EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar

The date most engineering teams had circled for the EU AI Act was 2 August 2026. It has passed, and what it meant depends on which obligation you mean, because the omnibus moved some of them by sixteen months and left others exactly where they were. Reading one headline that says the AI Act was delayed is how a team ends up treating a live transparency duty as optional.

This post is a DevOps calendar built from sources I read on 17 October 2026: the Commission's AI Act page, the AI Act Service Desk timeline, the Article 50 and Article 99 texts as reproduced there, and three law-firm analyses by Orrick, Cooley and Cuatrecasas. I could not read the Official Journal text itself from a script, and I say what that limits in the failure section. It covers what moved, what did not, what a pipeline owner can act on, and a small script that turns the dates into a CI check.

What Regulation 2026/1744 actually moved

Cooley and Cuatrecasas both report that Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, three days after publication; the Commission's own page confirms the 27 July date. It amends Regulation (EU) 2024/1689, the AI Act. Orrick's analysis groups the changes into eight; for a delivery team, the dates are the part that changes a plan.

The table below merges the three law-firm summaries and the AI Act Service Desk timeline. Where they agreed I stated the date; the last two rows are the ones that did not move, listed so the table answers the question people actually ask, which is what still applies.

What the omnibus left alone

Cooley's summary is explicit that the Article 5 prohibited practices in force since 2 February 2025, the general-purpose AI obligations in force since 2 August 2025, Article 50 transparency for new systems from 2 August 2026, and the AI Office's enforcement powers and governance bodies from the same date were not moved. The Commission's page says the transparency rules come into effect in August 2026 and describes the Act as applicable from 2 August 2026 with some exceptions, which is consistent.

Two smaller points sit in the same bucket. Cooley reports that the Commission's proposal to drop the Article 6(3) registration requirement was rejected, so a provider that concludes its system is not high-risk still registers, with a simplified procedure available. Cuatrecasas and Cooley both say the AI literacy duty survived in softer form: providers and deployers are asked to support AI literacy, and the article states that it does not require a specific literacy level of anyone in particular.

Article 50 and the 2 December 2026 marking date

Article 50 is the part of the Act a pipeline owner can most directly implement, and most of it has applied since 2 August 2026. I read the text as reproduced on artificialintelligenceact.eu; the table gives its four paragraphs in plain terms and the last column is my suggestion of where each one shows up in an engineering estate, not a legal conclusion.

The 2 December 2026 grace applies to one thing only. Orrick and Cooley both say providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet Article 50(2); anything placed on the market after that date was due on 2 August 2026. Cuatrecasas adds that the Commission had proposed six months and Parliament three, so older explainers quote February or November dates that did not survive.

The text asks for marking that is robust and interoperable, and a boolean in a JSON response is neither. What a CI test can do is stop the marker being silently dropped by the next refactor. The test below is deliberately format-agnostic: swap the assertions for whichever technique you decide meets the standard once you have read it.

// test/generated-output-marking.test.mjs  (run with: node --test)
// Purpose: stop the Article 50(2) marker being dropped by a refactor.
// It does NOT prove the marker is robust or interoperable. That judgement
// is yours, made against the standard you pick.
import test from "node:test";
import assert from "node:assert/strict";
import { generateSummary } from "../src/summaries.mjs"; // your generative feature

test("every generated output carries a machine-readable AI marker", async () => {
  const out = await generateSummary("quarterly incident review");

  // Wrong: only checking the visible text. A footer a user can crop is not
  // a machine-readable marking, and a test that passes on it gives false comfort.
  // assert.match(out.text, /generated by AI/i);

  // Right: assert on the structured field that downstream tools read.
  assert.equal(out.metadata.aiGenerated, true);
  assert.ok(out.metadata.generator, "generator id must be present");
});

test("the marker survives the export path", async () => {
  const out = await generateSummary("quarterly incident review");
  const exported = JSON.parse(JSON.stringify(out)); // what the API actually returns
  assert.equal(exported.metadata.aiGenerated, true);
});

The two new bans and the penalty tier above them

Orrick describes two new Article 5 prohibitions applying from 2 December 2026: AI that generates or manipulates non-consensual intimate imagery of identifiable people, including nudifier apps, and AI that generates child sexual abuse material. The scope covers systems designed for these outputs and systems where the outputs are reasonably foreseeable and reproducible without adequate safeguards. Cooley notes there is no exemption for systems already on the market, which is why this one does not get the Article 50(2) grace.

For anyone who hosts an image or video generation feature, the second scope limb is the operative one. It turns a guardrail from a product nicety into something you may need to show. The Article 99 page I read lists up to EUR 35,000,000 or 7 percent of worldwide annual turnover, whichever is higher, for Article 5 infringements, and up to EUR 15,000,000 or 3 percent for other operator obligations including Article 50; it does not mark those figures as changed by the omnibus, and I did not verify them against the Official Journal.

High-risk is deferred, not dismissed

The Annex III date moved from 2 August 2026 to 2 December 2027 and the Annex I date from 2 August 2027 to 2 August 2028, which Cooley counts as sixteen and twelve months. The Commission's page gives biometrics, education and employment as examples of Annex III use cases. Cooley says the omnibus replaced the Commission's conditional mechanism with fixed dates, so there is no longer a trigger to wait for.

The transition rule matters more to a DevOps team than the date. Cuatrecasas reports that units of a high-risk system lawfully placed on the market before the applicable date can keep being placed on the market while the design stays unchanged, and that a significant design change triggers full compliance, including conformity assessment. Orrick calls the trigger substantially modified; the service desk timeline says significant design changes. Whether swapping or fine-tuning a model counts is not something any source I read answers, so that question goes to counsel before the release, not after.

Where this goes wrong

The first failure is reading the omnibus as a pause button. It deferred one class of obligation and added a new one, and the table shows two dates in December 2026 that did not exist in the original calendar. A team that read delayed and stopped reading will miss the marking date and the ban date together.

The second is trusting a single summary, and I did not escape it myself. Calling EUR-Lex from a script returned an HTTP 202 with an empty body and a WAF challenge header, so the Official Journal text was unreadable to me, and every date here comes from the Commission page and secondary analyses that agree with each other. They also disagree in places: the Commission page does not say whether Article 50 changed, and the praxikon summary I read mentions no 2 August 2026 application date at all. Where sources were silent I left the point out.

Putting the calendar in CI

A calendar that lives in a wiki is read once. The register below lists each AI-enabled service with the few facts the dates depend on: your role, whether it generates content, whether it was on the market before 2 August 2026, and whether its use case looks like an Annex III area. The role and use-case fields are your input and need legal confirmation; the script only checks that someone filled them in.

// ai-systems.json  (the register; roles and use cases need legal confirmation)
[
  {
    "id": "support-assistant",
    "owner": "platform-team",
    "role": "provider",
    "generatesContent": true,
    "onMarketBefore20260802": true,
    "markingPlan": "response middleware adds metadata.aiGenerated, ticket PLAT-142",
    "annexIIIArea": null
  },
  {
    "id": "cv-screening",
    "owner": null,
    "role": "deployer",
    "generatesContent": false,
    "onMarketBefore20260802": true,
    "markingPlan": null,
    "annexIIIArea": "employment"
  }
]

// scripts/ai-act-calendar.mjs  (run in CI: node scripts/ai-act-calendar.mjs)
import { readFileSync } from "node:fs";

// Dates as read on 17 October 2026 from the sources in this post.
// Re-check against the Official Journal text before changing or trusting them.
const DEADLINES = [
  { date: "2026-12-02", what: "Art. 50(2) marking, systems on market before 2026-08-02" },
  { date: "2026-12-02", what: "New Art. 5 bans: non-consensual intimate imagery, CSAM" },
  { date: "2027-08-02", what: "National regulatory sandboxes due" },
  { date: "2027-12-02", what: "Annex III high-risk obligations (Art. 6(2))" },
  { date: "2028-08-02", what: "Annex I high-risk obligations (Art. 6(1))" },
  { date: "2030-08-02", what: "High-risk systems for public authorities" },
];
const WARN_DAYS = 60; // my choice, not the Act's

// AI_ACT_TODAY lets you rehearse the calendar at a future date.
const today = new Date(process.env.AI_ACT_TODAY ?? new Date().toISOString().slice(0, 10));
const register = JSON.parse(readFileSync("ai-systems.json", "utf8"));

let failed = false;
for (const d of DEADLINES) {
  const days = Math.ceil((new Date(d.date) - today) / 86400000);
  const flag = days < 0 ? "PASSED" : days <= WARN_DAYS ? "SOON" : "ok";
  console.log(flag.padEnd(7) + d.date + "  " + String(days).padStart(5) + " days  " + d.what);
}

for (const s of register) {
  // Marking plan: provider-side generative systems already on the market.
  if (s.role === "provider" && s.generatesContent && !s.markingPlan) {
    console.error("FAIL " + s.id + ": generative provider system has no marking plan");
    failed = true;
  }
  // An Annex III candidate nobody owns will not get its design-change log kept.
  if (s.annexIIIArea && !s.owner) {
    console.error("FAIL " + s.id + ": Annex III candidate (" + s.annexIIIArea + ") has no owner");
    failed = true;
  }
}
process.exit(failed ? 1 : 0);

The script fails the build when a generative provider system has no marking plan, when an Annex III candidate has no owner, and prints the days left to each dated item. Run it with AI_ACT_TODAY to rehearse the calendar at a future date. The 60-day warning window is my choice, not the Act's.

What to do on Monday

Five steps, in the order that costs least. None of them needs a legal ruling to start; all of them need one before you close them.

1. Build the register: every service that calls a generative model, your role for it, whether it generates audio, image, video or text, and whether it was on the market before 2 August 2026.
2. For each provider-side generative system on the market before that date, write a marking plan and add the output test before 2 December 2026.
3. Run a guardrail check on any image or video generation feature against the two new Article 5 bans before 2 December 2026, and keep the result.
4. Tag Annex III candidates, such as biometrics, education and employment uses, and record the release in which each last changed design, since that is the trigger Cuatrecasas describes.
5. Commit the register and the calendar script, run it in CI, and put a monthly reminder to re-read the Official Journal text and update the research date.

If the register is empty after an hour, that is a finding too: either nothing in your estate is in scope, or nobody knows what is. Both are worth writing down.

A deferral moves the deadline of one class of duty and leaves every other date where it was. After 2026/1744, the calendar that matters to a DevOps team is not one date but four: Article 50 now, marking and the new bans on 2 December 2026, high-risk on 2 December 2027 and 2 August 2028.