Has the EU AI Act been delayed? The current timeline for companies after the Digital Omnibus.

All summer the same headline went around LinkedIn and news sites: "The EU AI Act has been delayed." It is not wrong, but it is incomplete. Some dates moved; the rules stayed. For a company selling products or services into the EU, the right question is: what applies today, and what applies when?

What changed?

The Digital Omnibus was published in the Official Journal as Regulation (EU) 2026/1744 and made these changes to the AI Act:

• Annex III high-risk systems (recruitment, credit, education, critical infrastructure and similar): 2 December 2027 instead of 2 August 2026.
• High-risk systems embedded in products (Annex I: machinery, medical devices, toys and similar): 2 August 2028.
• Marking AI-generated content: systems placed on the market before 2 August 2026 have until 2 December 2026.
• New prohibitions: apps that generate non-consensual intimate imagery are banned from 2 December 2026.
• Small mid-caps: companies with fewer than 750 employees and turnover up to €150 million or a balance sheet up to €129 million can use SME relief.
• Machinery Regulation: moved to the lighter section of Annex I to reduce overlap.

What it means for a company selling from Türkiye into the EU

The Act covers not only EU companies but anyone whose product or output is used in the EU. If you build a machine that uses vision-based quality inspection as a safety function, you fall under Annex I and your date is 2028. If you supply an EU customer with software used in recruitment or credit decisions, your date is 2027. If you use agents for your own internal processes, you are usually not high-risk, but the transparency and literacy rules still apply.

The delay is not a break; it is preparation time.

How to use the extra time

• Inventory: which AI systems does the company use, and which are inside its products?
• Risk class: is each one prohibited, high-risk, transparency-only or minimal risk?
• Supplier documents: what documentation do you need from the providers of the models and software you use?
• Human oversight and logging: who makes the decision, and is every agent step logged?

The last point is a principle I apply in every agent setup from day one: the agent prepares, a person approves, every step is logged. It is a small version of what the Act expects from high-risk systems.

For the detailed timeline, the Cyber Resilience Act and the situation in China, the US and Türkiye, see the AI regulation 2026 guide.

This post is general information, not legal advice. For your own products, rely on the official texts and expert advice.