Free assessment

Published July 2, 2026

The AI Act timeline after the Digital Omnibus

The ”Digital Omnibus” simplification package postponed several AI Act deadlines. Here are the markers — to be confirmed, as the timeline remains in flux.

The key deadlines

  • Transparency obligations (limited risk): apply earlier, around August 2026.
  • High-risk “Annex III” (standalone systems, for example credit): pushed to 2 December 2027.
  • High-risk “product” (Annex I): around August 2028.

(Dates from the Digital Omnibus adopted mid-2026 — check the version in force.)

What the deferral does not change

Your system’s classification does not move: if a model is high-risk, it stays high-risk. The deferral buys time to document, not an exemption.

Another Omnibus adjustment

For bias detection and correction, processing sensitive data (special categories) used to be reserved for providers of high-risk systems. The Omnibus opens it to providers and deployers of any system, subject to a strict necessity test. This is a broadened legal basis, not a new obligation: it brings no one into the high-risk scope.

What to do now

  1. Inventory your AI systems (many organisations lack this list).
  2. Classify each one (high risk? limited? minimal?).
  3. For high-risk systems, fill the data dossier before the deadline, not at it.

Indicative guidance, not legal advice. Timeline subject to change.

COMPAS: Conformlex recovers the racial disparity ProPublica exposed Pointed at the COMPAS dataset without being told what to look for, the engine recovers the racial disparity in the risk score — the same one ProPublica's investigation exposed. Reproducible proof, honest framing.You have an AI governance platform. Who measured your data? AI governance and data evidence are two different jobs. Platforms document compliance; Article 10 requires measuring the dataset. Where the gap is.Article 10 of the AI Act, explained What 'representative, error-free, traceable' training data actually means — and who Article 10 really applies to.Are you covered by the AI Act? High, limited, minimal risk The AI Act risk tiers, how to place your system — and why most organisations overestimate their obligations.Building an auditable data dossier (Article 10) The eight blocks of Article 10-compliant dataset documentation, and the simple test to know whether your dossier holds up.AI Act and GDPR: where they overlap on training data Two distinct regulations, one common ground: provenance, legal basis, profiling. What overlaps and what differs.