EU AI Act Amendments: What They Mean for Responsible AI, Data Governance & Readiness

EU AI Act Amendments: New Compliance Timelines and Strategic Shifts

Updated High-Risk AI Compliance Deadlines

The EU AI Act’s 2026 amendments introduce a significant shift in when organizations must comply with certain high-risk AI requirements. The AI Omnibus entered into force on July 27, 2026, replacing the earlier proposal’s conditional readiness-trigger approach with fixed application dates.

Under the amended EU AI Act, requirements for specified high-risk AI systems listed in Annex III apply from December 2, 2027. Requirements for high-risk AI systems associated with regulated products under Annex I apply from August 2, 2028.

These extensions provide additional preparation time, but they do not postpone every AI Act obligation. Prohibited AI practices and AI literacy provisions became applicable in February 2025, general-purpose AI obligations followed in August 2025, and additional transparency requirements became applicable in August 2026.

What the EU AI Act Amendments Mean in Practice

1. Compliance Timelines Are Extended, Not Eliminated

The amended EU AI Act establishes fixed deadlines for two categories of high-risk AI systems. Requirements for systems classified as high-risk under Annex III, including certain applications involving employment, education, creditworthiness, and law enforcement, apply from December 2, 2027.

Requirements for high-risk AI systems covered by Annex I, including AI associated with certain regulated products, apply from August 2, 2028.

These dates replace the earlier proposal’s six-month and twelve-month readiness-trigger periods. They give organizations additional time to prepare for the applicable high-risk AI requirements, while other AI Act obligations continue on their established schedules.

Organizations should use this additional time to assess AI use cases, document relevant data sources, evaluate risks, and establish governance controls before the applicable deadlines.

2. Targeted Simplifications Reinforce the Importance of Data Governance

The 2026 AI Omnibus introduces targeted changes intended to simplify implementation while maintaining safeguards for safety and fundamental rights. Key amendments include:

• Expanded simplifications for smaller businesses: Certain simplified obligations previously available to small and medium-sized enterprises now extend to qualifying small mid-cap companies.
• Adjusted AI literacy provisions: The amendments simplify the previous AI literacy framework, with the European Commission and Member States taking a stronger role in promoting AI literacy.
• Expanded regulatory oversight: The EU AI Office receives additional oversight responsibilities for certain AI systems, including systems built on general-purpose AI models.
• Broader testing opportunities: The reforms expand regulatory sandbox provisions and opportunities to test AI systems under appropriate safeguards.
• Bias detection and correction: The amendments permit certain processing of special categories of personal data for bias detection and correction, subject to applicable conditions and safeguards.
• Simplified registration: The reforms reduce registration requirements for certain AI systems assessed as falling outside the high-risk classification.

For organizations developing or deploying AI, the operational priority remains clear: understand the data used by AI systems, identify sensitive information, document relevant processing activities, and establish controls that support accountability and risk management.

3. AI Governance and GDPR Require Coordinated Oversight

The EU AI Act and the General Data Protection Regulation (GDPR) establish distinct but overlapping responsibilities for organizations developing or deploying AI systems that process personal data.

While the 2026 AI Omnibus amendments have entered into force, separate Digital Omnibus proposals concerning GDPR and other data protection rules remain subject to the EU legislative process. These proposals address areas such as personal data definitions, pseudonymization, data protection impact assessments, breach notifications, cookie requirements, and the use of legitimate interests in AI-related processing. They should not be treated as changes to existing GDPR obligations unless formally adopted.

For organizations managing AI-related data risks, coordinated governance requires visibility into:

• What personal, sensitive, and regulated data they hold
• Which AI systems access and process that information
• The lawful basis and purpose of relevant processing activities
• Potential privacy, security, and AI-related risks
• Data movement, lineage, retention, and access permissions
• Evidence needed to demonstrate compliance with applicable requirements

Connecting privacy and AI governance processes helps organizations maintain accountability while responding to evolving regulatory requirements.

BigID’s Take: Start Building the Foundation Now

Why Delay Shouldn’t Mean Inaction

Even with delayed timelines, the organizations that will be ready for high-risk AI obligations are the ones investing today in:

• Comprehensive data discovery and classification across all environments
• Data quality and integrity controls
• Governance frameworks for training data, model inputs, and output monitoring
• Clear documentation and auditability
• Automated risk assessments tied to both GDPR and AI Act requirements

BigID helps organizations connect data discovery, classification, risk intelligence, and governance to support AI regulatory readiness across jurisdictions. Request a demo to explore how BigID can help strengthen your AI governance program.

Build AI Readiness on a Strong Data Foundation

The EU AI Act amendments give organizations additional time to prepare for specified high-risk AI requirements, but the need for responsible AI governance is already here.

Organizations that understand their AI systems, the data those systems process, and the risks associated with that data will be better positioned to implement appropriate controls, document governance decisions, and respond to evolving regulatory requirements.

The priority is not simply meeting a future deadline. It is building the data visibility, accountability, and governance processes needed to support trustworthy AI.