← Zum BlogBack to the blog

Build for August, hedge for the Omnibus — shipping under regulatory uncertainty

·4 Min. Lesezeitmin read·EN

Künstliche IntelligenzComplianceProduktstrategie

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and switches on in phases. Prohibited practices applied from 2 February 2025; general-purpose AI obligations from 2 August 2025; and under Article 113, the bulk of the high-risk regime — the Annex III standalone systems used in hiring, credit, education and the like — was scheduled to apply from 2 August 2026. Then the Commission moved the goalposts.

The deadline that may not be

On 19 November 2025 the Commission proposed the Digital Omnibus, a simplification package that defers the high-risk obligations. After a failed trilogue in late April, Parliament and Council reached a provisional agreement on 7 May 2026: standalone Annex III systems would now apply from 2 December 2027, and product-embedded high-risk systems from 2 August 2028. The deal still has to clear a final vote, so the calendar is agreed in principle but not yet law.

The stakes are why this matters at all. Once the high-risk regime applies, breaching its obligations carries administrative fines up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99) — and whether you are even in scope turns on the Article 6 classification rules, which look at the use case, not the model. A recommender for hiring or credit is high-risk; the same model behind a spell-checker is not. Misjudge that line and the rest of the roadmap is moot.

It is tempting to treat this as a binary bet — comply now, or wait and see. Both bets lose. Race for August and you may over-invest against a date that has already slipped sixteen months. Wait for the Omnibus and you may be caught flat if the final vote stalls or narrows. The mistake in both cases is the same: treating compliance as a one-off deadline project rather than a property of the product.

Design for the rule, not the date

Here is what does not move when the calendar does: the obligations themselves. For high-risk systems the Act requires a risk-management process (Art. 9), data and data governance with attention to bias and representativeness (Art. 10), technical documentation (Art. 11), automatic record-keeping and logging over the lifecycle (Art. 12), transparency toward deployers (Art. 13), and effective human oversight (Art. 14). The Omnibus shifts when these bite. It does not rewrite what they ask for.

None of that becomes wrong if the date moves. So build for the rule, not the date.

Compliance built as architecture survives a moving deadline. Compliance built as a deadline project does not.

Practically, that means folding the requirements into how the product already works — logging as a system concern rather than a bolt-on, oversight as a real workflow rather than a rubber stamp, technical documentation generated from the system rather than written about it after the fact. Two of these reward you immediately: clean data lineage and good logs make debugging and incident response faster regardless of any regulation. Frameworks like ISO/IEC 42001 and the NIST AI Risk Management Framework give you a vocabulary and control structure that maps onto these obligations without betting on a single legal text. Done this way, an earlier or later date changes your schedule, not your design.

A no-regrets roadmap for product leads

Sort the work by what holds in both scenarios:

  • Do now — risk classification, data lineage and logging (Art. 9, 10, 12). You need these regardless of the date, they are the slowest to retrofit, and they pay back in engineering quality the day you ship them.
  • Stage — conformity documentation and oversight workflows (Art. 11, 13, 14), scaffolded now against ISO/IEC 42001 or the NIST AI RMF, finalized as the text settles.
  • Watch — the Omnibus’s final vote and the standards still being harmonised. Let them move your timeline, never your architecture.

The deadline is a forcing function, not an endpoint. Teams that treat it that way stay able to act whichever way the date lands — and that optionality, not a date on a slide, is the real deliverable.

Sources

Lass uns sprechenLet’s talk Alle BeiträgeAll posts