# EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar > Regulation (EU) 2026/1744 moved AI Act high-risk dates to Dec 2027 and Aug 2028, but Article 50 and two Dec 2026 deadlines still apply. A DevOps calendar. URL: https://www.matthewswong.com/en/blog/eu-ai-act-digital-omnibus-devops-deadlines/ - Author: Matthews Wong (https://www.matthewswong.com/en/about/) - Published: 2026-10-17 - Updated: 2026-10-17 - Category: Security > **Key takeaway:** Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved Annex III high-risk obligations to 2 December 2027 and embedded-product obligations to 2 August 2028. It did not move Article 50 for new systems, which applied from 2 August 2026. Two dates still land on 2 December 2026: Article 50(2) marking for older generative systems, and two new Article 5 bans. The date most engineering teams had circled for the EU AI Act was 2 August 2026. It has passed, and what it meant depends on which obligation you mean, because the omnibus moved some of them by sixteen months and left others exactly where they were. Reading one headline that says the AI Act was delayed is how a team ends up treating a live transparency duty as optional. This post is a DevOps calendar built from sources I read on 17 October 2026: the Commission's AI Act page, the AI Act Service Desk timeline, the Article 50 and Article 99 texts as reproduced there, and three law-firm analyses by Orrick, Cooley and Cuatrecasas. I could not read the Official Journal text itself from a script, and I say what that limits in the failure section. It covers what moved, what did not, what a pipeline owner can act on, and a small script that turns the dates into a CI check. > **Research date and disclaimer** > Researched on 17 October 2026 from the sources listed at the end. This is an engineering summary, not legal advice. Whether your company is a provider or a deployer of a given system, and whether a system is high-risk, are legal questions for your counsel. Dates may be amended again; re-check the Official Journal text before relying on any of them. ## What Regulation 2026/1744 actually moved Cooley and Cuatrecasas both report that Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, three days after publication; the Commission's own page confirms the 27 July date. It amends Regulation (EU) 2024/1689, the AI Act. Orrick's analysis groups the changes into eight; for a delivery team, the dates are the part that changes a plan. The table below merges the three law-firm summaries and the AI Act Service Desk timeline. Where they agreed I stated the date; the last two rows are the ones that did not move, listed so the table answers the question people actually ask, which is what still applies. Annex III stand-alone high-risk systems (Article 6(2)) 2 August 2026 2 December 2027 Annex I high-risk systems embedded in products (Article 6(1)) 2 August 2027 2 August 2028 High-risk systems intended for public authorities 2 August 2026 2 August 2030 Article 50(2) marking, for generative systems already on the market before 2 August 2026 2 August 2026 2 December 2026 Two new Article 5 bans: non-consensual intimate imagery (nudifier apps) and CSAM Did not exist 2 December 2026 At least one national regulatory sandbox per Member State 2 August 2026 2 August 2027 Article 50 for systems placed on the market from 2 August 2026 2 August 2026 Unchanged: 2 August 2026 General-purpose AI model obligations (Articles 51 to 56) 2 August 2025 Unchanged: in force since 2 August 2025 ## What the omnibus left alone Cooley's summary is explicit that the Article 5 prohibited practices in force since 2 February 2025, the general-purpose AI obligations in force since 2 August 2025, Article 50 transparency for new systems from 2 August 2026, and the AI Office's enforcement powers and governance bodies from the same date were not moved. The Commission's page says the transparency rules come into effect in August 2026 and describes the Act as applicable from 2 August 2026 with some exceptions, which is consistent. Two smaller points sit in the same bucket. Cooley reports that the Commission's proposal to drop the Article 6(3) registration requirement was rejected, so a provider that concludes its system is not high-risk still registers, with a simplified procedure available. Cuatrecasas and Cooley both say the AI literacy duty survived in softer form: providers and deployers are asked to support AI literacy, and the article states that it does not require a specific literacy level of anyone in particular. ## Article 50 and the 2 December 2026 marking date Article 50 is the part of the Act a pipeline owner can most directly implement, and most of it has applied since 2 August 2026. I read the text as reproduced on artificialintelligenceact.eu; the table gives its four paragraphs in plain terms and the last column is my suggestion of where each one shows up in an engineering estate, not a legal conclusion. 50(1) Providers Design systems that interact directly with people so those people are told they are interacting with an AI system, unless that is obvious to a reasonably well-informed person. Support bots and in-product assistants: the first-message notice. 50(2) Providers For systems generating synthetic audio, image, video or text, mark outputs in a machine-readable format so they are detectable as artificially generated. Solutions must be effective, interoperable, robust and reliable as far as technically feasible. Standard editing assistance is excluded. The output path of every feature that generates media or text: a response middleware or post-processing step. 50(3) Deployers Inform the people exposed to an emotion recognition or biometric categorisation system about how it operates. Vendor SDKs and camera or call-analytics add-ons you switched on. 50(4) Deployers Disclose that deepfake image, audio or video has been artificially generated or manipulated, and disclose AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and someone holds editorial responsibility. Marketing and content pipelines that publish generated media or text. The 2 December 2026 grace applies to one thing only. Orrick and Cooley both say providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet Article 50(2); anything placed on the market after that date was due on 2 August 2026. Cuatrecasas adds that the Commission had proposed six months and Parliament three, so older explainers quote February or November dates that did not survive. The text asks for marking that is robust and interoperable, and a boolean in a JSON response is neither. What a CI test can do is stop the marker being silently dropped by the next refactor. The test below is deliberately format-agnostic: swap the assertions for whichever technique you decide meets the standard once you have read it. ## The two new bans and the penalty tier above them Orrick describes two new Article 5 prohibitions applying from 2 December 2026: AI that generates or manipulates non-consensual intimate imagery of identifiable people, including nudifier apps, and AI that generates child sexual abuse material. The scope covers systems designed for these outputs and systems where the outputs are reasonably foreseeable and reproducible without adequate safeguards. Cooley notes there is no exemption for systems already on the market, which is why this one does not get the Article 50(2) grace. For anyone who hosts an image or video generation feature, the second scope limb is the operative one. It turns a guardrail from a product nicety into something you may need to show. The Article 99 page I read lists up to EUR 35,000,000 or 7 percent of worldwide annual turnover, whichever is higher, for Article 5 infringements, and up to EUR 15,000,000 or 3 percent for other operator obligations including Article 50; it does not mark those figures as changed by the omnibus, and I did not verify them against the Official Journal. > I found no source saying that an upstream model vendor's safeguards discharge your own duty. If you wrap a third-party image model in your product, treat the guardrail test as yours to run and keep the result. ## High-risk is deferred, not dismissed The Annex III date moved from 2 August 2026 to 2 December 2027 and the Annex I date from 2 August 2027 to 2 August 2028, which Cooley counts as sixteen and twelve months. The Commission's page gives biometrics, education and employment as examples of Annex III use cases. Cooley says the omnibus replaced the Commission's conditional mechanism with fixed dates, so there is no longer a trigger to wait for. The transition rule matters more to a DevOps team than the date. Cuatrecasas reports that units of a high-risk system lawfully placed on the market before the applicable date can keep being placed on the market while the design stays unchanged, and that a significant design change triggers full compliance, including conformity assessment. Orrick calls the trigger substantially modified; the service desk timeline says significant design changes. Whether swapping or fine-tuning a model counts is not something any source I read answers, so that question goes to counsel before the release, not after. > Use the sixteen months as engineering lead time, not slack. Orrick notes the omnibus also asks the Commission to request unified European standards covering the AI Act and existing harmonisation law, so the documentation you start now is more likely to survive the standards arriving than to be redone. ## Where this goes wrong The first failure is reading the omnibus as a pause button. It deferred one class of obligation and added a new one, and the table shows two dates in December 2026 that did not exist in the original calendar. A team that read delayed and stopped reading will miss the marking date and the ban date together. The second is trusting a single summary, and I did not escape it myself. Calling EUR-Lex from a script returned an HTTP 202 with an empty body and a WAF challenge header, so the Official Journal text was unreadable to me, and every date here comes from the Commission page and secondary analyses that agree with each other. They also disagree in places: the Commission page does not say whether Article 50 changed, and the praxikon summary I read mentions no 2 August 2026 application date at all. Where sources were silent I left the point out. > Do not copy a date from this post into a compliance document. Copy it from the Official Journal, and write down who read it and when. ## Putting the calendar in CI A calendar that lives in a wiki is read once. The register below lists each AI-enabled service with the few facts the dates depend on: your role, whether it generates content, whether it was on the market before 2 August 2026, and whether its use case looks like an Annex III area. The role and use-case fields are your input and need legal confirmation; the script only checks that someone filled them in. The script fails the build when a generative provider system has no marking plan, when an Annex III candidate has no owner, and prints the days left to each dated item. Run it with AI_ACT_TODAY to rehearse the calendar at a future date. The 60-day warning window is my choice, not the Act's. ## What to do on Monday Five steps, in the order that costs least. None of them needs a legal ruling to start; all of them need one before you close them. 1. Build the register: every service that calls a generative model, your role for it, whether it generates audio, image, video or text, and whether it was on the market before 2 August 2026. 2. For each provider-side generative system on the market before that date, write a marking plan and add the output test before 2 December 2026. 3. Run a guardrail check on any image or video generation feature against the two new Article 5 bans before 2 December 2026, and keep the result. 4. Tag Annex III candidates, such as biometrics, education and employment uses, and record the release in which each last changed design, since that is the trigger Cuatrecasas describes. 5. Commit the register and the calendar script, run it in CI, and put a monthly reminder to re-read the Official Journal text and update the research date. If the register is empty after an hour, that is a finding too: either nothing in your estate is in scope, or nobody knows what is. Both are worth writing down. A deferral moves the deadline of one class of duty and leaves every other date where it was. After 2026/1744, the calendar that matters to a DevOps team is not one date but four: Article 50 now, marking and the new bans on 2 December 2026, high-risk on 2 December 2027 and 2 August 2028. ## Sources, all read on 17 October 2026 - Orrick: EU AI Act update, Digital Omnibus finalizes 8 compliance changes - European Commission: AI Act regulatory framework page - Cooley: Digital AI Omnibus delays key deadlines, introduces new rules - Cuatrecasas: Digital Omnibus on AI has been published - AI Act Service Desk: implementation timeline - AI Act Service Desk: Article 50 transparency obligations - AI Act Service Desk: Article 99 penalties - EUR-Lex: Regulation (EU) 2026/1744 in the Official Journal - Praxikon: Regulation (EU) 2026/1744 summary ## Source links - https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes - https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai - https://cdp.cooley.com/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules/ - https://www.cuatrecasas.com/en/spain/intellectual-property/art/digital-omnibus-ai-has-been-published - https://artificialintelligenceact.eu/implementation-timeline/ - https://artificialintelligenceact.eu/article/50/ - https://artificialintelligenceact.eu/article/99/ - https://eur-lex.europa.eu/eli/reg/2026/1744/oj - https://www.praxikon.com/en/richtsnoeren/regulation-eu-2026-1744-digital-omnibus-on-ai ## FAQ ### What did the EU Digital Omnibus change about the AI Act deadlines? Regulation (EU) 2026/1744 moved Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I embedded-product obligations to 2 August 2028. Systems for public authorities have until 2 August 2030. It also added a 2 December 2026 date for Article 50(2) marking of older generative systems. ### Does Article 50 of the AI Act still apply from 2 August 2026? Yes for systems placed on the market from that date, according to Cooley's summary. The only grace period is for generative systems already on the market before 2 August 2026, which have until 2 December 2026 to meet the Article 50(2) machine-readable marking duty. ### What are the new AI Act bans that start on 2 December 2026? Orrick describes two new Article 5 prohibitions: AI that generates or manipulates non-consensual intimate imagery of identifiable people, including nudifier apps, and AI that generates child sexual abuse material. Cooley notes there is no exemption for systems already on the market. ### Is my DevOps team a provider or a deployer under the AI Act? That depends on your role for each system, and it is a legal question for your counsel. Article 50 splits duties: providers handle chatbot disclosure and machine-readable marking, deployers handle deepfake and public-interest text disclosure. Record your role per system in a register and have it confirmed. ### Where can I read the official text of Regulation 2026/1744? It was published in the Official Journal on 24 July 2026 and is on EUR-Lex as OJ L 2026/1744, linked from the Commission's AI Act page. Automated requests to EUR-Lex can hit a bot challenge, so read it in a browser and copy dates from there rather than from a summary. --- - HTML version: https://www.matthewswong.com/en/blog/eu-ai-act-digital-omnibus-devops-deadlines/ - Bahasa Indonesia: https://www.matthewswong.com/id/blog/eu-ai-act-digital-omnibus-devops-deadlines/ - Site index for agents: https://www.matthewswong.com/llms.txt - Sitemap: https://www.matthewswong.com/sitemap.xml - API description (OpenAPI): https://www.matthewswong.com/openapi.json