The AI Act After The Digital Omnibus: Simplified Rules, Delayed Deadlines—But Can Compliance Wait?

July 2026 – On 27 July 2026, Regulation (EU) 2026/1744 (the Digital Omnibus) entered into force, only days before the original application date of the AI Act’s high-risk obligations.

Much of the discussion has focused on the postponement of the rules applicable to high-risk AI systems. While this is undoubtedly the most significant change for companies, it is far from the only one. The Digital Omnibus also amends a number of substantive AI Act requirements, while confirming that several important obligations continue to apply from 2 August 2026.

For stand-alone high-risk AI systems listed in Annex III, including systems used for recruitment, employee monitoring, performance evaluation, promotion, task allocation, and termination decisions, the relevant obligations have been postponed from 2 August 2026 to 2 December 2027. Similarly, the obligations applicable to AI systems embedded in products already regulated under EU product safety legislation will now apply from 2 August 2028.

The postponement of the high-risk AI obligations is accompanied by two additional deadline extensions: the machine-readable marking requirements for AI-generated content already on the market before 2 August 2026 apply from 2 December 2026, and the obligation on Member States to establish national regulatory sandboxes moves to 2 August 2027.

The Digital Omnibus also introduces several additional amendments intended to simplify implementation of the AI Act.

AI literacy has been redefined. The Digital Omnibus also changes the AI literacy obligation. Until now, organisations deploying AI systems had to ensure that their staff possessed a sufficient level of AI literacy. The Commission initially proposed removing this obligation altogether and shifting responsibility to the Commission and the Member States. The co-legislators took a different approach. Rather than removing the obligation, they revised it: organisations are now required to take measures to support the development of AI literacy among their staff.

This does not mean that companies no longer need to train their employees. Instead, the focus shifts towards putting in place appropriate measures, such as role-specific training, internal guidance, and regular awareness activities. Organisations deploying high-risk AI systems must also continue to ensure that the individuals overseeing those systems have the necessary competence.

Two new prohibited practices. AI systems generating non-consensual intimate imagery, and those generating child sexual abuse material, become prohibited from 2 December 2026. Companies making generative AI tools available to staff should review their acceptable use policies and internal governance rules to ensure that these prohibited uses are expressly addressed.

A wider basis for bias testing. The ability to process special categories of personal data in order to detect and correct bias, previously available only to providers of high-risk systems, now extends to providers and deployers of AI systems generally, subject to a strict necessity standard. For companies testing recruitment or evaluation tools for discriminatory outcomes this provides greater flexibility, although the data protection analysis remains demanding.

Administrative relief. The registration information required of providers has been reduced, and providers are no longer obliged to follow a Commission template when preparing post-market monitoring plans. Simplified technical documentation, proportionate conformity assessment procedures, adapted quality management systems, and reduced fine exposure — previously reserved for SMEs — now extend to small mid-cap companies, meaning those with fewer than 750 employees and turnover not exceeding EUR 150 million or a balance sheet total not exceeding EUR 129 million.

What has not been postponed

Transparency obligations continue to apply from 2 August 2026: Individuals interacting directly with an AI system must be informed that they are doing so, and AI-generated or manipulated content must be identified as such. In the HR context this covers recruitment chatbots, virtual assistants answering candidates’ questions, and generative tools used in recruitment or in employee communications.

The enforcement framework applies from the same date, with administrative fines reaching, depending on the infringement, EUR 15 million or 3% of total worldwide annual turnover, whichever is higher.

What does this mean for Romanian companies?

Romania has designated its competent authorities. Following the Government Memorandum of 12 March 2026, ANCOM acts as the market surveillance authority and single point of contact, with sector-specific responsibilities allocated to ASF, BNR, ANSPDCP, and ADR.

However, the national implementing legislation is still under preparation. Although the procedural framework is not yet finalised, this does not postpone companies' obligations. The AI Act is directly applicable across the European Union, and organisations must already comply with those provisions that are currently in force.

How companies should use the additional time

Rather than treating the postponement as a pause, organisations should use the additional sixteen months to strengthen their AI governance framework.

Priority should be given to:

• identifying all AI systems used throughout the employment lifecycle, including tools adopted directly by HR teams or by individual employees;
• assessing whether those systems are likely to qualify as high-risk;
• implementing the applicable transparency measures;
• ensuring appropriate AI literacy across the organisation;
• reviewing internal AI policies, governance frameworks and contractual arrangements with AI providers, including the date on which each tool was placed on the market; and
• assessing whether the introduction of AI systems triggers employee information and consultation obligations.

The key takeaway

While the Digital Omnibus has changed the AI Act compliance timeline, it also introduces a number of targeted amendments that go beyond postponing deadlines.

For companies, the practical message remains the same: AI Act compliance has already begun. The additional time should be used to prepare for high-risk AI obligations, not to postpone broader compliance efforts.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.