... Digital Omnibus on AI on 16 June 2026, by 423 votes to 57 with 174 abstentions, after a trilogue deal on 7 May. It sets fixed later dates for the high-risk regime: 2 December 2027 for stand-alone Annex III systems, 2 August 2028 for high-risk AI embedded in regulated products. It extends some SME simplifications to small mid-caps, eases registration for non-high-risk systems, and adds a new prohibition on AI generating non-consensual intimate ... ... content and CSAM. That's the headline, and for a small subscription app it is almost entirely irrelevant, because you were probably never building an Annex

... most people reading this, and the coverage around it said the opposite. Here's what happened. The Digital Omnibus was published in the Official Journal on 24 July and entered into force on 27 July. It pushed the Annex III high-risk regime hiring, credit scoring, education, essential services from 2 August 2026 out to 2 December 2027, and high-risk systems embedded in regulated products to 2 August 2028. That is a real deferral and it got written ...

... onto a horizontal GRC platform like Drata or Vanta that wasn't built for it. There's no opinionated, 42001-native SaaS. So I built one. What's in the product: versioned Statement of Applicability across all 38 Annex A controls. AI Impact Assessments structured per ISO/IEC 42005. Management-review packs auto-aggregating Clause 9.3.2's actual 5 inputs (not the 9 most consultants cite). Internal audit programme with per-clause checklists. Surveillance changelog against any baseline date. Read-only ...

... everyone I just launched the AI Governance Toolkit for the EU AI Act , built for teams, consultants and enterprises who need to operationalise compliance without drowning in legal complexity. The toolkit includes: Full classification logic (territorial scope, Art. 5, Annex III, GPAI, sector overlays) High-risk compliance engine (Annex

... Vendors offering AI governance , audits, DPIA/FRIA, logging/monitoring, CE-readiness Signals we track (with source links). Hiring: AI governance / risk / compliance roles New AI policies/charters or transparency pages RFPs / vendor questionnaires mentioning AI Act controls Product changes that likely trigger Annex III (HR, credit/insurance, biometrics, education, essential services) Mentions of FRIA/DPIA, logging, post-market monitoring What you get. Lead cards: Company Country Sector Likely trigger (Annex