The AI Act is slowing down. Can your company postpone the audit?
At the end of April 2026, the European Parliament and the Council of the EU announced a preliminary political agreement. The “digital omnibus” package moves the AI Act deadlines for high-risk systems. From August 2026 to December 2027. That is 18 more months.
This article breaks it down: what has changed, what has stayed, and why postponing the audit is a worse choice than doing it now.
What has changed - 5 changes from the digital omnibus
The political agreement still needs formal adoption by Parliament and the Council before August 2026. But the direction is clear. Five changes:
High risk waits longer
Obligations for high-risk AI systems are postponed to December 2, 2027. This covers the 8 areas from Annex III: biometrics, critical infrastructure, education, employment, law enforcement, borders, justice, public services. Safety components covered by EU sectoral legislation come later still, on August 2, 2028.
Watermarking sooner than the Commission wanted
The obligation to label AI-generated content takes effect on December 2, 2026 - two months earlier than the European Commission proposed. Why sooner? The co-legislators decided they could not wait for the next wave of generative AI without decent transparency.
Centralization at EU level
Enforcement of the rules for certain general-purpose AI systems moves to the EU AI Office. National supervisory authorities (in Poland: KRiBSI, the Commission for the Development and Safety of AI) lose part of their powers.
Relief for business, not only SMEs
The exemptions for small and medium-sized enterprises have been extended to small mid-cap companies (SMCs). Overlapping requirements for AI in machinery products have been removed. The definition of a “safety component” has been narrowed. Processing of personal data to detect and correct algorithmic bias has been allowed.
Ban on nudifier apps
For managing AI in a company, this point does not matter. It will, however, please every parent. The co-legislators agreed to ban AI systems that create CSAM and that depict the intimate parts of an identifiable person without their consent. Deadline: December 2, 2026.
What has NOT changed
This is where companies often get it wrong. The digital omnibus does not repeal the AI Act. It does not switch it off. Most of the core of the regulation stays.
The risk-based approach - four levels: prohibited, high, limited, minimal. No change.
The 8 high-risk areas from Annex III. No change.
Penalties up to EUR 35 million or 7% of global turnover. No change.
AI literacy and prohibited practices - in force since February 2, 2025. Already now, not in the future.
Watermarking - paradoxically it arrives sooner than in the original version.
That last point is the key one. The digital omnibus gives more time for technical documentation, conformity assessment and governance processes for high-risk systems. But it does not postpone the transparency obligations for generative AI. It speeds them up.
Most companies use generative AI every day. ChatGPT for writing content, Claude for drafting documents and presentations, Perplexity for research. Chatbots on websites. Watermarking and the duty to disclose AI use apply to every one of these applications.
Since this article was published, the Digital Omnibus has become law, and in Poland the Act on AI Systems has come into force. We have described the current state of the rules separately, and how unauthorized use of AI in the company fits into it.
This is not a topic for 2027. It is a topic for December 2026.
Why postponing the audit is expensive
After the digital omnibus, most companies may think: “we have 18 more months, so we can push the topic to later quarters.”
Four reasons why this is a miscalculation.
First: contracts with EU clients will require compliance earlier than December 2027
A German, French or Dutch enterprise client does not wait for the regulatory deadline before demanding compliance certificates from a supplier. Procurement teams in international corporations are already putting AI Act compliance into their RFPs. No EU declaration = no contract. A Polish company selling SaaS to EU enterprises must have compliance ready not by December 2027, but by the first renewal conversation in mid-2026.
Second: competitors will start using compliance as a differentiator
The first Polish companies to announce full AI Act compliance in 2026 will gain a marketing advantage. “The first HR SaaS provider in Poland with AI Act compliance certification” is a headline. “We are ready” is a sales pitch.
Third: expansion abroad requires compliance regardless of the deadline
Every Polish company planning expansion into EU/UK markets must have compliance ready before entering the market. The UK has a package similar to the AI Act. Germany has local BfDI guidelines. France has the CNIL. No compliance = no expansion.
Fourth: the market for AI Act consultants will overheat in the second half of 2027
The Polish compliance advisory market is small. Currently a dozen or so firms specialize in the AI Act. When thousands of mid-sized and large Polish companies start looking for a partner around July 2027, prices will rise by 40-60%. Today a readiness audit is priced at PLN 12-25k. In 2027 expect PLN 25-50k, plus a 6-12 week delay before the project can start.
The question for the CFO is this: do you want to do compliance under pressure in mid-2027, when consultants are more expensive, clients more demanding, and the market has overtaken you? Or calmly by the end of 2026, with a 12-month buffer for implementation?
What to do now, while it is calm
Phase 1: Inventory of AI systems
The first step is a register. It must include:
AI systems built in-house
AI systems from external vendors (ChatGPT, Copilot, HR tools)
Custom models and fine-tuning
Chatbots on the website and in products
Each entry: system name, vendor, business use, input data, decisions affecting people, scope of users.
Phase 2: Risk classification and role identification
For each system in the register, check:
Does it fall into the 8 high-risk areas from Annex III?
What role do you play: provider (you build it), deployer (you use someone else’s), or both?
Could fine-tuning or custom prompts have changed your role from deployer to provider?
This is the decision point. The obligations follow from the risk map.
Phase 3: Implementation - spread over 12-15 months
A concrete schedule, quarter by quarter, for example:
Q3 2026: AI literacy program, audit of prohibited practices, watermarking procedures for generative AI
Q4 2026: governance framework, an AI usage policy for the organization, AI Act clauses in vendor contracts
Q1 2027: technical documentation for high-risk systems, risk management system
Q2-Q3 2027: conformity assessment, EU declaration, post-market monitoring
Q4 2027: testing of procedures, readiness for inspection
This is not a one-week project. It is 12-15 months of continuous work. And that is exactly why the digital omnibus gave you so much time. Not to postpone, but to do it properly.
What WeAreFuture does on the AI Act
We work with mid-sized and large companies every day. On the AI Act we have a 3-module path:
AI Check - a free online test: 20 questions, about 7 minutes, full results without email. It assesses the company’s AI maturity, including rules for data and risk, and points to three actions to plan. It is not an AI Act compliance audit, but it is a good filter before the first conversation.
AI Act Sprint - approx. 2 weeks. A readiness audit with classification of AI systems, role identification (provider/deployer) and risk assessment. Deliverable: a document with a compliance map and an implementation schedule, ready to present to the board. Pricing depends on complexity: from PLN 12,000 net.
Governance Implementation - 4-12 weeks. Implementation of an AI policy, a governance framework, clauses in vendor contracts, technical documentation for high-risk systems. Pricing depends on the size of the organization. Delivered in cooperation with a partner law firm.
What we do not do
We do not replace your legal department. We work with your lawyers, or with a law firm, not instead of them.
We do not sell panic. If a specific area does not create real business risk for your organization, we say so plainly.
We do not implement compliance theater. Documentation that nobody uses is worse than none at all.
Next steps
If you have been postponing the AI Act on the assumption that the digital omnibus buys you time - read section 3 again.
If you had planned the audit for August 2026 - you can do it now, with a buffer for implementation.
If you want to check in about 7 minutes where your company stands with AI - use our free online AI Check. 20 questions, full results without email. It is an assessment of AI maturity, not an AI Act compliance audit.
If you already know you need a full audit with an implementation roadmap - let’s set up a call. The AI Act Sprint starts with 1-2 weeks and ends with a document for the board.
