On 27 July 2026 the Digital Omnibus Regulation entered into force, five days before the deadline that many companies had spent two years preparing for. The obligations for high-risk systems under Annex III now apply from 2 December 2027 instead of 2 August 2026. For AI in regulated products under Annex I, the date shifts to 2 August 2028.

The headlines turned this into the EU postponing the AI rules. What was postponed is a clearly defined part. The very obligations that affect most companies directly entered into force on time.

What has applied since 2 August

The transparency and labelling obligations under Article 50 apply unchanged. They are not a separate risk class but cut across all systems, including those otherwise considered minimal risk. Four distinct obligations sit behind them:

  • Providers of interactive systems must disclose that a person is talking to a machine.
  • Providers of generative systems must mark outputs as AI-generated in machine-readable form.
  • Deployers of emotion recognition and biometric categorisation must inform the persons concerned.
  • Deployers must label deepfakes and published AI texts on matters of public interest.

The decisive question is therefore not which risk class a system falls into, but whether you are a provider or a deployer. Anyone who makes a purchased model available in their own product can be both at once. In practice this concerns the campaign image from the image generator, the synthetic voice in the service centre and the AI text on a socio-political question.

A detail with consequences for every marketing department: an AI text does not become exempt from labelling because someone later corrects it or smooths out the language.

The next deadline is December 2026, not 2027

For generative systems placed on the market before 2 August 2026, a four-month transition period applies. The machine-readable marking must be in place by 2 December 2026. This affects practically every company that put a generative application into production before this summer.

On the same date, two new prohibitions under Article 5 enter into force. The Omnibus is not a rollback.

The Omnibus also removes systems from the high-risk class

Less noticed, but for some companies the bigger change: the concept of a safety component has been narrowed. Systems that serve solely user support, performance optimisation, automation or non-safety-relevant quality control will in future fall outside the high-risk classification. Mere integration into a regulated product no longer establishes a safety function in itself.

Anyone who has already carried out a classification should therefore review it again. It may come out differently today, and in the company’s favour.

Why this affects Swiss companies

The AI Regulation is not tied to the company’s location but to the market. Anyone who places an AI system on the market or operates one in the EU, or whose system output is used in the EU, falls within its scope. A Swiss software provider with EU customers is covered, as is a Swiss group rolling out a tool across all national subsidiaries.

The pattern is the same as with NIS-2: Switzerland is formally outside and yet, through customers, group structures and contracts, right in the middle of it. Breaches of Article 50 carry penalties of up to 15 million euros or three percent of global annual turnover.

What makes sense now

  • Build an inventory of the AI systems in use, with role assignment: provider or deployer.
  • Anchor labelling in marketing, communications and customer service, rather than deciding case by case.
  • Review disclosure texts in chatbots and assistance systems.
  • Check contracts with AI providers and cloud platforms for labelling and information obligations.
  • Reassess existing high-risk classifications in light of the narrower definition.

The work that comes before any classification stays the same: knowing which AI systems are running in the company, who owns them and which decisions they influence. This question is tied to no deadline, and in most companies it is unanswered. What an AI Governance looks like that orders this without slowing operations, we described in Introducing AI Responsibly.