The EU AI Act after the Omnibus: what’s changed for UK firms

In July 2026 the EU adopted the "AI Omnibus", a package of changes to the EU AI Act. Headlines called it a delay. That’s partly true, but it’s not the whole story, and it doesn’t mean AI governance can wait.

Here’s what this means for your business.

First: does the EU AI Act apply to a UK firm?

It can. The AI Act reaches beyond the EU. It can apply to you if you place AI systems on the EU market, or if the output of an AI system you use is used in the EU. If you have EU clients, EU offices or EU-facing services, it’s worth checking.

Even where it doesn’t apply directly, it is shaping what clients, insurers and partners expect. Many will ask EU-style questions regardless of where you’re based.

What changed

The AI Omnibus (Regulation (EU) 2026/1744) entered into force on 27 July 2026. The main changes:

• High-risk AI (stand-alone systems) moved back. Obligations for high-risk uses such as recruitment and employment decisions, education, and creditworthiness assessment now apply from 2 December 2027, not 2 August 2026.
• High-risk AI built into regulated products moved back further. AI inside products already covered by EU product safety law (such as machinery or medical devices) now has until 2 August 2028.
• AI literacy was softened. Article 4 originally required organisations to ensure a sufficient level of AI literacy among staff. It now requires them to take measures to support AI literacy, with the Commission and Member States providing help.
• New prohibitions were added. AI systems that generate realistic intimate imagery or child sexual abuse material are banned from 2 December 2026.

What didn’t change

• Prohibited practices have applied since February 2025 and still do.
• Transparency obligations apply from 2 August 2026 as planned. This covers telling people when they’re interacting with an AI system and labelling deepfakes and certain AI-generated content.
• General-purpose AI model rules continue on their original timetable.

What this means for UK firms

The delay buys time for high-risk use cases. It doesn’t remove the need to know where AI sits in your business. In practice:

1. Know what you use. You can’t decide whether something is high-risk if you don’t know it’s there.
2. Check your high-risk exposure. If you use AI in hiring, performance management or credit decisions, the 2027 date is now your planning horizon.
3. Keep training going. The literacy duty is softer, but the reason for it hasn’t gone away. People who understand AI use it better and more safely.
4. Watch the UK picture too. There is no UK AI Act, but the Data (Use and Access) Act 2025 changed the rules on automated decision-making from February 2026, and the ICO is preparing a statutory code on AI.

The calm view

Regulation will keep moving. Dates will shift again. The firms that handle this well aren’t the ones chasing every update. They’re the ones with a clear picture of their AI use and a simple way to keep governance current.

TURMA Assured is built for that rhythm: policies, controls and evidence that update as the rules change, so you’re ready when someone asks.

This article is general information, not legal advice. Last reviewed October 2026.