Episode Details

On 24 July 2026, the Official Journal of the European Union published Regulation (EU) 2026/1744, the Digital Omnibus on Artificial Intelligence. It amends Regulation (EU) 2024/1689, the AI Act, and it does one thing that matters more than anything else in the amendment. It moves the compliance date for the bulk of the high risk system regime from 2 August 2026 to 2 December 2027 for stand alone systems listed in Annex III, and to 2 August 2028 for artificial intelligence embedded in products already regulated under separate safety law, listed in Annex I. Founders who spent the summer racing a deadline that felt weeks away are now working against a date that sits sixteen months further out for most of what they were building toward, and twenty four months out for anything embedded in a regulated device. The same instrument adds one new prohibited practice to Article 5, banning artificial intelligence systems built to generate non consensual intimate imagery and material depicting child sexual abuse.

The confusion did not start this month. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and set 2 August 2026 as the twenty four month marker for the high risk regime: classification under Article 6, provider duties under Articles 8 through 17, conformity assessment under Article 43, and deployer duties under Article 26. That date sat on every compliance calendar built in 2024 and 2025. The Commission published its Digital Omnibus proposal on 19 November 2025. The Council and the Parliament reached provisional agreement on 7 May 2026. The Parliament approved the text on 16 June 2026 by a vote of 423 in favor, 57 against, and 174 abstentions. The Council gave final adoption on 29 June 2026, the instrument was signed on 8 July 2026, and it entered into force on 27 July 2026, three days after Official Journal publication. Sixteen months moved off the calendar through one amending regulation, and most of the compliance plans built against the old date have not yet caught up.

The second and larger source of confusion has nothing to do with timing. It concerns who owes what. A provider under Regulation (EU) 2024/1689 is the entity that develops a high risk system and places it on the market or puts it into service under its own name. A deployer is the entity that uses that system under its own authority, typically the provider’s customer. The conformity assessment described in Article 43 and the technical documentation described in Article 11 and Annex IV are provider obligations. Most Annex III categories, points 2 through 8, use the internal control route in Annex VI, where the provider self assesses against Articles 9 through 15 without a notified body. Certain biometric systems under Annex III point 1 require the Annex VII route, a notified body assessment of the quality management system and the technical file, when no harmonized standard applies or has been applied only in part. The technical file itself runs across nine sections under Annex IV: the system description, the development process and design choices, data governance, performance metrics and known limitations, the risk management documentation required by Article 9, lifecycle changes, the standards applied, the EU Declaration of Conformity, and the post market monitoring plan required by Article 72. Article 17 separately requires the provider to maintain a quality management system covering design, testing, data management, and post market monitoring. A small or micro enterprise, including a startup, may complete Annex IV in a simplified form once the Commission issues the template it is directed to publish, and a notified body must accept that simplified filing.

None of that file belongs to the deployer. Article 26 gives the deployer eleven categories of duty that run in a different direction entirely: use the system according to the provider’s instructions, assign human oversight to individuals with the competence and authority to inte