If your compliance plan for this year rests on the sentence "the EU delayed everything", you are working from the wrong calendar. The digital omnibus delayed one category of AI Act obligations, the high-risk rules, and nothing else. The AI transparency duties, the European Accessibility Act, and India's DPDP timetable all held exactly where they were. Three of those dates have already passed, and the next two arrive within twelve months.
Delay headlines travel further than the fine print. A founder who skimmed the coverage in May could reasonably conclude they had until December 2027. For most product teams, the binding dates are much closer.
The AI Act delay was real, but narrow
On 7 May 2026, EU legislators reached a provisional agreement on the digital omnibus that pushed high-risk obligations for standalone Annex III systems from 2 August 2026 to 2 December 2027, and high-risk AI embedded in regulated products to 2 August 2028. That was the delay everyone read about.
What the omnibus did not touch is the rest of Regulation 2024/1689. Prohibited practices and AI literacy duties have applied since 2 February 2025. General purpose AI model obligations have applied since 2 August 2025. And the Article 50 transparency duties, covering chatbot disclosure, machine-readable marking of generated content and deepfake labelling, applied on 2 August 2026 as originally scheduled. The Commission's guidelines on Article 50 spell out what that means in practice. Any chatbot, generated image or synthetic voice in front of EU users is in scope today, with fines of up to 15 million euros or 3 percent of worldwide turnover.
The chart above is the whole argument in one image. Two amber bars moved. Six navy ones did not, and the dashed line shows how many are already behind you.
The accessibility deadline passed while nobody was watching
The European Accessibility Act has applied to products and services placed on the EU market since 28 June 2025. That covers e-commerce, banking apps, e-books, ticketing and most consumer-facing software. There was no omnibus for accessibility, no stop the clock, no grace announcement.
Enforcement is now the story. The first year of EAA enforcement has brought lawsuits in France, active market surveillance by the Dutch regulator, and formal information requests sent to companies well outside the EU. Two follow-on dates are fixed in the directive itself: service contracts concluded before June 2025 must comply by 28 June 2027, and the long transition for legacy self-service terminals runs out in 2030. If your product sells into Europe and has never had an accessibility audit, you are not early any more. You are late with company.
India's DPDP clock started in November and has not paused
India's data protection regime moved from statute to enforcement when the DPDP Rules were notified on 13 November 2025. The rollout is phased and the phases are dated. The Data Protection Board provisions took effect immediately. Consent manager registration opens at the twelve month mark, in November 2026. The core business obligations, covering notice, consent, breach reporting, retention and children's data, all bind from 13 May 2027.
That final date sounds distant until you map it against engineering reality. Consent flows, retention schedules and breach-response plumbing are quarters of work, not weeks, and teams that treat May 2027 as a start date will repeat the GDPR scramble of 2018. This is where a structured review earns its keep: a short engagement on AI deployment, scaling and governance maps which obligations attach to which product surface, so the work lands in the roadmap instead of in a panic.
FAQ
Which compliance dates actually moved in 2026?
Only the EU AI Act high-risk obligations: standalone Annex III systems to 2 December 2027 and high-risk AI in regulated products to 2 August 2028. Transparency, accessibility and DPDP dates all held.
Do these rules apply to companies outside the EU or India?
Yes, if your product or its output reaches users there. The AI Act, the EAA and the DPDP framework all follow the user, not your registered office.
What is the most urgent date right now?
Article 50 transparency and the EAA are already in force, so those are remediation, not planning. The next fixed milestones are DPDP consent manager registration in November 2026 and full DPDP obligations on 13 May 2027.
Five checks before you trust any delay headline
1. List every regulation that touches your product, then find each date in the legal text, not the coverage.
2. Separate what is already in force from what is pending, and treat the first group as live risk.
3. Confirm which AI Act tier your systems fall into, because only the high-risk tier moved.
4. Book an accessibility audit if you sell digital services into the EU and have not had one.
5. Put DPDP consent, retention and breach work into the next two quarters of your roadmap.
If that list surfaced more red than you expected, BeyondPixl Studio runs compliance-mapping sprints that turn these dates into a sequenced engineering backlog. Book one before the November DPDP milestone and walk into 2027 with the work already scheduled.