EU Digital Omnibus on AI Is Now Law: Formal Adoption Completed July 2026, Annex III High-Risk Obligations Deferred to December 2, 2027

EU Digital Omnibus on AI Is Now Law: Formal Adoption Completed July 2026, Annex III High-Risk Obligations Deferred to December 2, 2027

The EU's "Digital Omnibus on AI" has completed the legislative process and is now binding law. The adoption timeline, confirmed by Renaissance Numérique: after the May 7, 2026 trilogue political agreement and Coreper endorsement on May 13, came "the European Parliament's plenary vote on 16 June 2026," followed by EU Council final approval on 29 June 2026. "The regulation was then signed on 8 July 2026 and published in the Official Journal on 24 July, entering into force on 27 July 2026."

The headline change for enterprise compliance planning: stand-alone high-risk systems listed in Annex III "now become subject to the regime on 2 December 2027, instead of 2 August 2026"¹ — a 16-month deferral of the obligations that would have otherwise hit embedded HR, credit, education, and essential-services AI systems within weeks. (Embedded-in-product high-risk systems under Annex I move to August 2028.) This supersedes the provisional-agreement status covered in prior cycles — the deferral is no longer a political deal but enacted law (OJ L, 2026/1744, 24.7.2026).

The second strand of the Omnibus package — amending the GDPR and ePrivacy Directive, including the contested redefinition of "personal data" — remains under negotiation, and Renaissance Numérique's roundtable documented the fault lines: industry representatives welcomed "practical and precise rules," while critics warned the new wording "could pave the way for opportunistic declarations" letting entities "unilaterally classify their data as 'pseudonymized' or 'anonymous'" and cautioned that "opening the Pandora's box of textual revision" risks "permanent legal instability."

What it means: Enterprises with EU exposure get breathing room on Annex III high-risk classification, but the deferral is not a repeal — and the liability architecture is arriving through parallel channels regardless: Italy's Decree 160 (Italy's Decree 160 Is Now in Force (September 30, 2026): Direct Action Against AI Insurers, Presumed Causation, and Facts-Deemed-Admitted Sanctions) already attaches criminal and civil consequences to AI Act obligations, and the revised Product Liability Directive transposition deadline is December 9, 2026 (EU PLD Transposition Countdown: Three States Done, Twelve in the Pipeline — and National Divergences Emerging Under a Maximum-Harmonization Directive). The practical sequencing for risk teams: use the 2027 runway to build the Article 9/11/12/14 documentation (risk management, technical documentation, logs, human oversight) — because Italy's model shows those records are becoming discoverable evidence with deemed-admission consequences for non-production.