The Deadline That Split, Not the Deadline That Moved
The Digital Omnibus pushed high-risk obligations to 2027 — and left transparency, prohibitions and enforcement exactly where they were. Reading that as a delay is the expensive mistake.
28 September 2026 — Most of the market read this week's news as "the EU AI Act was delayed." That reading will cost some businesses money.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved standalone Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and embedded high-risk systems in regulated products to 2 August 2028. The reason given was that harmonised standards were not ready — a legitimate technical argument, and a real relief for anyone building a high-risk system.
But look at what did not move. The prohibitions stayed. Article 50 transparency obligations stayed. The obligations on general-purpose AI models stayed. And the Commission's enforcement powers stayed, which is why it sent formal information requests to more than thirty AI companies on 1 September. The 2 December 2026 machine-readable labelling requirement is unchanged and was 65 days away.
So the correct description is not a delay. It is a split: the deadlines that require long engineering programmes moved, and the deadlines that require you to be honest about what you are running stayed put. The obligations hardest to fake — transparency, identity, oversight — are precisely the ones the calendar did not touch.
The second development is the one that will define next year's breach statistics. SpyCloud's 2026 report found that non-human identities — service accounts, API keys, agent credentials — are now the primary entry point in 31% of breaches, nearly double the rate for phishing. Ninety-five percent of organisations believe they can see their machine-identity exposure. Thirty-six percent actually monitor it.
That gap is the whole security problem in one sentence. A non-human identity does not get phished, does not take a holiday, and does not notice that it is being used from somewhere new.
What this means if you run an SME. Read the Omnibus as relief on one specific thing — high-risk conformity work — and as no relief at all on anything else. If you have agents, service accounts, or API integrations, the inventory of what they can reach is now the single highest-value document in your business. Build it while everyone else is celebrating a delay that did not happen.
Seventeenth in a weekly series on the developments that matter to small and mid-sized organisations.