EU AI Act and the Digital Omnibus:
What Should Companies Do Now?

What Happened on 26 March 2026?

On 26 March 2026, the European Parliament plenary approved the Digital Omnibus package by 569 votes to 45. Immediately following the vote, the trilogue — the three-way negotiation between Parliament, Council, and Commission — formally opened. The package is based on the text adopted by the IMCO and LIBE committees on 18 March 2026 by 101 to 9 (with 8 abstentions).¹

The Digital Omnibus does not rewrite the EU AI Act; the core framework remains intact. The proposed changes are essentially two things: moving some obligations forward in time, and simplifying certain provisions. But the Parliament vote is not the end of this process — it is the beginning of a new phase. Until the Council, Parliament, and Commission complete the trilogue, no deadline has legally changed.

The Proposed New Timeline

The positions of Parliament and Council largely align. What remains in the trilogue is technical detail — but "technical detail" can sometimes take months.

What Is Not Changing?

Delay headlines can easily become a "relax on AI Act" message. That is not accurate. It is important to be precise about which obligations fall outside the Digital Omnibus scope.

Article 5 prohibitions (in force since 2 February 2025): Subliminal manipulation, social scoring, real-time biometric surveillance in public spaces (with limited exceptions), and emotion inference based on protected characteristics are all prohibited now. The Digital Omnibus does not touch these dates.

Article 4 AI literacy (in force since 2 February 2025): Providers and deployers are required to ensure that persons working with AI systems have adequate AI literacy. The Digital Omnibus proposes to revise the formulation of this obligation (the responsible party and the standard may change) — but no timeline extension is proposed for its application date.²

GPAI model obligations (in force since 2 August 2025): Transparency, technical documentation, and (for systemic risk models) safety evaluation obligations for general-purpose AI model providers under Articles 51–56 apply now. These obligations are outside the postponement scope.

Article 50 transparency obligations (limited risk): Information obligations for chatbots, deepfakes, and emotion recognition systems enter into force on 2 August 2026. The Digital Omnibus proposes to move the content marking date to November 2026 — but no clear postponement is proposed for the other Article 50 provisions.

Impact on Turkish Companies: Three Groups

The EU AI Act does not require registration in the EU. Any organisation that places AI systems on the EU market, or whose AI systems affect users in the EU, falls within scope — whether operating from Istanbul, Ankara, or anywhere else. For companies in Turkey, three distinct situations apply.

Group 1 — Exporting AI products or software to the EU: Turkish companies placing products or software that contain an AI component on the EU market qualify as providers under the EU AI Act. The Annex III postponement directly affects this group — but for companies with ongoing EU sales negotiations, planning to the August 2026 deadline remains the prudent approach until the delay is confirmed.

Group 2 — Providing AI-enabled services to EU customers: If a service delivered from Turkey affects a buyer in the EU, it falls within scope. Deployer obligations apply to this group: human oversight, compliance with usage restrictions, technical documentation requests. The Annex III postponement may defer some of these obligations — but contract requirements may already contain these conditions regardless of regulatory timeline.

Group 3 — Part of an EU supply chain: Turkish firms used as subcontractors by EU companies to develop, test, or process data for AI systems may fall under supply chain obligations (Article 25). For this group, documentation and technical information provision requirements are increasingly significant.

Delay: Opportunity or Trap?

If the Annex III postponement is confirmed, the August 2026 pressure eases considerably. A wider window for planning compliance investments opens. But three things are worth keeping in mind.

First and most important: the delay is not yet confirmed. Trilogue negotiations can stall on unexpected disagreements. If that happens, organisations that planned to December 2027 will find themselves repositioning rapidly for August 2026.

There is also a pressure that operates outside the regulatory calendar: customers and investors. Corporate buyers and institutional investors in the EU are already requesting AI governance documentation — and that demand does not track the European Parliament's vote calendar.

And perhaps most importantly: a delay does not remove obligations — it defers them. 2027 is coming. 2028 is coming. Building regulatory infrastructure is not a quick fix. Those who say "we'll start once the trilogue closes" may find there is not enough time when it does.

What to Do: The ORIENT Framework

Whether or not the postponement is confirmed, the first two stages of ORIENT define what needs to be done today.

Observe: Inventory the AI systems that produce effects in the EU market. Which system affects which customer in which country? Without answering this question, scope analysis is impossible. The Hexis Generator provides a starting point for structuring that inventory.

Risk: Determine the EU AI Act risk class for each system. The risk classification guide walks through the decision tree step by step. Is the system in Annex III scope, or under transparency obligations? Your answer also determines whether the Digital Omnibus postponement affects you at all.

Identify: Separate the obligations already in force (Article 5, Article 4, GPAI) from those arriving in August 2026. Which require preparation now? Which might shift with the Digital Omnibus?

Evaluate → Navigate → Track: After the gap analysis, build a prioritised action plan. Monitor the trilogue outcome; update your plan when it closes. This is not news tracking — it is a systematic Track process. The difference: news tracking means information arrives, a note is made, and it is forgotten. In Track, the outcome becomes a document, and the document becomes action.

Conclusion: Don't Wait — Prepare

If the trilogue closes in May 2026 and the Annex III deadline moves to 2 December 2027, you have a 20-month implementation window. If the trilogue extends and August 2026 arrives as planned, having completed your inventory and risk classification puts you in an advantageous position — not a disadvantageous one.

In either scenario, the starting point is the same: know your systems, determine your risk level, map your obligations. The Digital Omnibus does not change these steps — it only makes the timeline uncertain.

---

Sources

1. Global Policy Watch. MEPs Adopt Joint Position on Proposed Digital Omnibus on AI. March 2026. globalpolicywatch.com

2. European Commission. Digital Omnibus on AI Regulation Proposal. digital-strategy.ec.europa.eu

3. European Commission. Regulation (EU) 2024/1689 — Artificial Intelligence Act. EUR-Lex. eur-lex.europa.eu

4. Addleshaw Goddard. EU Digital Omnibus on AI Update: Council and Parliament Agreed Positions. 2026. addleshawgoddard.com

Note: This article is based on information available as of 3 April 2026. The Digital Omnibus trilogue process is ongoing. This article will be updated when the trilogue concludes. This does not constitute legal advice.