Notifications
Clear all
Topic starter
18/08/2026 2:25 pm
TL;DR: The EU AI Omnibus delays high-risk AI Act deadlines to 2027 and 2028, but transparency, GPAI enforcement, and market surveillance still begin on August 2, 2026, according to BigID. The result is not a rollback but a split compliance timetable that rewards inventory, classification, and data governance work now.
NHIMG editorial — based on content published by BigID: the EU AI Omnibus and its impact on AI Act compliance timelines
By the numbers:
- Standalone high-risk systems now have until December 2, 2027, under the Omnibus.
- Product-embedded high-risk systems now have until August 2, 2028, under the Omnibus.
Questions worth separating out
Q: What do organisations get wrong about AI compliance deadlines?
A: They often treat deadline extensions as a signal to wait.
Q: What breaks when AI system inventory is incomplete under the EU AI Act?
A: Incomplete inventory breaks classification, and classification breaks everything downstream.
Q: Why do access controls matter in AI regulatory compliance?
A: Access controls matter because AI compliance depends on proving who could reach training data, prompts, model outputs, and supporting records.
Practitioner guidance
- Rebuild the AI compliance timeline Separate transparency obligations from high-risk conformity work and assign independent owners for each track.
- Inventory shadow AI and embedded models Map every AI system in use, including approved tools, embedded third-party models, and unmanaged generative features.
- Document data lineage and access evidence Record where training, validation, prompt, and output data comes from, who can reach it, and how it is retained.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- The full obligation timeline for Article 50, GPAI enforcement, and high-risk conformity milestones across 2026, 2027, and 2028.
- The article's practical breakdown of what inventory, classification, and lineage documentation should contain for AI governance evidence.
- BigID's mapping of shadow AI discovery to compliance readiness, including the controls needed to prove access governance.
- The article's explanation of how organisations can re-baseline current compliance work without pausing underlying data governance.
👉 Read BigID's analysis of the EU AI Omnibus and AI Act deadline changes →
EU AI Omnibus: what changed, and what still needs action?
Explore further
18/08/2026 3:16 pm
The Omnibus does not reduce governance pressure, it redistributes it. By moving high-risk deadlines while keeping transparency and enforcement active, the EU has created a split regime that rewards organisations only if they start working now. The immediate risk is deadline confusion, where teams pause substantive control work because one date moved. Practitioners should treat this as a sequencing problem, not a reprieve.
A question worth separating out:
Q: Who is accountable when a customer-facing AI system fails Article 50 transparency requirements?
A: Accountability sits with the provider and, in some cases, the deployer, depending on how the system is built and placed on the market. Organisations should assign a named owner for disclosure, content marking, and monitoring, because regulators will look for responsibility at the system level, not the team level.
👉 Read our full editorial: EU AI Omnibus delays high-risk deadlines but keeps enforcement live
