13 October 2026: The European Union has formally adopted the AI Omnibus, introducing targeted amendments to the EU AI Act that are intended to simplify implementation and provide organizations with additional time to prepare for compliance.
While the Omnibus revises several implementation deadlines and introduces a small number of targeted amendments, it does not change the AI Act's core risk-based approach. The overarching objective remains the same: to support the development and deployment of trustworthy, human-centric AI across the EU.
For organizations developing, deploying, procuring or integrating AI systems, the Omnibus offers greater implementation certainty while reinforcing the importance of establishing effective AI governance and risk management practices.
What is changing
High-risk AI compliance deadlines extended
The most significant change is the extension of the application dates for high-risk AI systems.
High-risk AI systems (Annex III)
Original AI Act Timeline: 2 August 2026
New AI Omnibus Timeline: 2 December 2027
High-risk AI systems embedded in regulated products (Annex I)
Original AI Act Timeline: 2 August 2027
New AI Omnibus Timeline: 2 August 2028
The revised timelines are intended to allow additional time for the development of harmonized standards, conformity assessment procedures and national enforcement capabilities.
New Prohibited AI Practices
The Omnibus expands the list of prohibited AI practices by introducing new restrictions on AI systems used to generate:
- non-consensual intimate or sexually explicit content; and
- AI-generated child sexual abuse material (CSAM).
These practices will become explicitly prohibited under the AI Act framework.
Broader support for startups
Certain support and simplification measures that were previously targeted at small and medium-sized enterprises (SMEs) have been extended to also cover small mid-cap enterprises (SMCs) This is intended to make compliance more proportionate for a wider range of innovative organizations while maintaining appropriate regulatory oversight.
Greater flexibility for bias monitoring
The Omnibus provides additional clarity on the processing of special categories of personal data where this is necessary to detect, monitor and correct bias in AI systems, provided appropriate safeguards are in place.
Reducing overlap with existing sectoral legislation
Clarifies the concept of a safety component, reduces overlap with sector-specific legislation, and adopts a dedicated sectoral approach for AI-enabled machinery by moving the Machinery Regulation from Annex I Section A to Section B.
Enhanced role of the AI Office
The European AI Office will take on expanded oversight responsibilities, particularly in relation to general-purpose AI (GPAI) models and cross-border regulatory coordination.
What remains unchanged
The AI Omnibus should not be viewed as a rollback of the AI Act. The fundamental regulatory framework remains intact, and several key obligations continue according to the original implementation timetable.
This includes AI literacy requirements, which continue to apply although certain aspects of Article 4 have been amended by the AI Omnibus, the existing prohibited AI practices under Article 5, which continue to apply alongside the new prohibitions introduced by the AI Omnibus, and the AI Act's governance and supervisory framework.
Requirements for providers of general-purpose AI (GPAI) models also remain unchanged and are not affected by the extension of the high-risk AI deadlines.
Similarly, transparency obligations - including those relating to AI-generated content - remain on their original implementation path, with only limited transitional relief of four months for certain systems already placed on the market before August 2026.
Revised AI Act Timeline
Our AI Act Timeline provides a clear view of the major compliance deadlines, from prohibited AI practices and AI literacy requirements to GPAI and high-risk AI obligations.
For more information on transparency obligations and broader enforcement provisions application, read our previous news article.
What organizations should do now
Although organizations have additional time before the high-risk AI requirements take effect, this should not be viewed as an opportunity to delay AI governance activities. The extended implementation period provides valuable time to strengthen governance arrangements and prepare for future compliance.
Organizations should continue to:
- maintain an inventory of AI systems;
- classify AI use cases according to the AI Act risk categories and maintain documentation supporting those classifications;
- establish clear governance, accountability and oversight arrangements;
- develop AI management systems aligned with recognized frameworks such as ISO/IEC 42001;
- review contracts and oversight arrangements with AI suppliers and third parties; and
- prepare the documentation and evidence needed for future conformity assessments.
Organizations that continue investing in AI governance now will be better positioned to demonstrate regulatory compliance, build stakeholder confidence and support the responsible adoption of AI.
BSI commitment
The AI Omnibus represents a pragmatic adjustment to implementation timelines and implementation mechanisms rather than a change in regulatory direction. While organizations have been given more time to prepare for high-risk AI obligations, expectations around governance, risk management and trustworthy AI remain unchanged.
Organizations should use this additional time to embed robust governance practices, improve transparency and accountability, and build confidence in the AI systems they develop, procure or deploy. Acting now will help reduce future compliance challenges while supporting innovation and responsible AI adoption.
BSI supports organizations throughout their AI governance and regulatory compliance journey. From developing AI management systems aligned with ISO/IEC 42001 to AI performance assessment and understanding evolving regulatory requirements, our experts can help organizations build confidence in their AI systems while preparing for future compliance obligations.
We have also published a new Whitepaper “AI Omnibus: An Overview Recap”.
For further guidance, you can also refer to the European Commission's guidelines, Providers placing AI systems on the EU market remain responsible for ensuring compliance before those systems are placed on the market or put into service.
If you are an existing BSI client, please contact your Scheme Manager. Alternatively, contact us at AIBSIContactPage@bsigroup.com to discuss how we can support your AI compliance journey.
Sincerely,
Linda Moon
Director of Global Quality & Accreditation
Regulatory Services, BSI
Yoann Buisson
Associate Director of Global Quality and Accreditation
Regulatory Services, BSI
