EU AI Act for SaaS Companies: What the 2026 Delay Actually Changes

What the Digital Omnibus actually delayed

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal of the European Union on 24 July 2026 and entered into force on 27 July 2026, three days after publication rather than the usual twenty, because the text was adopted just before the AI Act’s original 2 August 2026 deadline for high-risk systems. It amends the AI Act (Regulation (EU) 2024/1689) by rewriting the implementation timetable in Article 113.

The deferral is narrow. It covers only Chapter III, Sections 1 to 3 of the AI Act — the sections that set out requirements for high-risk AI systems and the obligations of their providers and deployers. Standalone high-risk systems listed in Annex III, the category that includes hiring, credit scoring, education, and biometrics tools, now have until 2 December 2027 to comply, instead of 2 August 2026. High-risk AI embedded in products covered by Annex I, such as medical devices or machinery, moves from 2 August 2027 to 2 August 2028. National AI regulatory sandboxes, which Member States were due to have operating by 2 August 2026, now have until 2 August 2027. One date did not move: high-risk systems intended for use by public authorities still have until 2 August 2030, as originally set.

Claim

Standalone high-risk AI systems under Annex III must comply with Chapter III obligations from 2 December 2027, not 2 August 2026.

Claim type

Legal requirement under adopted EU regulation

Original source

NicFab, article-by-article analysis of Regulation (EU) 2026/1744, cross-checked against Cooley’s and CyberAccord’s independent summaries

Publication date

24 July 2026 (NicFab); 3 August 2026 (Cooley); 22 October 2026 (CyberAccord)

Research or measurement date

Not applicable — this is a legal commencement date set by Article 113, third paragraph, point (c)(i) of the AI Act as amended

Sample and population

Not applicable

Method or definition

Direct reading of the amended Article 113 text, as reported independently by three law-firm and compliance-industry sources that cite the same article and recital numbers

Limitations

Direct access to the EUR-Lex Official Journal text was not available in this research session. The claim rests on convergent secondary legal analysis rather than a direct primary-source fetch; a spot-check against EUR-Lex is recommended before publication.

Editorial interpretation

None added beyond the cited sources.

What was already in force, and still is

Three sets of obligations predate the Omnibus entirely and were not touched by it. The ban on prohibited AI practices and the AI literacy duty under Articles 5 and 4 have applied since 2 February 2025. General-purpose AI model obligations, covering the foundation models many SaaS products are built on, have applied since 2 August 2025, with the Commission’s enforcement powers over those providers active since 2 August 2026.

The Omnibus did make one change inside Article 4. The original wording required providers and deployers to “ensure” a sufficient level of AI literacy among staff. The amended version requires them to “take measures to support the development of” AI literacy, and it adds that this does not require guaranteeing any individual’s specific level of competence. The obligation was softened, not removed, and the softened wording has applied since the Omnibus entered into force on 27 July 2026.

Article 50 transparency duties are the fourth, and for most SaaS products the most relevant, set of obligations. They have applied since 2 August 2026 and were left untouched by the Omnibus. Providers of systems that interact directly with people, such as chatbots, must design them so users know they are talking to AI, unless that is obvious from context. Providers of generative systems must mark their outputs in a machine-readable format. Deployers must disclose deepfakes and AI-generated text published on matters of public interest, unless a human has taken editorial responsibility for it.

The 2 December 2026 deadline most summaries get wrong

A lot of compliance guides describe 2 December 2026 as a general watermarking deadline for generative AI. That overstates it. The new Article 111(4), inserted by the Omnibus, gives a grace period only to providers of AI systems — including general-purpose AI systems — that generate synthetic audio, image, video, or text and that were already placed on the market before 2 August 2026. Those providers have until 2 December 2026 to bring their machine-readable marking into line with Article 50(2). A generative feature launched on or after 2 August 2026 had no such grace period and had to comply from the day it launched.

The same 2 December 2026 date also carries a separate, newly added obligation: a ban on AI systems that generate or manipulate realistic intimate imagery of an identifiable person without consent, and on AI-generated child sexual abuse material. The standard differs for providers and deployers. A provider is caught where generating that material is the system’s intended purpose, or where it is a reasonably foreseeable and reproducible outcome that the system lacks adequate safeguards to prevent. A deployer is caught only where it actually uses the system to generate or manipulate such material. Any SaaS product with image, audio, or video generation or editing features should check its guardrails against this before the date arrives.

According to the European Commission’s Code of Practice on Transparency of AI-Generated Content, as reported by Faegre Drinker, signatories to the Code also commit to offering detection tools for their marking methods and to building interoperability between them by 2 February 2027. That date sits outside the AI Act’s own text and depends on voluntary Code commitments rather than a binding statutory deadline, so it is worth tracking separately rather than treating it as a hard legal cutoff.

Claim

The 2 December 2026 grace period for Article 50(2) marking applies only to generative systems already on the market before 2 August 2026, not to every generative AI feature.

Claim type

Legal requirement under adopted EU regulation

Original source

NWLexTech, “EU AI Act for SaaS Companies”, cross-checked against Brainence’s guide and CyberAccord’s analysis

Publication date

Updated August 2026 (NWLexTech); 28 October 2026 (Brainence); 22 October 2026 (CyberAccord)

Research or measurement date

Not applicable — this is a legal commencement date set by Article 111(4) of the AI Act as amended

Sample and population

Not applicable

Method or definition

Direct reading of the amended Article 111(4) text, as reported independently by three sources that each state the “already on the market before 2 August 2026” condition explicitly

Limitations

Direct access to the EUR-Lex Official Journal text was not available in this research session. A spot-check against EUR-Lex is recommended before publication.

Editorial interpretation

The framing of this as “the deadline most summaries get wrong” is this publication’s own observation, based on comparing several general-audience compliance guides against the narrower statutory wording.

If your SaaS is built on GPT, Claude, or another model

Responsibility splits along a clear line. The provider of a general-purpose AI model carries the Chapter V obligations: technical documentation covering training and testing, information for downstream providers, a copyright policy, and a public summary of training content. Those duties have applied to model providers since 2 August 2025, and the Commission’s enforcement powers over them began on 2 August 2026. Models already on the market before 2 August 2025 have until 2 August 2027 to come into full compliance.

None of that transfers your own obligations away. A SaaS company that builds a feature on top of a third-party model is still the one responsible for classifying that feature, meeting its Article 50 transparency duties, and marking any synthetic output the feature produces. Vendor due diligence is worth adding to your contract review now: ask whether your model provider has signed the Commission’s Code of Practice on Transparency of AI-Generated Content, and what marking its outputs actually carry, because your Article 50(2) obligation is not satisfied just because the underlying model vendor is compliant.