Digital Omnibus Defers High-Risk AI Obligations to December 2027 — Compliance Window Is Narrower Than It Appears

The EU Digital Omnibus Regulation (EU 2026/1744), which entered into force July 27 — five days before the AI Act's main application date — formally shifted Annex III high-risk AI obligations from August 2, 2026 to December 2, 2027, and Annex I embedded high-risk obligations to August 2, 2028. The KLA Digital and Axis Intelligence analyses from late July document the full revised timeline: at least one operational AI regulatory sandbox per Member State is now required by August 2027 (not August 2026), and machine-readable marking requirements for generative AI systems carry their own deferred implementation track. For law firms advising financial services, HR, or professional services clients whose AI systems may qualify as Annex III high-risk — AI used for employment decisions, access to essential services, or administrative proceedings — the December 2027 deadline is a compliance planning anchor, not a reprieve: the technical documentation, risk management, and CE marking obligations take months to build, and firms that begin compliance architecture in Q4 2026 will be ahead of clients who begin in mid-2027. The gap between Article 50 (live) and Annex III (deferred) is also a source of client confusion that law firm AI practices are already fielding.