AI Act Digital Omnibus analysis: 2 août not Annex III

The stale date hiding in AI roadmaps is 2 août. It used to be a useful shorthand for many remaining EU AI Act obligations, then the Digital Omnibus made shorthand dangerous. According to the Future of Privacy Forum, the Omnibus moves high risk compliance for Annex III to December 2027 and Annex I to August 2028 from the initial 2 August 2026 date. That makes 2 août a review point, not the day Annex III controls arrive from Brussels with a clipboard. No one gets a compliance holiday. The practical correction is narrower and therefore more useful: separate duties already in motion from high risk obligations now running on a later track. Product teams that treat August as one large undifferentiated deadline will either overbuild in the wrong order or underprepare for the parts that already apply. Neither is a governance strategy, although both produce impressive spreadsheets.

What changed on the calendar The Future of Privacy

Forum says the AI Omnibus modifies the EU AI Act implementation timeline by pushing high risk AI system obligations to December 2027 for Annex III and August 2028 for Annex I, instead of the initial 2 August 2026 date. Pearl Cohen reports that the Digital Omnibus entered into force on July 27, 2026, and describes the revised mechanism as conditional: the high risk rules apply six months after the Commission confirms that adequate compliance support measures are available, or by December 2, 2027 for Annex III and August 2, 2028 for Annex I, whichever comes first. EU AI Compass records the Council adoption point as June 29, 2026 and lists the same Annex III and Annex I planning dates. The wrinkle is the conditional trigger. December 2, 2027 is not permission to wake up in late November with a conformity file shaped like a wish. Under Pearl Cohen's reading, the Commission's confirmation that support measures are available can start a six month clock earlier. In product terms, your roadmap needs a watch item for that confirmation, not just a calendar invite for December.

What did not move out of sight The Future of Privacy

Forum notes that since the AI Act entered into force in August 2024, several provisions have already begun to apply: rules on prohibited AI practices and AI literacy, and obligations for providers of general purpose AI models. The same analysis says the Omnibus also adds new prohibited practices, further allows processing of special categories of personal data for bias detection and correction in AI systems, and revises post market monitoring requirements. That is an awkward sentence for anyone selling a simple deadline graphic, but it is the law shaped like implementation work. So the correct split is not compliance now versus compliance later. It is live obligations now, high risk conformity buildout on a longer track, and monitoring for the Commission support measures that can move the high risk clock. If your governance board asks whether the AI Act has been delayed, the accurate answer is: parts of the high risk system timetable moved. The rest of the sentence matters.

Who needs to rewrite

the roadmap Cooley described the proposed Digital Omnibus as important for businesses that place, put into service, or use AI systems in the EU, as well as product manufacturers that integrate AI systems into hardware products. That remains the right population to audit its assumptions, because the timing change is only useful if the scope analysis is not a shrug. Start by classifying whether the system is an Annex III high risk system, an Annex I product embedded system, or outside those buckets. Then translate the calendar into ordinary delivery work. Keep evidence for obligations that already apply, maintain a system inventory that distinguishes Annex III from Annex I, assign someone to monitor Commission support measures, and stop using 2 août as a universal deadline label. This is not more glamorous than model launch planning. It is just less likely to produce a panicked message from counsel that begins with, we welcome clarity from regulators.

What to watch next

The Cloud Security Alliance captured the pre entry into force state by noting that negotiators from the European Council, European Parliament, and European Commission reached provisional political agreement on May 7, 2026, with provisions expected to take effect three days after publication. Pearl Cohen later reported entry into force on July 27, 2026. EU AI Compass and Pearl Cohen describe different adoption milestones, with June 29 for Council adoption in EU AI Compass and July 8 for formal adoption in Pearl Cohen, so teams should record which source they used and when they updated the calendar. The next useful signal is not another social post about 2 août. It is the Commission confirmation that adequate compliance support measures are available, because Pearl Cohen says that can start the six month application window. Builders should use the extra runway to produce boring artifacts: scope decisions, ownership, evidence trails, and monitoring routines. Boring is underrated in AI governance. It is also much easier to defend.