There’s a precise moment, in these weeks, worth looking at closely. It’s the one where, inside a small or mid-sized IT company that had finally started taking the AI Act seriously (someone who had begun mapping systems, asking model providers uncomfortable questions, writing the first lines of a DPIA), the news arrives: postponed. And with the news comes, right on cue, the line that goes with it: “See? I told you there was no rush.”
That line is the real risk of this June 2026. Not the regulation, not the dates, not Brussels. That line.
Because it’s wrong. It’s wrong on the facts, it’s wrong strategically, and it’s wrong, above all, on the level of what should move anyone who builds software that touches people’s lives. Let’s take it apart piece by piece.
What Actually Happened
On June 16, 2026 the European Parliament gave its final approval to the so-called Digital Omnibus on AI: a regulation amending some provisions of Regulation (EU) 2024/1689 (the AI Act), within the Commission’s seventh simplification package. The vote passed by a very wide margin: 423 in favor, 57 against, 174 abstentions. The text isn’t in force yet: it still needs formal adoption by the Council, expected by the end of June. But the direction is clear, and it’s worth reading properly before turning it into the wrong excuse.
The part that made headlines is the postponement of obligations for high-risk systems. With one important difference from the original proposal: the dates are now fixed, no longer tied to the publication of harmonized standards.
- Stand-alone high-risk systems (the Annex III ones: biometrics, employment, education, credit, essential services, justice, border management) will apply from December 2, 2027.
- High-risk systems embedded as safety components in products already covered by sectoral legislation (Annex I) have until August 2, 2028.
- The obligation to mark AI-generated content (Article 50(2): machine-readable watermarking) slips to December 2, 2026.
- The establishment of national regulatory sandboxes moves to August 2, 2027.
And then there’s everything else. Which is exactly the point.
The Part Nobody Put on the Front Page: They Added Prohibitions
While everyone was discussing extensions, the same text introduced a new prohibition among the practices banned under Article 5. Now banned: AI systems that generate child sexual abuse material (CSAM), and those that create, without consent, images, video or audio depicting the intimate parts of an identifiable person or their sexually explicit activities. The so-called nudifier apps, the pornographic deepfakes. The ban hits both those who put these systems on the market and those who use them, and it allows a single way out, a technical safe harbour, for systems with effective safeguards that prevent that kind of output upstream. Time to comply: December 2, 2026.
Stop on this for a second. In a measure sold as “simplification” and “burden reduction,” the Union found the time and the majority to tighten. To widen the perimeter of banned practices. To say, in black and white, that some things simply aren’t done, regardless of the cost the ban imposes on companies.
This is not the grammar of a legislator backing away from rights. It’s the grammar of a legislator confirming the structure and, where it mattered, reinforcing it. Anyone who reads the high-risk extension as a sign of “softening” is reading half the sentence and ignoring the other half, the one in bold.
The Delay Is Procedural, the Course Is Confirmed
The distinction every technical team should internalize is this: the clock changed, not the map.
The AI Act’s risk-based logic is intact. The risk categories are the same. The obligations on transparency, data governance, technical documentation, human oversight, incident management: they’re all still there, in the same form. Most of the regulation’s provisions (including the Article 50 transparency ones, except the watermarking paragraph) come into application anyway on August 2, 2026. That is, in a few weeks.
And here’s the first, banal mistake of those pumping the brakes: they confuse “some high-risk deadlines have been postponed” with “the AI Act has been postponed.” It hasn’t. The bulk of the regulation starts as planned. If your systems aren’t high-risk (and statistically most aren’t), the high-risk delay barely concerns you. What concerns you are the dates that didn’t change.
There’s more, and it’s worth saying to anyone who knows project management: fixed dates are a gift, not a concession. For two years the great alibi was “we can’t really prepare until the harmonized standards come out.” Now that alibi is dead. The deadlines no longer depend on the standards. They’re there, written, immovable. You can put them in a Gantt chart and never move them again. The planning certainty companies were loudly demanding has arrived: use it to plan, not to postpone.
The Hard Work Has No Deadline You Can Move
This is the heart of the matter, and it holds for any development company, from the eight-person software house to the regional system integrator.
The expensive part of AI Act compliance isn’t the documentation template. It isn’t the PDF to sign. The expensive part is finding every AI system inside your organization and your products, deciding which risk category each one falls into, and, above all, keeping that inventory alive while the team keeps shipping features every two weeks. It’s a job of technical archaeology and process discipline. It doesn’t depend on the final standards. It doesn’t get easier with time: it gets harder, because in the meantime the systems grow, accrete, change model provider, inherit dependencies.
Whoever starts today has about eighteen months to refine an inventory, a classification, a documentation pipeline that updates itself. Whoever starts in late 2027 will have weeks, not months. And they’ll do it in a panic, with management asking why nobody raised it earlier, and with clients who have meanwhile already put compliance into their tenders.
The delay, in other words, doesn’t push the effort forward. It only pushes forward the perception of the effort. The effort stays exactly where it is, and it compounds while you ignore it.
The “De Facto Exemption” Trap
Then there’s a subtler argument, and honestly a more insidious one, that’s worth facing head-on. Several civil-society organizations have pointed out that the delay risks creating a de facto exemption window: high-risk systems placed on the market before the new dates might stay outside the regulation’s full application until they’re substantially modified. Translated for a company: “if I rush the system out now, I slip into the window and spare myself the obligations.”
It’s a temptation I understand. And it’s exactly the kind of shortcut that, within three years, turns against you.
First, because it’s a bet on a contested interpretation: the ones crying loophole today are precisely the organizations that tomorrow will do advocacy, complaints, naming and shaming. You’re building a product whose compliance rests on a technicality that half the ecosystem is already attacking. Second, because the exemption, assuming it holds, breaks at the first substantial modification, and in software substantial modifications are the job: you’ve tied your hands on the roadmap just to avoid writing a DPIA. Third, and most important, because it’s a stance. It’s the stance of someone who treats people’s rights as a cost to dodge rather than a design constraint. And stances, over time, become company culture. They become the way your engineers think when no one is watching.
You don’t build a durable competitive advantage inside a three-year window that will close anyway. You build it by doing things in a way that holds when the window is gone.
For an SME: Less Paperwork Doesn’t Mean Less Responsibility
The omnibus did genuinely lighten some things, and that deserves recognition. The exemptions from certain obligations granted to SMEs have been extended to small mid-caps (mid-capitalization companies of contained size). The registration of systems the provider assesses as not high-risk (the ones relying on the Article 6(3) derogation) stays mandatory in the EU database, but with a reduced information set. Machinery products using AI will have to comply only with sectoral safety legislation, without the double burden. The definition of “safety component” is clearer, so that AI functions that merely assist the user or optimize performance don’t automatically end up in the high-risk circle.
All correct, all useful. But be careful not to confuse two planes the legislator kept deliberately distinct. Less bureaucracy is not less responsibility. The self-assessment of “not high-risk” still has to be documented before putting the system on the market, and registered: the regulator wants to know who decided to sit just below the threshold, and why. The “frontier” stays visible. It’s simply that writing that assessment well, with a defensible argument on Article 6, becomes even more central, because that’s the document that saves you if someone challenges the classification.
For an SME this is actually good news, seen from the right angle: it means the entry barrier to compliance is made of structured thinking more than of expensive formalities. And structured thinking is exactly what a good software house already knows how to do. It’s the same discipline as specification-driven development: define first what you’re building and why, then build it. Compliance, done this way, isn’t a separate department. It’s a property of how you write things.
The Nearest Deadline Is Already Around the Corner
While everyone watches 2027 and 2028, the live deadline, the one that burns, is much closer: December 2, 2026. From that date, providers of systems that generate synthetic content (audio, images, video, text) must ensure the outputs are marked in a machine-readable format and detectable as artificial. It’s Article 50(2). Just over five months away.
If your product has any generative function aimed at the European market (an assistant that writes text, an image generator, a voice synthesizer, a module that summarizes documents by producing new content), you need, operational by year’s end: labeling visible in the interface, machine-readable metadata embedded in the output, and a coherent detection capability. It’s not trivial. Recital 133 explicitly cites watermarks and cryptographic methods; the Commission is finalizing a Code of Practice on marking and labeling that will become the practical benchmark. And if you integrate third-party models (which almost everyone does), the question to ask your vendor, today, is precise: how do you guarantee compliance with Article 50(2), and which detection APIs do you expose to me? If you can’t answer, you’ve found the first ticket to open this morning.
This is the deadline the debate over the delay is culpably obscuring. It’s close, it’s technical, and it touches the vast majority of products that use generative AI. There’s no delay that covers you here.
Bias Leaves the High-Risk Niche
There’s a development that deserves more attention than it got, because it’s both an opportunity and a responsibility. Article 10(5) allows, exceptionally and to the extent strictly necessary, the processing of special categories of personal data (the “sensitive” data of Article 9 GDPR) to detect and correct bias in systems. Until now this possibility applied only to high-risk systems. The omnibus extends it to non-high-risk systems too.
It’s an opening that changes the picture for anyone wanting to offer serious fairness auditing services. It means you can design documented, defensible bias monitoring even on systems that don’t fall under high-risk, aligning AI Act and GDPR without living in the regulatory grey. But, and here’s the responsibility, the opening isn’t a shortcut to process sensitive data at will. The “strict necessity” constraint stays, with everything it entails: a solid legal basis (Recital 70 points to the substantial public interest of Article 9(2)(g) GDPR), DPIA, minimization, pseudonymization, storage limitation (the data is deleted once the bias is corrected) and a clean, architectural separation between the auditing dataset and the production one.
Whoever can do this well holds a concrete commercial offering, not a formality. The difference between the two is made by the quality of the documentation.
Compliance Is a Moat, Not a Tax
At this point the strategic question becomes: why should a small or mid-sized IT company spend energy on all this, now, while the market tells it it can wait?
Because the market telling you to wait is the same one that, eighteen months from now, will put AI Act compliance into every public-administration tender and every enterprise client’s due diligence. Compliance isn’t a tax you pay grudgingly. It’s a competitive moat. The moment the majority of your competitors use the delay as an excuse not to move, whoever did move shows up to the bid with a system inventory, a defensible classification, a documentation pipeline and a story to tell. The others show up with a promise.
In a sector where trust is scarce and hard to demonstrate, being able to say “we’ve already done this work, here are the documents” is worth more than any sales deck. It’s the grown-up version of “security by design”: compliance by design as a signal of technical seriousness. And for an SME, which can’t compete on price with the big players or on marketing, demonstrable technical seriousness is one of the few levers that actually work.
People’s Rights Have No Application Date
I take off the consultant’s coat and put on the one I wear more gladly.
Underneath all the discussion of deadlines and annexes there’s something simple. The systems we build decide whether a person gets an interview, a loan, a place on a list, a treatment. They touch the dignity of human beings who almost never know they’ve been processed by a model, and almost never have a way to contest it. The AI Act, with all its flaws and compromises, is the most serious attempt so far to put those systems under a rule that centers the person instead of the output.
The delay shifts the date on which certain obligations become enforceable. It doesn’t shift by a single day the moment a badly designed system harms someone. That moment is now, every time the system runs. The fact that the state can’t yet sanction you for a given shortcoming doesn’t mean the shortcoming produces no consequences for real people. Formal compliance arrives in 2027; the duty toward whoever is on the other side of the screen is already here, and it has never had a grace period.
There’s a humanist, not bureaucratic, way to read the AI Act: as the list, written badly and with difficulty, of the things we owe one another when we delegate decisions to a machine. Read that way, the idea of “exploiting the window” to do less sounds like what it is: not a management trick, but a small failure of design nerve. And companies, exactly like people, end up resembling the shortcuts they allow themselves.
What to Do Now, Concretely
If you’re the team that had just started pushing, here’s the list for not losing momentum. Nothing exotic: things you can start this week.
- Lock in the dates that didn’t change. Put August 2, 2026 (most obligations) and December 2, 2026 (watermarking and the nudifier/CSAM ban) in the plan, in bold, not movable. These are the next ones, not the 2027 ones.
- Inventory every AI system. Inside the products, inside internal processes, inside the integrations with third-party models. A living sheet, with an owner, a model provider, a provisional risk category. It’s the document everything else depends on.
- Classify, and write down why. For each system, a risk assessment. For the ones you declare “not high-risk” under Article 6(3), a defensible argument and registration (now lighter) in the EU database.
- Close the watermarking front. For every generative function aimed at the EU market: label in the interface, machine-readable metadata, detection. And open the ticket with the model provider: “how do you guarantee Article 50(2)?”.
- Operationalize the safe harbour on image generation. If a component generates images or video, the safeguards against NCII and CSAM go designed and documented in risk management, not bolted on afterward.
- Turn bias auditing into an offering. With the extension of Article 10(5) to non-high-risk, build a documented AI-Act-plus-GDPR pipeline: DPIA, dataset separation, deletion once correction is done. It’s sellable.
- Structure the model lifecycle. Data lineage, model cards, technical documentation, logging. Use the eighteen months to build it as a practice, not to postpone it as a chore.
The European Bet, and Ours
Europe has made an explicit bet: that you can build a competitive AI industry without selling off people’s rights, and that respecting those rights can even become a distinctive trait of the European product. It’s a hard bet, made of imperfect compromises like this omnibus, and nothing guarantees it wins. But it’s ours, and it’s infinitely more interesting than the alternative.
The Digital Omnibus, read properly, doesn’t weaken that bet: it confirms it and sets its calendar. It gave us a few more months not so we could do less, but so we could do better the things that have to be done anyway. It’s a window to arrive prepared, not an amnesty for not showing up.
For a small or mid-sized IT company that had just started taking all this seriously, the message is one, and it should be said out loud in Monday morning’s meeting: this is not the moment to lift your foot off the accelerator. It’s the moment to press harder. Because the hard work doesn’t expire, people’s rights have no grace period, and eighteen months from now there will be those who arrived with the documents in hand and those who arrived with excuses. Decide today which side you want to be on.
Key takeaways
The clock changed, not the map. The risk-based logic, the risk categories and the obligations on transparency, data governance, documentation and human oversight stay identical. Most of the regulation comes into application on August 2, 2026: the delay touches only some high-risk deadlines, not the AI Act.
The dates are now fixed and no longer conditional on the publication of harmonized standards. That’s a gift to anyone who plans, not a concession to anyone who postpones: the alibi of “we can’t prepare until the standards come out” is dead.
The same text sold as simplification widened the perimeter of the Article 5 prohibitions: banned are systems that generate CSAM and non-consensual pornographic deepfakes (nudifier apps), with a single technical safe harbour and a December 2, 2026 deadline. A legislator that tightens is not backing away from rights.
The nearest deadline is December 2, 2026: machine-readable watermarking of AI-generated content (Article 50(2)). It touches almost every product with a generative function aimed at the EU market, and no delay covers it.
Compliance isn’t a tax, it’s a competitive moat. Eighteen months from now it will be inside every tender and every due diligence: whoever shows up with an inventory, a classification and documentation wins the bid against whoever shows up with a promise.
Questions & answers
What is the Digital Omnibus on AI approved on June 16, 2026?
It’s a regulation amending some provisions of Regulation (EU) 2024/1689 (the AI Act), within the Commission’s seventh simplification package. The European Parliament gave it final approval with 423 votes in favor, 57 against and 174 abstentions. It still needs formal adoption by the Council, expected by the end of June. The best-known part is the postponement of obligations for high-risk systems, but the text confirms the regulation’s structure and in one place reinforces it.
Which AI Act deadlines were postponed?
Stand-alone high-risk systems under Annex III (biometrics, employment, education, credit, essential services, justice, borders) will apply from December 2, 2027. Those embedded as safety components in already-regulated products (Annex I) have until August 2, 2028. The obligation to mark AI-generated content (Article 50(2)) slips to December 2, 2026, and national sandboxes to August 2, 2027. Crucially, the dates are now fixed, no longer tied to the publication of harmonized standards.
What did NOT change and stays in force?
Most of the regulation. The risk-based logic, the risk categories, the obligations on transparency, data governance, technical documentation, human oversight and incident management stay identical. Most provisions, including the Article 50 transparency ones except the watermarking paragraph, come into application on August 2, 2026. If your systems aren’t high-risk (most aren’t), the high-risk delay barely concerns you.
What's the nearest deadline not to miss?
December 2, 2026. From that date, providers of systems that generate synthetic content (audio, images, video, text) must ensure the outputs are marked in a machine-readable format and detectable as artificial: it’s Article 50(2). It touches almost every product with a generative function aimed at the European market. On the same date the new ban on systems that generate CSAM and non-consensual pornographic deepfakes takes effect.
For an SME, does less bureaucracy mean less responsibility?
No. The omnibus extended some exemptions from SMEs to small mid-caps and lightened the registration of systems assessed as not high-risk, but the “not high-risk” self-assessment under Article 6(3) still has to be documented before the system goes to market and registered in the EU database. Less paperwork doesn’t mean less responsibility: the entry barrier is made of structured thinking more than of expensive formalities.
The author
