The immediate legal change is settled, even if many operational questions are not. The European Commission says the Digital Omnibus on AI entered into force across the EU on 27 July 2026, after a political agreement in May 2026 and the European Parliament’s first-reading vote on 16 June 2026. That matters because it shifts the live question for companies and regulators from whether the amending law exists to which obligations now have later application dates and which institutions still need to build capacity (Commission news, Digital Rulebook overview, Parliament OEIL summary).
The clearest practical effect in the available record is timing. According to the Commission, rules for high-risk AI systems listed in Annex III now apply from 2 December 2027, while rules for high-risk AI embedded in physical products covered by Annex I apply from 2 August 2028 (Commission news). The Parliament’s 16 June 2026 summary describes the same postponement and says its purpose was to allow standards and support measures to be put in place (Parliament OEIL summary). For firms, that is a real change in legal timing, but not proof that the compliance machinery behind those dates is already ready.
That distinction matters because the public pages here are not the whole implementation record. The Commission’s news item and Digital Rulebook page confirm entry into force and the broad direction of the amendments, but they do not provide article-by-article legal wording, an Official Journal citation in the briefed material, or evidence that harmonised standards, national designations or enforcement decisions were already in place by 31 October 2026 (Commission news, Digital Rulebook overview). Readers should therefore separate a binding amendment to the timetable from any assumption that supervision is fully operational in every member state.
The second significant change is institutional. The Commission says the AI Office receives extended oversight of certain AI systems, including some built on general-purpose models and embedded in large online platforms and search engines (Commission news). The Parliament summary adds more texture: it says Parliament strengthened the AI Office role by giving it exclusive competence over certain AI systems built on general-purpose AI models within the same undertaking, plus market-surveillance powers for systems within its remit (Parliament OEIL summary). The practical reading is not that Brussels now enforces the whole AI Act alone, but that a narrow category of systems may face more direct EU-level supervision while national authorities remain central elsewhere.
Member states still have work to do. The Parliament summary says each country must ensure at least one national AI regulatory sandbox is established and operational by 2 August 2027, and that the AI Office may set up a Union-level sandbox (Parliament OEIL summary). The Commission also says measures once reserved for SMEs are extended to small mid-cap companies and that access to sandboxes is expanded (Commission news). That offers a support route for developers, but it is still a future implementation milestone, not evidence that those facilities were functioning everywhere by the end of October 2026.
So the near-term checklist is narrower than the politics around the Omnibus suggests. Companies should watch for the standards and supervisory documents that turn later dates into concrete compliance planning; national authorities should watch the sandbox deadline and the division of responsibilities with the AI Office; and readers should treat any claim of fully active enforcement cautiously unless it is backed by a current, specific record. The available EU documents establish that the timetable changed and the AI Office role widened. They do not yet establish that the full enforcement architecture is complete across the Union.
