EU AI Act vs AI Omnibus

The first substantive amendment to the EU AI Act since 2024 took effect July 27. Here's what changed, what didn't, and how to prepare for both.

The AI Omnibus gave companies real breathing room on the hardest part of the framework, deferring standalone Annex III systems to December 2, 2027 and product-embedded Annex I systems to August 2, 2028. What it left alone matters just as much, because Article 50 transparency, GPAI enforcement powers, and market surveillance authority all still take effect August 2, 2026 exactly as written. 

Inside you'll find:

• The AI Act as amended: what the Omnibus deferred, what it left in place, and the one Article 50 date that isn't August 2
• Whether Annex III reaches you: recruitment, credit scoring, insurance, and education workflows land in scope even at companies that have never considered themselves AI companies
• 5 priority actions: beginning with an inventory built from procurement records, SaaS spend, and API traffic rather than a self-reported list, since teams routinely stand up AI tools outside any approval process
• How BigID helps: discovering shadow AI, tracing data lineage into and out of AI pipelines, classifying training data, and governing access