The AI Act deadline that fragmented instead of disappearing

Many boards left their June AI governance meetings believing the immediate regulatory pressure had eased. Following the Council of the European Union’s approval of the Digital Omnibus on 29 June 2026, that conclusion was understandable. It was also incomplete.

The AI Act did not become simpler. Its implementation timetable became fragmented.

While the application of the Annex III high-risk obligations has moved to December 2027, other provisions remain on their original timetable, and new prohibited practices carry their own implementation date later in the year. Organisations that continue to govern against a single AI Act deadline are now governing against the wrong calendar.

For Chief Privacy Officers, Chief Risk Officers and boards, the challenge is no longer simply understanding the legislation. It is ensuring that governance activity reflects the legislation’s revised implementation timetable.

From one deadline to three governance milestones

For much of the past year, organisations have structured their AI governance programmes around a single assumption. August 2026 represented the point at which the AI Act would begin placing significant operational obligations on organisations deploying high-risk AI systems.

The Digital Omnibus fundamentally changed that assumption.

The application of the Annex III obligations for stand-alone high-risk AI systems has been deferred until December 2027. AI systems that form part of regulated products under Annex I legislation now move even further, with implementation scheduled for August 2028.

Those changes are significant. They provide organisations with valuable additional time to strengthen governance frameworks, refine accountability structures and prepare the documentation expected of higher-risk AI deployments.

However, one important misconception has quickly emerged.

Many organisations interpreted the revised timetable as though the AI Act itself had been delayed. In reality, only part of the implementation schedule moved. Several important obligations remain exactly where legislators originally intended them to be.

The result is not one revised deadline. It is three distinct governance milestones, each requiring different decisions, different evidence and different forms of board oversight.

That distinction matters because governance programmes are rarely built around legislation alone. They are built around implementation dates. Project plans, steering committees, board reporting and assurance activities all tend to revolve around key regulatory milestones. When those milestones change, governance programmes must change with them.

The first milestone remains August 2026

The first milestone arrives sooner than many organisations now realise.

From 2 August 2026, Article 50 introduces transparency obligations requiring organisations, in defined circumstances, to ensure individuals know when they are interacting with an AI system. It also requires certain categories of AI-generated or AI-manipulated content to be appropriately disclosed or labelled.

Although these obligations are narrower than the governance framework applying to high-risk AI systems, they are nevertheless mandatory legal requirements under the AI Act.

More importantly, they represent one of the first practical tests of whether AI governance has moved beyond policy statements and into day-to-day operational practice.

For boards, this shifts the conversation away from legislative interpretation and towards governance assurance.

Can we identify every customer or employee interaction that falls within the Article 50 transparency requirements?

Do we know where AI-generated content requires clear disclosure?

Who is accountable for ensuring those disclosures remain accurate as AI capability expands across the organisation?

How will we demonstrate compliance if regulators request evidence?

These are governance questions rather than legal questions.

They require clear ownership, documented processes and regular oversight. Publishing an AI policy alone will not provide satisfactory answers.

December introduces a different governance challenge

A second implementation milestone follows only four months later.

Article 5 introduces additional prohibited practices relating to AI systems that produce non-consensual intimate imagery. These provisions become applicable in December 2026 and establish another distinct point within the AI Act’s implementation timetable.

Many organisations will never develop or intentionally deploy systems capable of creating this type of content. Nevertheless, the governance lesson extends well beyond the specific prohibition itself.

The AI Act is no longer progressing through a single implementation event.

Different obligations now become applicable at different times, reflecting different categories of regulatory risk.

Boards that continue reporting against one “AI Act deadline” may therefore overlook obligations that arise independently of the deferred high-risk provisions.

Good governance depends not only on understanding what the legislation requires, but also on understanding precisely when each obligation takes effect.

That requires governance calendars that remain as dynamic as the regulatory environment itself.

A governance calendar that reflects reality

For many organisations, the greatest risk is no longer misunderstanding the legislation. It is continuing to manage AI governance using an outdated implementation calendar.

Governance programmes naturally develop around major regulatory milestones. Project plans, steering groups, board reporting and assurance activities are built to support a known deadline. When that deadline changes, governance programmes should change with it.

The Digital Omnibus makes that adjustment essential.

Rather than viewing the AI Act as one implementation event, boards should now think in terms of three distinct governance milestones.

The first is transparency.

From August 2026, organisations should be confident they know where Article 50 applies, which AI systems require user notification, where AI-generated content requires appropriate disclosure, and how those obligations are monitored over time.

The second is prohibited practices.

From December 2026, organisations should be able to demonstrate that prohibited AI uses have been assessed, even where the immediate business risk appears low. Governance is not simply about preventing misuse. It is about being able to demonstrate that foreseeable risks have been considered and appropriately managed.

The third is high-risk AI governance.

The postponement of the Annex III obligations should not be viewed as an opportunity to delay governance activity. It should be viewed as additional preparation time. Organisations deploying AI into significant business processes will still need documented risk management, defined accountability, effective human oversight and evidence that governance arrangements are capable of supporting future regulatory expectations.

Each milestone requires different activities.

Each involves different stakeholders.

Each demands different evidence.

Treating them as a single compliance deadline risks leaving important obligations unmanaged.

Governance is becoming a continuous discipline

One of the most significant changes introduced by modern AI regulation is the move away from one-off compliance exercises.

Privacy professionals have experienced this evolution before.

Few organisations now regard GDPR as something that was completed in May 2018. Most recognise that privacy governance requires continual monitoring, regular review and ongoing executive oversight.

The AI Act should be approached in exactly the same way.

Policies will evolve.

Regulatory guidance will continue to develop.

AI capabilities will expand.

New use cases will emerge across every area of the organisation.

An effective governance programme therefore needs mechanisms for reviewing its own assumptions, including whether its implementation timetable still reflects current regulatory reality.

This becomes even more important for organisations operating across multiple jurisdictions, where AI regulation is evolving at different speeds and according to different legislative priorities.

The governance challenge is no longer preparing for one deadline.

It is maintaining an accurate regulatory calendar as obligations continue to evolve.

For boards, the more useful question is no longer:

“Have we reached the AI Act deadline?”

Instead, it is:

“Which AI Act obligations apply today, and what evidence demonstrates that we are governing them appropriately?”

That simple change in perspective encourages governance based on current obligations rather than historical planning assumptions.

Looking beyond the headlines

Major regulatory announcements inevitably generate major headlines.

The approval of the Digital Omnibus was no exception. Much of the public discussion focused on the postponement of the Annex III high-risk obligations because it represented the most visible change to the implementation timetable.

That coverage was understandable.

It was not the whole story.

Effective governance cannot rely on headlines.

Boards need to understand which obligations have moved, which remain unchanged and which continue to become applicable according to their original timetable.

That requires more than legal awareness.

It requires governance programmes that are reviewed whenever legislation, implementation dates or regulatory guidance changes.

For organisations already investing in AI governance, this should be viewed positively.

The objective is not to rebuild governance programmes every time the regulatory landscape evolves. It is to ensure that board reporting, accountability and operational priorities continue to reflect the obligations that actually apply.

The organisations most likely to succeed will not necessarily be those with the largest compliance teams.

They will be those whose governance processes remain aligned with an evolving regulatory environment.

The Digital Omnibus reduced immediate pressure in one area of the AI Act. It did not reduce the need for effective governance.

Boards that continue to manage AI against a single implementation date risk overlooking obligations that already apply or are about to apply. Those that maintain an accurate governance calendar will be better placed to demonstrate accountability, provide evidence of informed oversight and adapt confidently as regulation continues to evolve.

Good governance depends on more than understanding regulation.

It depends on governing against the right timetable.

The DPG helps organisations translate changing AI regulation into practical governance programmes that remain aligned with current legal obligations and board expectations. By keeping governance calendars as current as governance policies, organisations are better placed to demonstrate that AI oversight is accurate, proportionate and capable of adapting as regulation continues to evolve.