The EU AI Act Just Slipped: What the Digital Omnibus Means for Marketing Teams

By November 2025 it was clear the EU AI Act rollout wasn't keeping pace: too many technical standards and delegated acts that the high-risk rules depend on were still missing. The Commission tabled the Digital Omnibus, a package that adjusts several digital laws at once. For the AI Act it comes down to one thing. The sharpest obligations arrive later.

If you already know the risk classes, the entry point into AI readiness and data strategy is here. If you're starting fresh, the short version is below.

What changed

The original plan set the high-risk obligations from 2 August 2026 (Annex III) and from 2 August 2027 for AI embedded in regulated products (Annex I). The Omnibus replaces the previously discussed conditional trigger with fixed dates and pushes both back:

• Annex III (stand-alone high-risk systems): from 2 December 2027.
• Annex I (high-risk AI in regulated products): from 2 August 2028.

There's also a substantive addition: a new Article 5 prohibition on AI-generated non-consensual intimate imagery and abuse material. It doesn't touch marketing analytics directly, but it belongs in the full picture.

What stays the same

The high-risk part moved. The rest holds.

• Prohibited practices have been banned since February 2025. Social scoring, manipulative subliminal techniques, real-time biometrics in public spaces. Penalties up to €35 million or 7 percent of global annual turnover.
• General-Purpose AI has carried its own obligations since August 2025. If you run GPT, Claude or Gemini inside tools or products, you fall under them.
• Transparency obligations for most marketing applications remain the practically relevant topic. Chatbots, AI copy and synthetic media have to be recognisable to users.

The new timeline at a glance

What it means for marketing teams

Deferred, not dropped. The extra time is lead time, not a reason to table the topic. If you run Smart Bidding, predictive audiences, lookalike audiences or attribution models, you operate AI systems in the sense of the Act. Risk classification decides which obligations apply, and the delay doesn't change that.

Three things are worth doing now, regardless of the moved deadlines:

• AI inventory. Which AI components sit in the marketing stack, including the invisible ones like Smart Bidding or HubSpot AI?
• Risk classification per use case. Most marketing setups land in Minimal or Limited Risk. Establishing that is cheap and ends the speculation.
• Transparency and documentation obligations. These apply today and are the most common blind spot in an audit.

The benefit of the delay is in the pace, not the scope. Instead of a last-minute exercise before August 2026, there's room to build a clean first-party data architecture as the foundation. That's exactly what any AI use case beyond a compliance checkbox needs.