The EU delays the AI Act: high-risk obligations pushed to 2027-2028 via the Digital Omnibus

The "Digital Omnibus" package adopted at EU level reshapes the AI Act's timetable. Standalone AI systems classified as high-risk see their compliance deadline pushed to 2 December 2027, against an initial cut-off in August 2026. High-risk systems embedded in products already governed by sectoral regulation — machinery, industrial devices — get a reprieve until 2 August 2028. Regulatory sandboxes are expected by 2 August 2027. The only obligation brought forward is transparency for AI-generated content, whose deadline is cut from six to three months for an application on 2 December 2026.

Beyond the dates, the text follows a logic of targeted relief. A compromise mechanism resolves sectoral overlaps: the Machinery Regulation is exempted from the AI Act's direct application, with the Commission instead able to add the necessary AI health and safety requirements through delegated acts. SMEs and small mid-caps obtain broadened exemptions. In return, operators who deem their systems exempt from the high-risk classification will have to register in the EU database — a defensive transparency that shifts the burden of proof onto the company.

For Cardan-AI's core target sectors, the impact is direct. An aero engine maker deploying inspection AI, an O&G operator optimising flows through machine learning, a manufacturer fitting its lines with computer vision: all handle use cases liable to tip into "high-risk". The delay gives them twelve to twenty-four additional months to map their systems, document datasets, trace algorithmic decisions and build the required governance. This is preparation time, not a blank cheque: systems designed today will have to be compliant tomorrow, and retrofitting compliance always costs more than designing it in from the start.

Cardan-AI Analysis: the real risk is not regulatory, it is strategic. Companies that read this delay as permission to stall will fall behind on AI governance, which is becoming a differentiating asset in the eyes of customers and investors. Those that use the reprieve to cleanly industrialise their use cases — risk classification, technical documentation, human oversight, logging — will turn a constraint into a competitive edge. Our recommendation to industrial leadership: use the 2026-2027 window for an AI Act compliance audit and a prioritised roadmap, rather than waiting for the deadline and being caught out.