI Director function and a durable AI governance operating model, then AI Ops for model changes, cost and quality drift. If you want a short working session on the calendar above, contact Encorp.ai.
Key takeaways
- The Digital Omnibus bought time on high-risk rules; it did not pause bans, literacy, GPAI duties or most transparency rules.
- Keep one shared calendar: 2 December 2026 still matters for marking and new prohibitions; 2027 and 2028 are for high-risk conformity.
- Inventory, ownership and evidence are the board questions that already apply.
- SME and SMC reliefs change documentation and fine caps, not the need to classify systems.
- Bulgarian and CEE companies should act on the EU timeline now, not wait for every national organigram to settle.
