The Digital Omnibus has rewritten the AI Act timeline: obligations for high-risk AI are pushed back to 2027 and 2028, while prohibitions, transparency and penalties are already in force. In this updated guide we look at what changes for manufacturing companies and how to use the extra time to get ready.
For months, 2 August 2026 was cited as the date on which the AI Act would become fully binding. With the Digital Omnibus on AI, which entered into force on 27 July 2026, the European Union revised the deadlines for high-risk systems and simplified some obligations. The result is not a halt, but more time to do things properly.
For a manufacturing company, implementing safe AI means building transparency and robustness requirements directly into the production workflow. And the right time to start is still now.
What is the AI Act
The AI Act (EU Regulation 2024/1689) is the world’s first comprehensive law on artificial intelligence. It aims to ensure that AI systems used in the Union are safe, transparent and respectful of fundamental rights, and introduces a legal framework based on risk classification.
Unlike other technology regulations, the AI Act does not regulate the technology “as such”, but its specific uses. This means the same algorithm can be minimal-risk when used to filter spam email, or high-risk when used as a safety component or to assess people at work.
What does it concretely mean for businesses?
The AI Act brings a paradigm shift on three fronts:
- Mandatory classification: every company must map its software to determine whether it falls into the “unacceptable” (prohibited), “high”, “limited” or “minimal” risk categories.
- Conformity and marking: for high-risk systems, conformity becomes a legal requirement for sale and use, following a logic similar to CE marking.
- Data governance: you must be able to show how the AI was trained and how data is managed, minimising the risk of wrong decisions that could cause physical harm or discrimination among workers.
In short, the AI Act moves artificial intelligence from experimental development into a regulated environment, where accountability is the central pillar.
Digital Omnibus: the new AI Act timeline
The AI Act applies in phases. Here are the dates to keep in mind after the Digital Omnibus:
- 2 February 2025: the bans on unacceptable-risk practices, such as emotion recognition in the workplace, and the AI literacy obligation apply.
- 2 August 2025: the obligations for general-purpose AI (GPAI) models and the penalty regime apply.
- 2 August 2026: the transparency obligations of Article 50 apply, for example informing people when they are interacting with an AI system. For the marking of generated content, systems already on the market before this date have until 2 December 2026.
- 2 December 2027: the obligations for the high-risk systems listed in Annex III apply (including employment and worker management, critical infrastructure and education).
- 2 August 2028: the obligations apply for high-risk systems embedded in products covered by the EU legislation listed in Annex I.
A postponement is not a suspension: penalties remain those set out in the regulation, up to EUR 35 million or 7% of annual worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for other obligations. And adapting processes, suppliers and documentation takes months, not weeks.
Are you a “Provider” or a “Deployer”? The chain of responsibility
One of the most common mistakes in factories is assuming that all responsibility lies with the software provider. The AI Act clearly distinguishes the roles:
- Provider: whoever develops the AI system or places it on the market. It has the heaviest obligations: conformity assessment, technical documentation and post-market monitoring.
- Deployer: the manufacturing company that uses AI in the factory. It must use the system according to the instructions, ensure the quality of input data and, above all, guarantee human oversight.
Watch out: if your company substantially modifies an AI system bought from a third party, for example to adapt it to a specific line, you could be considered a “Provider” and inherit its obligations.
Identifying high-risk AI
An AI system can be high-risk in two ways: because it is a safety component of a product covered by the EU legislation listed in Annex I, or because it is used in one of the areas in Annex III, including worker management.
Critical examples in manufacturing:
- Safety and robotics: algorithms that perform safety functions on machinery, such as managing the trajectory of collaborative robots when people are present. For these cases the reference is the Machinery Regulation (see below).
- HR and people management: software that evaluates operators’ performance, assigns tasks based on personal characteristics or monitors behaviour. These fall under Annex III; emotion recognition in the workplace is prohibited.
- Critical infrastructure: AI systems used as safety components in the management and operation of the supply of electricity, gas, water or heating.
By contrast, an algorithm that optimises scheduling or suggests maintenance work, without performing safety functions or making decisions about people, generally does not fall into the high-risk category. However, the classification must be checked case by case.
AI Act and the Machinery Regulation (EU 2023/1230)
The new Machinery Regulation applies from 20 January 2027 and already provides specific procedures for safety components with self-evolving behaviour, based for example on machine learning. With the Digital Omnibus, products that fall under the Machinery Regulation are largely excluded from the direct application of the AI Act: AI-related health and safety requirements are defined within the machinery legislation.
For those who build or integrate machinery, therefore, the main reference becomes the Machinery Regulation. “Safe AI” must be tested not only as software, but as a component that meets the machine’s functional safety standards.
The 5 Technical Pillars for Operational Compliance
For high-risk systems, and as good practice for all the others, the company should focus on these pillars:
- Data Governance: the datasets used for training and fine-tuning must be relevant, representative and as free of errors as possible. In the factory, this means tracing the origin of every piece of sensor data.
- Automatic logging: the system must generate logs that make it possible to reconstruct the decisions taken by the algorithm. Traceability is at the heart of accountability.
- Transparency: people working on the line must understand why the AI flags an anomaly. Clear instructions for use are part of the obligations for high-risk systems.
- Robustness and cybersecurity: the AI must withstand manipulation attempts, such as data poisoning, that could alter production parameters.
- Human-in-the-loop: it must always be possible for a person to stop the system or override its decision.
The Human Factor: AI Literacy
Article 4 of the AI Act requires providers and deployers to develop the AI skills of the staff who work with these systems. The obligation has applied since 2 February 2025, and the Digital Omnibus has made it more flexible: companies must take measures to develop these skills, rather than guarantee a specific level. This is not just technical training, but awareness of the risks and limits of the technology: an aware team remains the first line of defence against non-compliance.
What to do now: the roadmap to 2027
- Inventory audit: map every piece of software that uses AI logic, not just the tools “sold” as AI.
- Check prohibitions and transparency: check right away that no system falls among the prohibited practices and that the Article 50 obligations, which already apply, are being met.
- Gap analysis: identify the systems that fall into the high-risk category and those covered by the Machinery Regulation.
- Vendor assessment: ask your industrial software suppliers for their compliance plans and the documentation available.
- Regulatory sandboxes: if you develop AI in-house, consider access to national sandboxes to test systems in a protected environment before release.
Compliance as a Competitive Advantage
The AI Act is not a “necessary evil”, but the framework that will build trust in the market. Postponing the deadlines does not reduce the work to be done: it makes it easier to plan. Those who use this time to map their systems, train their people and align their suppliers will be able to offer partners a transparent and secure supply chain without last-minute scrambles.
At AzzurroDigitale we support companies along this journey, turning regulatory constraints into operational excellence.
Frequently asked questions (FAQ)
What is the AI Act?
It is EU Regulation 2024/1689, the first comprehensive law on artificial intelligence. It does not regulate the technology itself but its uses, classifying AI systems by risk: unacceptable (prohibited), high, limited or minimal.
When do the obligations for high-risk AI systems apply?
The Digital Omnibus, in force since 27 July 2026, postponed the deadlines: the obligations for the high-risk systems in Annex III apply from 2 December 2027, and those for systems embedded in products covered by Annex I from 2 August 2028.
Does the AI Act apply to industrial machinery?
With the Digital Omnibus, products that fall under the Machinery Regulation (EU 2023/1230) are largely excluded from the direct application of the AI Act: AI-related safety requirements are defined within the machinery legislation, which applies from 20 January 2027.
What is the difference between a provider and a deployer?
The provider develops an AI system or places it on the market; the deployer is whoever uses it in their own business, such as a manufacturing company adopting it on the shop floor. The two roles have different obligations, and it is important to understand which one you hold for each system.
How do you prepare for AI Act compliance?
The first step is to map the AI systems in use and classify their risk, then define data governance, documentation and human oversight, and train your people. To set up a structured adoption path, read our practical guide to AI in manufacturing.