The Digital Omnibus Passed. Here’s Why UK SMEs Still Can’t Afford to Wait.

On 7 May 2026, a political agreement was reached on the EU’s Digital Omnibus package. Within hours, the headlines landed: the high-risk AI system deadline has been pushed back. December 2027 for most Annex III categories. August 2028 for product-integrated systems.

LinkedIn lit up. Compliance teams exhaled. And a significant number of UK SMEs quietly decided they could put this on the back burner.

That would be a mistake.

The Digital Omnibus extended the deadline for high-risk AI system conformity assessments — the formal process by which organisations using AI in areas like recruitment, credit scoring, biometrics, and critical infrastructure must demonstrate compliance with Chapter III of the EU AI Act.

That’s a meaningful delay for companies operating in those specific high-risk categories who haven’t yet completed their conformity assessments. For them, the breathing room is real.

But that is the extent of what changed.

The 2 August 2026 deadline for transparency obligations stands. If your business uses a chatbot, generates AI content, or deploys AI to interact with customers in any way, you are required to disclose this. That obligation has not moved.

Article 4 — the AI literacy requirement — has been in force since February 2025. Every organisation using AI in a professional context must ensure their staff have a sufficient level of AI literacy. That requirement is already active and already enforceable.

The obligation to document what AI systems your business uses? Not extended. The requirement to have a human oversight policy in place? Not extended. The expectation that your organisation can demonstrate to a regulator what AI it uses, why, and how it governs it? Not extended.

The Omnibus changed the timeline for one tier of one category of obligations. The underlying framework — document, govern, disclose — remains intact and remains on schedule.

The most dangerous outcome of the Omnibus announcement is not that businesses misread the specific provisions. It’s that the headlines create a generalised sense that the pressure is off.

It isn’t.

Regulators across EU member states are actively standing up their enforcement infrastructure ahead of August 2026. The first enforcement actions will make examples. And the organisations most at risk are not the ones operating in bad faith — they’re the ones who saw a headline, relaxed, and never built the baseline documentation that would have taken them an hour to put in place.

Regardless of which tier your AI use falls into, the following apply to your business today:

• An AI systems register — a record of every AI tool your organisation uses, what it does, and who is responsible for overseeing it.
• An AI Acceptable Use Policy — governing how your team is permitted to use AI tools, what data can and cannot be processed, and what happens when something goes wrong.
• An AI Transparency Notice — telling your customers and users when and how AI is involved in their interactions with your business.
• A Human Oversight Policy — documenting how your organisation ensures humans remain in control of AI-influenced decisions.
• An AI Literacy record — evidence that your team has received appropriate AI literacy training or briefing.

The Omnibus gave high-risk system operators more time to complete their conformity assessments. It did not give every SME permission to stop preparing.

The clock got longer for some. The obligation stayed the same for all.

If you haven’t started yet, now is still the right time. Not because the deadline is imminent — but because the documentation you put in place today is the evidence that protects you tomorrow.

Not sure where you stand? Take the free two-minute compliance risk check at clausely.co.uk/compliance-checker.

Ready to get compliant? Get your tailored documents within the hour from £399 at clausely.co.uk/pricing.