AI Act: the real 2026-2027 compliance timeline after the Digital Omnibus delay

For the past few weeks, two contradictory takes on the AI Act have been circulating. The first: “the August 2, 2026 deadline has passed, we’re in breach.” The second: “everything got pushed to 2027, we have time.” Both are wrong, and the confusion is costly — either unnecessary panic, or a genuine regulatory blind spot.

Here’s what actually happened: the Digital Omnibus, adopted by the European Parliament on June 16, 2026 (423 in favor, 57 against) and formally approved by the Council on June 29, 2026, delayed part of the timeline — not all of it. Here’s what’s due today, what just changed, and what it actually means if you run Bedrock, a RAG pipeline, or any AI system in production.

The real timeline, item by item

February 2, 2025 — Prohibited practices (Article 5), already in force. Social scoring, subliminal manipulation, emotion recognition at work or school, sensitive-category biometric categorization: these have been banned for 18 months. Maximum fine: €35M or 7% of global turnover, whichever is higher.

August 2, 2025 — GPAI obligations, already in force. Providers of general-purpose AI models (the models behind Bedrock, Claude, GPT, Mistral) must document training, respect copyright, and publish a summary of training content. This doesn’t directly hit you as a Bedrock user — but it shapes what AWS and model providers owe you in transparency.

August 2, 2026 — Transparency (Article 50), unchanged, just passed. This is the date causing the confusion: it did not move. Obligation to inform users they’re interacting with an AI (chatbot, agent), and to label AI-generated content (deepfakes, synthetic voice) when distributed publicly. If you run a support chatbot or a user-facing Bedrock agent without clear disclosure, you’ve been in breach since August 2, 2026 — not in 2027.

December 2, 2026 — Watermarking of AI content and ban on non-consensual deepfakes, unchanged. Technical watermarking of generative outputs, explicit ban on systems producing non-consensual intimate content.

December 2, 2027 — High-risk systems, Annex III, DELAYED. This was the date scaring every SMB using AI in HR (CV screening), credit scoring, medical assessment, or educational systems. It was originally set for August 2, 2026. The Digital Omnibus pushes it back 16 months.

August 2, 2028 — High-risk systems, Annex I (already-regulated products: medical devices, machinery, connected toys), DELAYED from August 2027.

Sources: Regulation (EU) 2024/1689, Quantic Avocats’ analysis of the Digital Omnibus text, Cloud Security Alliance tracking note.

What didn’t move — and probably already applies to you

The trap with any delay is using it as an excuse to do nothing. Three things remain due right now, independent of the Annex III delay:

1. Classifying your AI systems. Prohibited / high-risk / limited-risk (transparency) / minimal-risk — this classification doesn’t depend on the enforcement calendar, it’s exactly what determines which calendar applies to you. An HR CV-screening system stays Annex III high-risk even though its enforcement date is now 2027: you still need to know it, document it, and not deploy it thinking you’re off the radar.

2. Article 50 (transparency) has been active since August 2, 2026. Support chatbot, conversational Bedrock agent, public-facing AI content generator: disclosure is mandatory, starting now.

3. Your obligations as a deployer of a third-party system. Even without building your own model, Article 26 requires companies that use a high-risk system (HR, credit, insurance) to provide human oversight, usage documentation, and incident reporting — on the same calendar as provider obligations.

Why waiting until 2027 is still a bad idea

The 16-month delay changes the deadline, not the workload. On Distribuée engagements, classification plus gap analysis for an AI system in production takes 6 to 10 weeks on average — mapping production AND shadow-IT systems (often the bulk of the work: business teams adopt AI tools without IT ever knowing), risk-tier classification, Article 4 documentation (AI literacy for teams), and a technical audit of the stack (Bedrock Guardrails, logging, RAG access control).

If you start this mapping in 2027, you’ll discover your high-risk systems right as the obligation becomes enforceable — zero room to fix anything. Starting now, with 16 months ahead instead of 2, changes everything: you can rework a poorly governed RAG architecture, tighten an overly broad access grant, and document properly, without a deadline crunch.

Who enforces it, in France

French governance clarified this year: the DDADUE law, validated by the Senate on February 17, 2026, designates the CNIL as the pivot authority for AI Act enforcement on French soil, with the DGCCRF as the single point of contact coordinating sectoral authorities. About fifteen sectoral authorities split the rest: Arcom on deepfakes, ACPR and AMF on finance, ANSM and HAS on healthcare. ANSSI provides technical cybersecurity support, without direct enforcement power.

For a typical B2B SMB with no regulated finance or health activity, the CNIL will be the point of contact in case of an audit — the same reflex as GDPR, extended to AI.

Our read for an SMB running Bedrock or a third-party LLM in production

Three priorities, in order:

• Classify before you document. Many SMBs jump straight into AI Act paperwork without having actually inventoried their AI systems — including the ones marketing or support teams adopted without IT sign-off. Map first.
• Treat Article 50 as an immediate deadline, not a future one. If an external user interacts with an AI system without knowing it, that’s the simplest non-compliance to fix and the most visible one in an audit.
• Use the runway to 2027 to fix the architecture, not to delay classification. Bedrock Guardrails, CloudTrail logging on model calls, RAG access segmentation by data sensitivity: these are multi-week technical projects that are far easier to run without deadline pressure.

Our AI Act Compliance audit covers exactly these three steps — mapping, classification, technical Bedrock/RAG audit — delivered in 3 weeks with a prioritized action plan, whether your real deadline is 2026 (Article 50) or 2027 (Annex III).

Conclusion

The Digital Omnibus bought companies breathing room on the heaviest obligations (Annex III high-risk), but it changed nothing about the transparency obligations already in force, or the classification work that remains an unavoidable first step. The best way to use this extra time isn’t to ignore it — it’s to turn what would have been a scramble in 2026 into a properly run project through the end of 2027.