The EU AI Act after the AI Omnibus: the dates that changed

The EU AI Act has been in force since 2024, but its obligations arrive in stages. In July 2026 the AI Omnibus, a package of targeted amendments, changed several of those stages. For organisations that build or use AI in Europe, including engineering teams adopting AI coding tools, the calendar now looks different from the one many compliance plans were built on. This article summarises what changed, what enforcement looks like, and what is worth doing now.

The context: what the Omnibus changed

According to the European Commission's announcement, the AI Omnibus entered into force on 27 July 2026. The main changes:

• High-risk systems in Annex III, such as AI used in employment, education or access to essential services, now have obligations applying from 2 December 2027.
• High-risk systems in Annex I, AI that is part of products already covered by EU product safety law, apply from 2 August 2028.
• AI literacy obligations were simplified.
• Relief for smaller companies was extended to small mid-cap companies.
• A new prohibition covers AI systems used to create non-consensual intimate images, often called nudification apps.

What enforcement looks like

The Commission's enforcement page sets out how the Act is enforced. National market surveillance authorities supervise most obligations, and the Commission's AI Office supervises general-purpose AI models. Enforcement powers apply from 2 August 2026. The prohibitions on AI generating child sexual abuse material and non-consensual intimate images apply from 2 December 2026.

Fines are tiered:

Breach	Maximum fine
Prohibited practices	€35 million or 7% of worldwide annual turnover
Most other obligations	€15 million or 3%
Incorrect information to authorities	€7.5 million or 1%

Analysis: what to make of it

The delay is not a pause. Prohibitions and general-purpose AI obligations already apply, and enforcement powers are in place. What moved is the high-risk timetable. Organisations that stopped work on the assumption that everything was postponed have misread the change.

Most engineering use of AI is not high-risk. AI coding assistants, code review bots and internal chat tools generally don't fall into the Annex III categories. The obligations that matter most for them are AI literacy, transparency where relevant, and the general expectation of knowing what AI you use.

But some uses near engineering are. AI used to evaluate employees' performance or decide on promotions is an Annex III employment use. Productivity analytics built on AI tool telemetry should be designed with that boundary in mind.

Simplification changes the form, not the need. Simpler AI literacy obligations still assume that people who use AI understand its limits. Training and clear internal rules remain worth having.

What it means for engineering and security leaders

The extra time is best used for groundwork that any regime will require: an inventory of AI systems and tools in use, a record of what each one is used for, and a clear owner for each. That inventory is also what you need to decide whether anything you run might be high-risk.

For AI coding tools specifically, the practical questions are where prompts and code go, which models process them, what is logged, and who can see the logs. Those questions overlap with data protection and security work already under way.

Practical takeaways for this week

• Update compliance plans with the new dates: 2 December 2027 for Annex III and 2 August 2028 for Annex I.
• Keep the dates that didn't move: the original prohibitions already apply (the new nudification ban applies from 2 December 2026), and enforcement powers apply from 2 August 2026.
• Build or refresh an inventory of AI tools in use, including coding assistants, MCP servers and internal agents.
• Check whether any AI use touches employment decisions, and keep developer analytics clear of performance scoring.
• Keep AI literacy training going in a simpler form: what the tools do, where data goes, and what not to paste in.

Where SpanDock fits

SpanDock helps with the inventory. On the Enterprise plan, process inventory shows which AI tools run on your team's computers, including the ones that send no telemetry; snapshots are kept on your server and never sent to https://spandock.com. Telemetry is stored on your own machines and leaves your network only to destinations you add; see privacy.