The single most consequential change in the Digital Omnibus is the split of the high-risk compliance deadline into two tracks. Stand-alone high-risk AI systems classified under Annex III — recruitment tools, credit scoring, biometric categorisation and the rest — now have until 2 December 2027 to comply. High-risk AI systems that are safety components of, or are themselves, products already regulated under Annex I legislation have until 2 August 2028.
That is a meaningful extension from the original 2 August 2026 high-risk date, and it reflects implementation feedback that providers could not realistically stand up conformity assessments, risk-management systems and Annex IV technical files in time. But the extension is confined to the high-risk obligations. It does not touch the prohibited-practice rules (in force since February 2025), the GPAI obligations, or the Article 50 transparency duties that apply from 2 August 2026.
Two adjacent changes matter for planning. First, the Article 4 AI-literacy requirement shifts from a mandatory obligation to an encouragement — organisations that had scoped mandatory training can move to a proportionate, risk-based programme, though literacy remains a sound control and a strong signal to auditors. Second, the simplified documentation regime is extended from SMEs to small mid-cap companies, so more organisations qualify for the lighter technical-file format.
The wrong response to a deadline extension is to stop. The right one is to use the runway: finish classification now, map the exact obligation set per system while it is cheap to change, and start accumulating dated evidence so that by late 2027 the file assembles itself. Veritome's engine already reflects the split deadlines, so each high-risk system shows the correct target date for its track.
Sources: Latham & Watkins, "EU AI Act Update: EU Resolves to Change Rules and Extend Deadlines"; VerifyWise, "EU AI Act omnibus: the new high-risk deadlines explained".