EU AI Act and the Digital Omnibus:
What Should Companies Do Now?

What Happened on 26 March 2026?

On 26 March 2026, the European Parliament plenary approved the Digital Omnibus package by 569 votes to 45. Immediately following the vote, the trilogue — the three-way negotiation between Parliament, Council, and Commission — formally opened. The package is based on the text adopted by the IMCO and LIBE committees on 18 March 2026 by 101 to 9 (with 8 abstentions).¹

The Digital Omnibus does not rewrite the EU AI Act; the core framework remains intact. The changes are essentially two things: moving some obligations forward in time, and simplifying certain provisions. The March 2026 Parliament vote described below was one step in that process; it concluded with formal adoption on 8 July 2026 and entry into force on 27 July 2026.

The New Timeline (Regulation (EU) 2026/1744)

The positions of Parliament and Council largely aligned, and what remained in the trilogue was technical detail. The process closed with adoption on 8 July 2026, and the proposed dates carried through largely intact.

What Is Not Changing?

Delay headlines can easily become a "relax on AI Act" message. That is not accurate. It is important to be precise about which obligations fall outside the Digital Omnibus scope.

Article 5 prohibitions (in force since 2 February 2025): Subliminal manipulation, social scoring, real-time biometric surveillance in public spaces (with limited exceptions), and emotion inference based on protected characteristics are all prohibited now. The Digital Omnibus does not touch these dates.

Article 4 AI literacy (in force since 2 February 2025): Regulation (EU) 2026/1744 rewrote this article with effect from 27 July 2026. Providers and deployers no longer have to ensure a sufficient level of AI literacy; they must take measures to support its development, and the new text states expressly that no specific level need be guaranteed for any individual. An obligation of effort rather than of result. The date did not move and the obligation was not removed.

GPAI model obligations (in force since 2 August 2025): Transparency, technical documentation, and (for systemic risk models) safety evaluation obligations for general-purpose AI model providers under Articles 51–56 apply now. These obligations are outside the postponement scope.

Article 50 transparency obligations (limited risk): Information obligations for chatbots, deepfakes, and emotion recognition systems entered into force on 2 August 2026 and were not deferred. Regulation (EU) 2026/1744 granted one narrow transition: the machine-readable marking requirement in Article 50(2) applies from 2 December 2026, but only for generative systems already placed on the EU market before 2 August 2026. Systems placed on the market on or after that date comply immediately, and content generated before 2 August 2026 needs no retroactive labelling.

Impact on Turkish Companies: Three Groups

The EU AI Act does not require registration in the EU. Any organisation that places AI systems on the EU market, or whose AI systems affect users in the EU, falls within scope — whether operating from Istanbul, Ankara, or anywhere else. For companies in Turkey, three distinct situations apply.

Group 1 — Exporting AI products or software to the EU: Turkish companies placing products or software that contain an AI component on the EU market qualify as providers under the EU AI Act. The Annex III postponement directly affects this group — but for companies with ongoing EU sales negotiations, planning to the August 2026 deadline remains the prudent approach until the delay is confirmed.

Group 2 — Providing AI-enabled services to EU customers: If a service delivered from Turkey affects a buyer in the EU, it falls within scope. Deployer obligations apply to this group: human oversight, compliance with usage restrictions, technical documentation requests. The Annex III postponement may defer some of these obligations — but contract requirements may already contain these conditions regardless of regulatory timeline.

Group 3 — Part of an EU supply chain: Turkish firms used as subcontractors by EU companies to develop, test, or process data for AI systems may fall under supply chain obligations (Article 25). For this group, documentation and technical information provision requirements are increasingly significant.

Delay: Opportunity or Trap?

With the Annex III postponement now confirmed, the August 2026 pressure has lifted. A wider window for planning compliance investments has opened. But three things are worth keeping in mind.

First: a deferral is not a reprieve. The obligations themselves did not change — only the date on which they bite. Organisations that treat 2 December 2027 as distant will face the same workload in a shorter window.

There is also a pressure that operates outside the regulatory calendar: customers and investors. Corporate buyers and institutional investors in the EU are already requesting AI governance documentation — and that demand does not track the European Parliament's vote calendar.

And perhaps most importantly: a delay does not remove obligations — it defers them. 2027 is coming. 2028 is coming. Building regulatory infrastructure is not a quick fix. Those who said "we'll start once the trilogue closes" now have their answer: it closed, and the clock is running.

What to Do: The ORIENT Framework

Whether or not the postponement is confirmed, the first two stages of ORIENT define what needs to be done today.

Observe: Inventory the AI systems that produce effects in the EU market. Which system affects which customer in which country? Without answering this question, scope analysis is impossible. The Hexis Generator provides a starting point for structuring that inventory.

Risk: Determine the EU AI Act risk class for each system. The risk classification guide walks through the decision tree step by step. Is the system in Annex III scope, or under transparency obligations? Your answer also determines whether the Digital Omnibus postponement affects you at all.

Identify: Separate the obligations already in force (Article 5, Article 4, GPAI, Article 50) from those arriving on 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Which require preparation now?

Evaluate → Navigate → Track: After the gap analysis, build a prioritised action plan. Set review triggers against the confirmed dates and against future amendments — Regulation (EU) 2026/1744 will not be the last one. This is not news tracking; it is a systematic Track process.

Conclusion: Don't Wait — Prepare

With the Annex III deadline set at 2 December 2027, you have roughly a 16-month implementation window from today. Article 50 is already in force, and the two new Article 5 prohibitions arrive on 2 December 2026. Having completed your inventory and risk classification puts you in an advantageous position for all three.

In either scenario, the starting point is the same: know your systems, determine your risk level, map your obligations. The Digital Omnibus does not change these steps — it only makes the timeline uncertain.

---

Sources

1. Global Policy Watch. MEPs Adopt Joint Position on Proposed Digital Omnibus on AI. March 2026. globalpolicywatch.com

2. European Commission. Digital Omnibus on AI Regulation Proposal. digital-strategy.ec.europa.eu

3. European Commission. Regulation (EU) 2024/1689 — Artificial Intelligence Act. EUR-Lex. eur-lex.europa.eu

4. Addleshaw Goddard. EU Digital Omnibus on AI Update: Council and Parliament Agreed Positions. 2026. addleshawgoddard.com

Note: This article is based on information available as of 3 April 2026. This article was updated on 3 August 2026. The Digital Omnibus entered into force as Regulation (EU) 2026/1744 on 27 July 2026 — see the update box at the top of this article. This does not constitute legal advice.