On June 29, 2026, the Council of the European Union gave final approval to the Digital Omnibus on AI, following the European Parliament’s approval on June 16. The regulation has since been published in the Official Journal of the European Union and will enter into force on July 27, 2026. It will simplify certain requirements of the EU AI Act and delay the application of specified high-risk AI obligations, giving organizations additional time to prepare.
For most organizations, the primary takeaway is timing: certain high-risk AI obligations are expected to move to December 2, 2027 for standalone high-risk AI systems, and to August 2, 2028 for high-risk AI systems embedded into regulated products.
AI literacy, client confidentiality, security, privacy, and vendor governance remain current expectations regardless of whether specific high-risk AI obligations are delayed.
Applicability
The EU AI Act may apply to organizations inside or outside the European Union where AI systems are placed on the EU market, put into service in the EU, or where the output produced by the AI system is used in the EU. Professional services firms should therefore assess applicability based not only on office location, but also on whether their clients, users, matters, or AI-supported services involve the EU.
Most professional services firms will be “deployers” of vendor AI systems in the context of the EU AI Act, not developers or providers. The Omnibus should therefore be read through a practical procurement and governance lens: inventory AI systems, determine whether any are high-risk, invest in user training, and retain evidence of appropriate monitoring, review, and oversight.
What Are the Most Significant Changes to the EU AI Act?
In addition to delaying obligations for certain high-risk AI systems from August 2, 2026 to December 2, 2027 or August 2, 2028, depending on the category of system, key changes include the following:
- AI literacy remains required, but is more flexible: The EU AI Act requires organizations using AI to help personnel understand AI’s capabilities, limitations, risks, and appropriate uses. The Omnibus softens this obligation by requiring reasonable measures to support AI literacy, rather than requiring organizations to guarantee a specific level of AI competence for each individual user.
- High-risk classification may be narrowed for certain support tools: The Omnibus clarifies that AI used only for user assistance, performance optimization, service efficiency, automation, convenience, or non-safety quality control would not be treated as a high-risk safety component. This may reduce the likelihood that ordinary productivity, workflow, or administrative tools are subject to full high-risk AI requirements.
- Impact Assessments may be easier to combine with DPIAs: For high-risk AI systems, the Omnibus allows Fundamental Rights Impact Assessments (“FRIAs”) to cross-reference or incorporate relevant portions of GDPR Data Protection Impact Assessments (“DPIAs”). This may help professional services firms integrate review under the EU AI Act into existing privacy and vendor risk processes.
- Bias testing with sensitive data becomes more feasible: The Omnibus permits limited processing of special-category personal data for bias detection and correction where strictly necessary and subject to safeguards. However, it does not create a new general obligation to conduct bias testing.
- Generative AI acceptable use controls become more important: Prohibitions related to the use of AI systems for generating or manipulating non-consensual intimate material or child sexual abuse material were added. While these risks may be outside ordinary use cases for professional services firms, they reinforce the need for clear AI acceptable use rules and escalation procedures.
Why AI Deployers Should Still Monitor Provider Obligations
Organizations procuring and using AI systems will often be considered “deployers” under the EU AI Act. However, even deployers have ample reason to monitor provider-side obligations and related regulatory developments.
- Provider-side changes still matter to AI deployers: Some Omnibus changes primarily affect AI providers rather than deployers. Professional services firms should monitor these changes because they may affect required vendor documentation, contractual commitments, product timelines, transparency obligations, logging capabilities, and the firm’s ability to meet its own obligations as a deployer.
- Vendor readiness may affect deployer readiness: Even where an organization only functions as an AI user/deployer, it may need information from vendors to classify AI systems, complete impact assessments, understand system limitations, train users, and maintain appropriate oversight. Firms should consider whether their AI vendors can provide sufficient documentation and contractual support as AI Act requirements come into effect.
- Provider-like obligations remain a risk: Organizations may still assume provider obligations if they materially modify, rebrand, or use a high-risk AI system outside its intended purpose. Firms should control customization, integration, and non-standard uses of vendor AI systems.
Looking Ahead
In practical terms, the Omnibus gives AI deployers additional time to prepare for certain high-risk AI obligations, but it does not eliminate existing or future compliance expectations. Organizations should use the delay to build a defensible AI governance program, rather than waiting until the new deadlines approach. This includes maintaining an AI inventory, classifying AI systems, assessing potential impacts of AI systems, updating acceptable use and training programs, and confirming that vendors can provide the documentation and transparency needed to support responsible AI use