Under the Digital Omnibus on AI, which the European Parliament and the Council formally approved in July 2026, high-risk obligations for AI embedded in regulated products under Annex I, including medical devices and IVDs, now apply from 2 August 2028 instead of 2 August 2027. Stand-alone high-risk systems under Annex III move to 2 December 2027. The new dates take legal effect on publication in the Official Journal.
The reason is practical. The harmonised standards that translate the AI Act’s requirements into workable processes are not finished. As of July 2026, standards for AI quality management, risk management, bias, data quality, logging and cybersecurity were at different stages of consultation or approval.
What Did Not Change
- The AI Act still applies. High-risk obligations were deferred, not removed.
- MDR and IVDR are unchanged. The AI Act sits on top of them, and MDCG 2025-6 addresses how the two frameworks interact.
- Some transparency duties are still on schedule. The Article 50 transparency obligations largely proceed from 2 August 2026, which matters if your product interacts with users or generates content.
- Reviewers still ask the same questions. What data trained the model, how it was validated, where it can fail, and what happens when it does.
What Did Change in Substance
Two changes are worth watching. The Commission can now limit specific AI Act requirements where sector legislation such as the MDR already imposes equivalent obligations. And the definition of a safety component was narrowed, so AI used only for user assistance, performance optimisation or convenience is not high-risk simply because it is embedded in a regulated product, unless its failure could endanger health or safety.
Both make it more important to know which of your AI features are actually safety-relevant.
Five Things to Do With the Extra Year
- Inventory every AI-enabled function and classify each one against the high-risk criteria and the narrowed safety-component definition.
- Build one requirements map that links your MDR technical documentation, your ISO 14971 risk file and the AI Act requirements on data governance, documentation, human oversight and robustness.
- Document data provenance now. Where training, validation and test data came from, how it was labelled and who it represents is the hardest evidence to reconstruct later.
- Extend risk management to AI failure modes: drift, performance gaps in subgroups, and out-of-distribution inputs.
- Get an outside look before the notified body does. An independent readiness check against named requirements shows where your evidence is thin while there is still time to fix it.
The extra year is only an advantage if the first six months go to inventory and evidence, not to waiting.
Sources: Gibson Dunn, EU AI Act Omnibus Agreement (May 27, 2026); Danish Standards, Digital Omnibus for AI approved (July 10, 2026); MedDeviceGuide, EU AI Act for Medical Devices (June 10, 2026).