Deadline postponed, scrutiny continues: what the AI Act Omnibus really changes for your business

Since the end of July 2026, it's official: the deadline for the central obligations for high-risk AI systems under Annex III of the EU AI Act has been postponed - by roughly 16 months, from August 2026 to December 2027. In many companies, this news landed like a reprieve. After months of uncertainty over risk management, technical documentation, and conformity assessment, time suddenly seemed to have been gained. But anyone who now closes the AI Act file and turns to other topics is making a costly mistake. Because the postponement only affects part of the obligations - and, of all things, the rules that hit practically every company using AI have long since taken effect.

This article breaks down what the Omnibus actually changes, which deadlines were truly postponed, which obligations continue unchanged - and why companies with recruiting AI, credit scoring, or other sensitive applications in particular should not wait now, just because a date on the calendar has moved further back.

What was actually decided on July 24, 2026

The so-called Omnibus Regulation - officially Regulation (EU) 2026/1744, known as the "AI Omnibus" or "Digital Omnibus" - was published in the EU Official Journal on July 24, 2026, and entered into force three days later, on July 27, 2026. It followed a swift legislative process: the Council and Parliament had already reached political agreement on the key points on May 7, 2026, and the Council of the EU gave final approval on June 29, 2026.

The Omnibus's explicit goal was to simplify and streamline the rules - not to water them down. And this is exactly the nuance that gets lost in many summaries: it wasn't the AI Act as a whole that was postponed, but a clearly defined set of obligations for a specific category of AI systems. Everything else in the law continues unchanged - including the fine provisions that already apply today.

In parallel, Germany has done its homework: the AI Market Surveillance and Innovation Promotion Act (KI-MIG) has been in force since July 29, 2026, and regulates who enforces the AI Act domestically. More on that shortly.

The actual postponement: from August 2026 to December 2027

Specifically postponed is the full compliance obligation for standalone high-risk systems under Annex III of the AI Act. These include, among others, AI systems for personnel selection and recruiting, creditworthiness assessment, biometric identification, critical infrastructure, education, employment, law enforcement, migration, and judicial administration. For these systems, the original deadline was August 2, 2026 - now it is December 2, 2027, roughly 16 months later. For high-risk AI embedded in products already regulated elsewhere (Annex I, such as medical devices or machinery), the deadline moves from August 2, 2027 to August 2, 2028.

What exactly falls under this postponed deadline is, at its core, the operational heart of high-risk compliance: the risk management system, requirements for data quality and data governance, technical documentation under Article 11 in conjunction with Annex IV, logging obligations, human oversight, the conformity assessment itself, and registration in the EU database for Annex III systems. Several independent sources, including the law firm Gibson Dunn and the Cloud Security Alliance, do not differentiate between individual Annex III categories here: recruiting AI, credit scoring, and health triage all fall under the same new December 2027 deadline.

This is a genuine reprieve, not cosmetic. Companies using software to pre-sort job applications or a scoring model for credit decisions no longer need to have full documentation, risk management, and conformity assessment ready by August 2026, but rather a good year later. Several advisors, however, are already warning: 12 to 18 months for full compliance is realistic - meaning the postponement creates "just barely enough" time, not a comfortable buffer. Anyone only starting to plan now immediately gives away the lead time just gained.

What wasn't postponed - and already applies

This is exactly the misconception many companies are currently falling for. The Omnibus postpones a clearly defined set of obligations for a specific system category. It does not postpone the AI Act as a whole. Several obligations that affect practically every company using AI remain unchanged, and some have already been in force for months.

First and foremost is Article 5, the ban on certain AI practices. It has already applied since February 2, 2025, and is not affected by the postponement at all. Banned practices include social scoring, manipulative systems, emotion recognition in the workplace and in educational institutions, and biometric categorization based on protected characteristics. Violators risk the highest fine bracket in the entire AI Act: up to €35 million or 7 percent of global group revenue, whichever amount is higher. From December 2, 2026, a new ban is added: non-consensual intimate AI images and deepfakes, as well as AI-generated abuse material.

Second is Article 4, the AI literacy obligation. It requires companies to demonstrate sufficient AI competence among their staff - documented training, clear responsibilities, a basic understanding of the systems used. This obligation is likewise unaffected by the postponement and applies to practically every company that uses AI in its daily work at all, regardless of whether it involves a high-risk system or not.

Third, the obligations for providers of general-purpose AI models (GPAI) continue unchanged. They have applied since August 2025, and enforcement and fines have taken effect since August 2, 2026.

Fourth, the transparency and labeling obligations under Article 50 have applied since August 2, 2026 - with a transition period until December 2, 2026, which, however, applies exclusively to the machine-readable labeling of generative systems already on the market, not to the labeling obligation as such.

The postponement affects the core set of obligations for standalone high-risk systems - risk management, technical documentation, conformity assessment, registration. It does not affect the bans, the AI literacy obligation, or the transparency rules. Yet these three areas are exactly what already affect most Mittelstand companies today.

In other words: a company using emotion recognition in candidate pre-selection doesn't have a postponement problem, but an immediate prohibition problem. A company using AI tools within its team without having documented its employees' competence is already violating Article 4. And a company publishing AI-generated content without labeling it is violating Article 50 - regardless of whether it ever operates a high-risk system within the meaning of Annex III.

The special case of recruiting: German labor law doesn't wait for Brussels

The deceptive sense of relief is especially clear in recruiting. Anyone using software that pre-sorts, rates, or prioritizes job applications is operating a high-risk system within the meaning of the AI Act - even if the AI was purchased rather than developed in-house. There is indeed time until December 2027 for actual high-risk compliance under the AI Act. But in parallel, German law already applies now, completely independent of the European timeline.

Three regulations are central here: Article 22 GDPR prohibits purely automated decisions that have legal or similarly significant effects on the person concerned - meaning an automated rejection without human involvement is generally impermissible. Section 26 BDSG (German Federal Data Protection Act) governs the legal basis for processing applicant data. And Section 87(1)(6) of the Works Constitution Act (BetrVG) enshrines the works council's co-determination right for AI-supported selection systems - introducing one without a works agreement is legally challengeable.

None of these three regulations know an Omnibus reprieve. Industry sources from the recruiting sector aptly describe this as "relief with reservations": the postponement of the AI Act deadlines is not a free pass, merely an extension of the time available on the EU-law side. The German labor-law side - including the often months-long negotiations over works agreements - continues completely unaffected. Anyone only starting works council coordination now will find even December 2027 tight.

You can also read more about using AI agents in day-to-day recruiting and how to make these processes legally sound in our article on Recruiting with AI agents.

Oversight in Germany: the Bundesnetzagentur takes over - and a rumor that deserves caution

With the KI-MIG in force since July 29, 2026, it is also now clear who is responsible for the AI Act in Germany: the Bundesnetzagentur (Federal Network Agency) in Bonn has been designated as the central market surveillance authority, point of contact, and complaints office. A dedicated coordination and competence center, the so-called KoKIVO, is being set up there. Sector-specific authorities remain responsible within their respective areas, such as BaFin in the financial sector. For companies, this brings clarity for the first time: there is now a specific address to turn to - and one from which inspections can also be expected.

It's worth examining a claim currently circulating across several online posts: that the EU AI Office and national data protection authorities - CNIL, BfDI, and AESIA are named - allegedly started the first technical audits under Article 11 on Annex III high-risk systems such as applicant screening, credit scoring, or health triage as early as August 30, 2026. You should treat this claim with clear caution. So far it appears exclusively in secondary blog sources with no identifiable primary source - neither the European Commission, the AI Office, nor reputable trade media have confirmed it. It also contradicts the fact, confirmed by several law firms and the Council of the EU, that the Article 11 documentation obligation for standalone Annex III systems was just postponed to December 2027 by the Omnibus. A formal Article 11 audit of these systems in September 2026 would therefore simply have no immediate legal basis.

It is more realistic that authorities are conducting initial market observations during this transition phase and preparing organizationally for their new role - not that formal review proceedings are already underway against individual companies. For your planning, this means: don't rely on isolated, unconfirmed reports, but on the solidly documented deadlines and responsibilities. Those alone are demanding enough.

The fine traffic light - and what you should concretely do now

The AI Act tiers fines by severity of the violation, and this tiering is not affected by the postponement. Violations of the prohibited practices under Article 5 - the red tier - can cost up to €35 million or 7 percent of worldwide annual revenue. Violations of high-risk and transparency obligations, such as under Articles 16, 22, 23, 24, 26, or 50 - the yellow tier - carry fines of up to €15 million or 3 percent of annual revenue. False statements to authorities - the third tier - are penalized with up to €7.5 million or 1 percent of annual revenue. In each case, the higher of the two amounts applies.

For business practice, a clear order of priorities can be derived from this, regardless of your company's size or which Annex III category applies to you:

First: check immediately whether you use systems that could fall under the Article 5 bans - particularly emotion recognition in the workplace or biometric categorization. This carries the highest fines, and there is no postponement.

Second: document your staff's AI competence under Article 4. This is not complex high-risk compliance, but in many cases achievable with manageable effort - and already enforceable today.

Third: label AI-generated content in accordance with Article 50, if you publish or use such content.

Fourth: only after that, but without unnecessary delay, build an AI inventory for your Annex III-relevant systems - who operates what, for what purpose, with what data basis. This stocktaking is the prerequisite for any later conformity assessment and can already be started now, without the December 2027 deadline putting pressure on it yet.

Fifth, specifically in recruiting: start coordinating with the works council early. Section 87 BetrVG doesn't follow a European timeline, and works agreements, as experience shows, need considerably more lead time than a single software update.

The postponement to December 2027 is genuine relief - for the part of the obligations it affects. But it's no reason to shelve the AI Act topic altogether. Companies that wisely use the time gained to work through exactly the obligations that already apply today will end up in a far better position than one starting from scratch in the fall of 2027. If you'd like to build a structured overview of your AI systems and the associated deadlines and obligations, we're happy to help - practically, without unnecessary bureaucracy, and with an eye on what's actually relevant to your specific business.