# AI Act high-risk rules in autumn 2026: what the Digital Omnibus delay means for Luxembourg

> The Digital Omnibus moved AI Act high-risk duties from 2 August 2026 to 2 December 2027 and 2 August 2028. Other obligations already apply in Luxembourg.

Published: 2026-10-01 · Dataplaz editorial team · https://dataplaz.lu/en/ai-act-high-risk-obligations-delay-2026/

## Key takeaways
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026, days before the high-risk rules were due to apply on 2 August 2026.
- High-risk requirements now apply from 2 December 2027 for stand-alone systems listed in Annex III and from 2 August 2028 for AI in products covered by Annex I.
- Prohibited practices (since 2 February 2025), general-purpose AI obligations (since 2 August 2025) and Article 50 transparency duties (since 2 August 2026) were not postponed.
- Two new prohibitions, on non-consensual intimate imagery and child sexual abuse material, apply from 2 December 2026.
- In Luxembourg, credit scoring and life and health insurance pricing fall under the 2 December 2027 date; the national enforcement law, draft No. 8476, had not been voted by October 2026.

The EU AI Act's obligations for high-risk AI systems did not start on 2 August 2026 as originally planned. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, moved them to 2 December 2027 for stand-alone systems listed in Annex III and to 2 August 2028 for AI built into products covered by Annex I. For Luxembourg companies, the prohibitions, AI literacy, general-purpose AI rules and transparency duties continue on their original timetable.

## How the delay was adopted

The European Commission proposed the Digital Omnibus on AI on 19 November 2025. Parliament and Council reached a provisional agreement in early May 2026; the European Parliament adopted the text on 16 June 2026 and the Council on 29 June 2026. The [regulation](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) is dated 8 July 2026, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the original deadline.

The recitals give the reason: standards for high-risk systems and national governance and conformity-assessment frameworks were not ready in time, making compliance heavier than expected. The Commission's proposal had tied the delay to the availability of standards and support tools; the adopted text sets fixed dates instead.

## The AI Act timeline after the Omnibus

| Date | What applies | Status on 1 October 2026 |
|---|---|---|
| 2 February 2025 | Prohibited practices (Art. 5); AI literacy (Art. 4) | Applies |
| 2 August 2025 | General-purpose AI model obligations; governance; penalties; notified bodies | Applies |
| 27 July 2026 | Omnibus in force; Article 4 rewritten ("take measures to support" AI literacy) | Applies |
| 2 August 2026 | General date of application, including Article 50 transparency | Applies |
| 2 December 2026 | New bans on non-consensual intimate imagery and child sexual abuse material; Art. 50(2) marking for generative systems already on the market | Upcoming |
| 2 August 2027 | General-purpose AI models placed on the market before 2 August 2025; national AI regulatory sandboxes operational | Upcoming |
| 2 December 2027 | High-risk requirements, Annex III systems (was 2 August 2026) | Postponed |
| 2 August 2028 | High-risk requirements, Annex I products (was 2 August 2027) | Postponed |
| 2 August 2030 | Existing high-risk systems used by public authorities | Unchanged |

## What was postponed, and what was not

The delay covers Sections 1 to 3 of Chapter III of the [AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj): classification, the technical requirements (risk management, data governance, documentation, logging, human oversight, accuracy and robustness) and the obligations of providers, deployers and other operators, including the fundamental rights impact assessment.

Article 50 was not postponed. Since 2 August 2026, people must be told when they interact with an AI system, synthetic content must be marked in a machine-readable way, and deployers must disclose deepfakes. Providers of generative systems that were already on the market before 2 August 2026 have until 2 December 2026 for the marking requirement.

The Omnibus also clarified the grace period for systems already on the market. High-risk systems placed on the market before the new application dates are only caught if their design changes significantly afterwards, and the recitals specify that this applies per type and model. Providers and deployers of high-risk systems used by public authorities must still comply by 2 August 2030.

## What it means for Luxembourg

For the financial centre, the most relevant Annex III categories are creditworthiness assessment and credit scoring of natural persons, and risk assessment and pricing in life and health insurance. Both now apply from 2 December 2027. Under [draft law No. 8476](https://www.chd.lu/fr/dossier/8476), the CSSF and the Commissariat aux assurances would supervise them, while the CNPD would cover most other uses, such as AI for recruitment and staff management, also listed in Annex III. Manufacturers of medical devices and other products in Annex I have until 2 August 2028.

The extra time also matters for the state. As of 1 October 2026, the national law designating these authorities had not been voted; the Conseil d'État delivered its opinion, with several formal oppositions, on 10 July 2026. The Omnibus also gives Member States until 2 August 2027, instead of 2 August 2026, to have a national AI regulatory sandbox in operation.

The postponement is not a pause. Prohibited practices, AI literacy and transparency duties are enforceable now, and two new prohibitions take effect on 2 December 2026. The 14 months to December 2027 are the window to inventory AI systems, confirm which ones are high-risk, and build the documentation and oversight that the requirements will demand once harmonised standards are available.

## Questions & answers
**Were the AI Act high-risk obligations postponed?**
Yes. Regulation (EU) 2026/1744 moved them from 2 August 2026 to 2 December 2027 for Annex III systems, and from 2 August 2027 to 2 August 2028 for AI embedded in products covered by Annex I.

**Is the delay conditional on harmonised standards?**
No. The Commission's proposal of 19 November 2025 linked the timing to the availability of standards and support tools, but the adopted regulation sets fixed dates in Article 113.

**Did the transparency obligations of Article 50 also move?**
No. Article 50 has applied since 2 August 2026. Only providers of generative AI systems placed on the market before that date received until 2 December 2026 to comply with the machine-readable marking duty in Article 50(2).

**Does the delay change anything for AI literacy?**
The obligation was not postponed, but its wording changed on 27 July 2026: providers and deployers must now take measures to support AI literacy rather than ensure a sufficient level of it.

## Sources
1. [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) · EUR-Lex
2. [Regulation (EU) 2024/1689 (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) · EUR-Lex
3. [Projet de loi 8476 – dossier parlementaire](https://www.chd.lu/fr/dossier/8476) · Chambre des Députés
4. [Projet de loi n° 8476 – document de dépôt](https://wdocs-pub.chd.lu/docs/exped/0151/094/302942.pdf) · Chambre des Députés
5. [EU AI Act Omnibus Agreement – Postponed High-Risk Deadlines and Other Key Changes](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/) · Gibson Dunn
6. [Council of the EU adopted Digital Omnibus on AI Regulation](https://digitalpolicyalert.org/event/42539-council-of-the-european-union-adopted-digital-omnibus-on-ai-regulation-20250359-including-local-operations-requirement) · Digital Policy Alert
7. [EU Digital Omnibus on AI Enters Into Force](https://www.cyberlawwatch.com/2026/07/31/eu-digital-omnibus-on-ai-enters-into-force/) · K&L Gates
8. [Digital Omnibus on AI](https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/) · artificialintelligenceact.eu