EU AI Act: The Omnibus Reprieve - What the Postponed High-Risk Deadline Really Changes for the Mittelstand

On 7 May 2026, the European Parliament and the Council agreed to move the EU AI Act’s most feared date. The application of obligations for stand-alone high-risk systems under Annex III, originally set for 2 August 2026, was pushed back to 2 December 2027². For a lot of Mittelstand boardrooms, the reaction was relief and then quiet. The compliance project went back in the drawer.

That is the trap. The Digital Omnibus on AI moved one deadline, not the whole regulation. The transparency rules, the deployer duties, the prohibited-practice ban and the AI-literacy requirement all still apply on their original timelines, some of which have been in force since February 2025¹³. A deferred deadline is only useful if you keep building toward it. If you stop, you arrive at December 2027 with less runway, not more.

This guide is for the Geschaeftsfuehrer, the general counsel, and the compliance lead at a German SME who heard “the AI Act got delayed” and needs to know exactly what changed, what did not, and what to keep doing this quarter. No panic, no false comfort. Just the facts and a plan.

What the Digital Omnibus Actually Changed

The European Commission tabled the Digital Omnibus on AI on 19 November 2025 as a simplification package¹. After a first round of trilogue talks collapsed on 28 April 2026, the institutions reached a provisional political agreement on 6-7 May, confirmed by member-state representatives on 13 May³. The headline is a timeline shift, not a rewrite of the risk model.

• Annex III high-risk deferred - Stand-alone high-risk systems (recruitment, credit scoring, insurance, education, biometric identification) move from 2 August 2026 to 2 December 2027, a delay of roughly 16 months².
• Annex I high-risk deferred - High-risk AI embedded in regulated products such as machinery and medical devices moves from 2 August 2027 to 2 August 2028³.
• The reason behind the delay - Implementation was visibly off track; harmonised standards from CEN-CENELEC and the notified-body infrastructure were not ready, so the extra time is meant to let the supporting machinery catch up⁶.
• A new prohibition added - The package adds a ban on AI generating non-consensual intimate imagery and child sexual abuse material under Article 5, effective 2 December 2026³.
• Targeted simplification - Some registration duties for self-assessed non-high-risk systems were trimmed, and sensitive data may be used where strictly necessary to detect and mitigate bias⁶.
• Regulatory sandboxes pushed - The deadline for member states to have a sandbox running shifted by a year, to 2 August 2027⁶.

The Commissioner responsible framed the package as a way to reduce uncertainty rather than lower the bar.

What Did Not Move (and Why That Matters Most)

The relief is narrow. Four pillars of the AI Act are untouched by the Omnibus, and three of them already apply or apply within weeks. If your AI footprint is chatbots, content generation, or any customer-facing agent, the delay does almost nothing for you.

• Article 50 transparency - Applies from 2 August 2026. You must disclose when a person interacts with an AI system, and AI-generated or substantially manipulated content must be labelled. This was largely unaffected by the Omnibus¹⁰.
• Article 26 deployer obligations - Apply for deployers of high-risk systems and remain intact. Use the system per instructions, ensure human oversight, monitor operation, keep logs, and inform affected people where required¹¹.
• Article 5 prohibited practices - Enforceable since 2 February 2025. Social scoring, manipulative AI, untargeted facial-image scraping, and emotion recognition in workplaces are banned. The Omnibus added a new prohibition, it did not relax existing ones¹².
• Article 4 AI literacy - Binding since 2 February 2025. Providers and deployers must ensure staff who operate AI systems have an adequate level of AI competence. The Omnibus softened the wording slightly but kept the duty¹³.
• General-purpose AI rules - In force since 2 August 2025 for GPAI model providers. If you build on top of a foundation model, your provider carries these, but your downstream duties remain⁹.
• The EU registration database - The duty to register high-risk systems in the central EU database remains in place; only some self-assessed registration items were trimmed⁶.

Still Live on 2 August 2026: The Transparency Layer

Article 50 is the obligation that catches the broadest set of Mittelstand companies, because almost everyone now runs some customer-facing AI. It is not deferred. Here is what it actually demands.

The four transparency duties

1. Chatbot and agent disclosure - Any AI system that interacts directly with a person must make clear that the person is dealing with an AI, unless it is obvious from context. A service hotline voice agent or a website chatbot both qualify¹⁰.
2. AI-content labelling - Providers of generative AI must mark output as artificially generated in a machine-readable way. Deployers using it must disclose where content is AI-generated or manipulated¹⁰.
3. Deepfake disclosure - Image, audio, or video content that is a deepfake must be labelled as artificially generated or manipulated, with narrow exceptions for artistic or law-enforcement use¹⁰.
4. Emotion and biometric notice - If you operate emotion-recognition or biometric-categorisation systems, you must inform the people exposed to them. Several such uses are also outright prohibited under Article 5¹².

Watermarking: the one short grace period

• New systems comply immediately - Generative systems placed on the market after 2 August 2026 must mark output from that date⁶.
• Existing systems get four months - Systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable watermarking³.
• This is not a high-risk question - Watermarking sits under transparency, so it applies regardless of the Annex III deferral.

Why a Deferred Deadline Is a Trap If You Stop Preparing

A delay only helps the companies that use it. The ones that file the project away will face the same wall in December 2027 with worse odds, because the work that the delay was meant to enable does not happen on its own. Five mechanics make the reprieve dangerous.

• Standards arrive late, certification arrives later - The extra time exists because harmonised standards and notified bodies are not ready. When they do land, the queue for conformity assessment fills up. Early movers get capacity; latecomers wait⁶.
• Documentation is slow to build, not slow to file - A high-risk technical file under Annex IV covers data lineage, system logic, risk management, and testing evidence. That history has to be captured as you build, not reconstructed in the final quarter.
• The political direction is contested - More than 120 civil-society organisations argued the Omnibus is deregulation rather than simplification, and the Parliament rapporteur warned the approach could be deregulatory¹⁹. Betting on further relief is betting on a fight that could swing either way.
• The other obligations bite first - Transparency in August 2026 and literacy since February 2025 are live now. A company that treats the whole Act as “delayed” misses obligations that have nothing to do with the high-risk timeline¹³.
• Skills compound - AI governance, classification discipline, and human-oversight design are organisational muscles. Teams that practise on low-risk systems now are ready when a high-risk use case appears. Teams that wait start from zero under deadline pressure.

The SME and Small Mid-Cap Provisions

The Omnibus is not only a delay. It carries genuine relief for smaller companies, which is the part of the package most relevant to the Mittelstand. The relief lowers the burden of the obligations; it does not remove them.

• The new small mid-cap category - The AI Act gains a small mid-cap class covering companies up to 750 employees and below roughly 150 million euros turnover (or a balance sheet below about 129 million euros), sitting between SMEs and large enterprises⁴.
• Simplified technical documentation - Small mid-caps and SMEs can use simplified technical-documentation templates that notified bodies must accept, cutting the paperwork load for high-risk conformity⁴.
• Proportionate quality management - Quality-management-system requirements are scaled to company size rather than applied uniformly⁴.
• Preferred sandbox access - Smaller companies get priority, free access to national regulatory sandboxes, where good-faith testing can count toward compliance⁴.
• Reduced fine caps - For SMEs and start-ups, the fine is the lower of the fixed amount or the percentage of turnover, keeping exposure proportionate¹⁴.
• A correction window - Smaller firms get a short period to remedy a violation after a warning before sanctions apply, rather than immediate penalties⁴.

What to Keep Doing Now: A Practical Plan

The right response to the delay is not to stop and not to panic. It is to keep a steady cadence of work that clears the live obligations and builds toward December 2027. Here is the sequence.

1. Inventory every AI system - List everything you build or deploy, including shadow tools your teams adopted on their own. For each, record the owner, what it does, what data it touches, and which Annex III category it could fall into. This is the foundation for everything else.
2. Classify by risk now - Map each system to prohibited, high-risk, limited-risk, or minimal-risk under the existing taxonomy. The substance of high-risk obligations did not change, only the timing, so classification done now stays valid¹⁵.
3. Clear the transparency layer - For every customer-facing chatbot, voice agent, and generative-content use, add disclosure and labelling before 2 August 2026. Document that you did it. This is the nearest live deadline for most companies¹⁰.
4. Run AI literacy training - Article 4 has been a duty since February 2025. Deliver role-based training for everyone who operates AI, and keep records. It is low-cost and overdue for many firms¹³.
5. Build documentation as you go - For any system that might become high-risk, capture data lineage, model choices, oversight design, and test results from day one. Reconstructing this in late 2027 is the expensive path.
6. Pin down deployer duties - For bought-in AI, confirm in writing what the provider covers and what you carry under Article 26: oversight, monitoring, logging, and informing affected people¹¹.
7. Join a sandbox early - When your national regulatory sandbox opens, get in. Capacity is limited and good-faith testing can count toward compliance⁴.
8. Keep the DSGVO and Betriebsrat in scope - Neither was touched by the Omnibus. Run a data protection impact assessment where required, and align with the works council on any system that monitors employees.

A simple cadence for the months ahead

How Superkind Fits

Superkind builds custom AI agents for SMEs and enterprises, and compliance is part of how they are built, not a layer bolted on afterward. The approach is process-first: we map your workflows and systems before writing code, which is also what produces clean AI Act documentation.

• Classification built in - Every agent we build is assessed against the AI Act risk taxonomy at design time, so you know whether a use case is minimal, limited, or high-risk before it goes live.
• Transparency by default - Customer-facing agents disclose that they are AI and label generated content, so the Article 50 obligations are met from day one rather than retrofitted.
• Documentation as a by-product - Because we map the process and data flows up front, the technical-documentation trail for a potential high-risk system accumulates as we build, not in a last-minute scramble.
• Human-in-the-loop design - Critical decisions route to a person with the context to decide, which is both good practice and the human-oversight requirement the high-risk rules demand.
• Sits on top of your stack - Agents connect to your existing ERP, CRM, and document systems through APIs. No rip-and-replace, and the audit trail stays inside your infrastructure.
• Data stays under your control - Encrypted connections and EU-friendly deployment options keep the DSGVO position clean, which the AI Act delay does not change.
• Literacy comes with the rollout - The teams that work with the agent learn to operate and supervise it, which feeds your Article 4 AI-literacy obligation directly.
• Outcomes, not licenses - Pricing is per use case with measurable ROI defined before the build, so compliance work is scoped, not open-ended.

Decision Framework: How Exposed Are You?

The delay changes your timeline only if you actually run high-risk systems. Use these signals to decide how much the reprieve affects you.

Frequently Asked Questions

Related Articles

• AI Literacy for the Mittelstand: How to Implement Article 4 of the EU AI Act in Practice
• DPIA for AI Agents: How the German Mittelstand Implements GDPR Article 35 for Agent Rollouts
• ChatGPT at Work: The Mittelstand Guide to What’s Allowed, Forbidden, and Trained
• Voice AI Agents on the Phone: Deploying AI Calling Without Customers Hanging Up
• AI as a Compliance Assistant: Automating Audit Trails, Policies, and Reporting
• AI Agents for the Mittelstand: How Germany’s Hidden Champions Deploy AI

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach, and a compliance posture that turns regulation into a head start rather than a scramble.