What the Digital Omnibus Actually Changed
The Digital Omnibus on AI was formally adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, signed on 8 July 2026, and entered into force on 27 July 2026 following Official Journal publication.
Its single most significant change is a deadline shift. The compliance deadline for stand-alone high-risk AI systems under Annex III was pushed back from August 2, 2026, to December 2, 2027, a 16-month reprieve.
High-risk AI systems that are products, or safety components of products, regulated by the EU product safety laws listed in Annex I (such as medical devices, machinery, and vehicles) will now take effect from 2 August 2028 rather than 2 August 2027, a 12-month delay.
What the Digital Omnibus Did Not Change
The delay does not cover everything. The risk-based classification framework, the four tiers, the obligations for general-purpose AI models, and the AI Office's oversight role all remain unchanged.
Three categories of obligations remain on their original schedule:
The prohibited AI practices ban (such as social scoring and manipulative AI) has been in effect since 2 February 2025. General-purpose AI model obligations have applied since 2 August 2025. And the Article 50 transparency obligations became applicable on 2 August 2026.
Product teams that read the Omnibus as a blanket pause are making a mistake. The Omnibus moved Annex III high-risk rules to 2 December 2027 and high-risk AI in regulated products to 2 August 2028, but left the prohibitions, AI literacy, GPAI rules and Article 50 on their original dates.
Article 50 Transparency: Already in Force Since 2 August 2026
From 2 August 2026, the EU AI Act's Article 50 transparency obligations apply. These affect a much broader set of AI systems than the high-risk classification does.
Article 50 creates four distinct transparency obligations. Providers bear responsibility for obligations 1 and 2, while deployers bear responsibility for obligations 3 and 4.
Here is what each obligation requires in practice:
Obligation 1: Chatbot and virtual assistant disclosure.
If your SaaS product includes a conversational AI feature, your users must be informed they are interacting with an AI system. This is a provider obligation. Providers of AI systems designed to interact directly with people, including chatbots, must ensure that users are informed that they are interacting with AI unless this is already obvious in the circumstances.
Obligation 2: Synthetic content marking.
Providers of AI systems that generate synthetic audio, images, video or text must ensure that their outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated, where technically feasible. A limited four-month transition ending on 2 December 2026 applies to this marking obligation for generative AI systems placed on the market before 2 August 2026.
Obligation 3: Emotion recognition and biometric categorization disclosure.
Deployers of these systems must inform affected individuals. This is a deployer obligation.
Obligation 4: Deepfake and AI-generated content disclosure.
Deployers publishing AI-generated or manipulated image, audio or video that constitutes a deepfake must clearly disclose that it has been artificially generated or manipulated.
The European Commission published its final guidelines on the application of Article 50 transparency obligations on 20 July 2026. It has also published a voluntary Code of Practice on Transparency of AI-Generated Content, offering providers a recognized path to demonstrate compliance with the marking and detection requirements.
The penalties are real. Breaches of Article 50 transparency obligations could result in fines of up to 15 million euros or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher.
The Revised Timeline: Every Deadline That Matters
Here is the consolidated timeline reflecting the Digital Omnibus amendments:
- 2 February 2025 - Prohibited AI practices ban entered into force (social scoring, manipulative AI). Already in effect.
- 2 August 2025 - General-purpose AI model obligations entered into force. Already in effect.
- 2 August 2026 - Article 50 transparency obligations apply. Already in effect.
- 2 December 2026 - Machine-readable marking obligation for generative AI systems placed on the market before 2 August 2026 takes effect. Also, a new prohibition added by the Omnibus applies from this date.
- 2 December 2027 - Annex III high-risk system obligations apply. This covers biometrics, employment, credit scoring, education, and critical infrastructure.
- 2 August 2028 - High-risk AI systems embedded in regulated products under Annex I (medical devices, machinery, vehicles) must comply.
Why This Matters for Fintech Specifically
Credit scoring falls squarely under Annex III of the AI Act. If your fintech product uses AI to assess creditworthiness, it is classified as a high-risk AI system. The compliance deadline for this category is now 2 December 2027.
That gives teams 14 months from today to prepare. The requirements include risk management systems, technical documentation, transparency provisions, human oversight measures, and data governance controls. Building these into an existing production system takes time.
Additionally, fintech companies regulated by BaFin face an overlapping obligation. BaFin issued non-binding guidance on ICT risks in the use of AI under DORA, released in early 2026. The guidance clarifies how financial institutions should manage ICT risks arising from AI-based systems under DORA and related EU regulations.
AI-based systems are not subject to a separate regime under DORA. They must be embedded into existing DORA-compliant ICT governance across the entire lifecycle of the AI-based system. This means your AI credit scoring model needs to sit inside your DORA ICT risk management framework, not alongside it.
What SaaS Teams Should Build Now
Even though Annex III obligations do not apply until December 2027, the engineering work should start now. Here is why: the systems you build today will be the systems you must retrofit later if you ignore these requirements.
AI interaction disclosure in the UI.
If your product includes any conversational AI, add clear disclosure labels. Article 50(1) is already enforceable.
Machine-readable content marking.
If your product generates text, images, audio, or video using AI, build the marking infrastructure into your content pipeline. The deadline for pre-existing systems is 2 December 2026. New systems must comply immediately.
Risk classification audit.
Map every AI component in your product against the Annex III categories. Determine which components qualify as high-risk and which do not. This classification drives every other compliance decision.
DPIA and FRIA planning.
High-risk AI systems require both a Data Protection Impact Assessment under GDPR Article 35 and a Fundamental Rights Impact Assessment under AI Act Article 27. Start these assessments early, because they require cross-functional input from legal, product, and engineering.
If you need help building AI agents that comply with these requirements from day one, working with a development partner that understands both the technical and regulatory landscape saves months of rework.
What the Delay Is Not
The 16-month delay reflects a practical reality. The delay reflects the absence of finalized technical standards, not reduced regulatory expectations.
The harmonized standards that high-risk AI system providers need for conformity assessment were not ready on time. The European Commission acknowledged this gap and pushed the deadline rather than forcing compliance against incomplete standards.
This does not mean the requirements have softened. The fundamental architecture of the AI Act remains intact. The delay is a deferral, not a dismantling.
Companies that use this window to prepare will have a significant advantage over those that wait until late 2027 to start. Retrofitting compliance into production AI systems is consistently more expensive and more disruptive than building it in from the start.
How Cypherox Approaches AI Act Compliance in Development
Disclosure: Cypherox offers AI and ML development services and generative AI development. This creates a potential bias in our perspective. That said, here is what we have learned about building AI systems with compliance built into the architecture.
Every AI system we build includes transparency hooks from the start. That means Article 50 disclosure mechanisms are not an afterthought. They are part of the UI and API design from the first sprint.
For fintech and SaaS clients, we build logging and audit trails that satisfy both GDPR accountability requirements and the AI Act's technical documentation obligations. This dual-compliance approach eliminates the need for two separate documentation processes.
We also structure AI agent architectures so that human oversight mechanisms are native to the system. When Annex III obligations take effect in December 2027, the systems we build today will already meet the human oversight requirements under Article 14 of the AI Act.
If you are evaluating how these obligations affect your product roadmap, our IT consulting services team can conduct a regulatory gap analysis specific to your AI stack.