EU AI Omnibus extends compliance deadlines for smaller companies

The EU AI Omnibus entered into force on 27 July 2026, extending some compliance deadlines and easing obligations for smaller companies. The measure also expands regulatory sandboxes and bans AI systems generating certain non-consensual sexual content. For founders and technology professionals, the changes affect when rules apply and how some systems can be tested.

What led to the new measure?

The Omnibus was proposed on 19 November 2025 as part of a digital omnibus package, according to the Commission. It makes targeted changes to the AI rulebook while retaining safeguards for safety and fundamental rights. The measure is intended to simplify compliance and give companies greater legal clarity when developing and deploying AI in Europe.

The text extends certain measures previously reserved for SMEs to small and mid-cap companies, or SMCs. That means SMCs can benefit from simplified legal obligations that had applied to SMEs. The source does not specify which individual companies qualify, or describe their circumstances. It presents the change as a proportionate approach to compliance.

What changed when it took effect?

The Omnibus expands access to regulatory sandboxes, which are supervised settings where companies can develop and test AI systems. It also introduces an EU-level regulatory sandbox. The source says these arrangements give companies more room to experiment under regulatory supervision. It does not set out further operating details for the sandbox.

Administrative changes cover AI literacy and database registration as well. The previous AI literacy requirement for companies is simplified, while the Commission and Member States take a stronger role in promoting AI literacy. The obligation to register exempted AI systems in the EU central database is also simplified. The source gives no detailed procedure or list of affected systems.

When do high-risk rules apply?

For high-risk AI systems listed in Annex III, rules apply starting 2 December 2027, according to the published timeline. High-risk AI embedded in physical products and covered by Annex I follows a later date: 2 August 2028. The source gives examples of covered product areas, including machinery, toys and lifts. These dates are the stated application timelines, following the Omnibus's entry into force.

The measure also changes safety and oversight provisions. It prohibits AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material. Separately, it allows processing special categories of personal data to detect and correct bias. The AI Office receives extended oversight of certain systems, including those built on general-purpose models and embedded in large online platforms and search engines.

What details remain to follow?

The source says the Omnibus clarifies how the AI Act interacts with other EU laws and simplifies procedures for conformity assessment bodies. It does not describe the revised procedures in detail. Nor does it identify specific companies or systems that will be subject to the extended AI Office oversight. Those matters will depend on the implementation of the legal text.

The stated dates establish when the measure entered into force and when the two high-risk categories begin applying. Further information is directed to the legislative text, implementation timeline and FAQs. The source does not provide an individual company response or a case-specific compliance assessment. Founders should read the applicable provisions to determine how the changes relate to their systems.