On June 16, 2026, the European Parliament adopted the Digital Omnibus package. In plain English: Europe is not throwing the AI Act in the trash. It is refining it to close gray areas and keep companies from hitting a last-minute compliance wall.
For an SME or Mid-Market Enterprise that develops, integrates, or resells AI components, the good news is straightforward: the timeline is becoming more manageable. Some obligations for certain high-risk systems are being rescheduled or tied to the availability of standards, guidance, and tools. In other words: less panic, more planning.
The SME Opportunity
The Digital Omnibus does not remove the rules, but it makes them more workable. And for a business that does not have an army of in-house lawyers, that is far from trivial.
- You gain time: 2026–2027 deadlines can be handled with a real execution plan instead of a last-minute sprint.
- You reduce administrative overhead: some registration obligations are simplified or clarified when the risk is limited.
- You clarify roles: when you reuse a foundation model from a third party, it becomes easier to separate what belongs to the vendor and what belongs to the integrator.
- You secure your roadmap: AI Act alignment can now happen alongside product decisions, not after the fact.
Practically, this opens an ideal window to audit your use cases, clean up your documentation, and decide what should be kept, fixed, or retired before the major deadlines close in.
The Watchout
Be careful not to mistake breathing room for a free pass. The Digital Omnibus does not mean “fewer constraints,” it means “better framed.” The core obligations are still there: risk analysis, human oversight, data quality, technical documentation, and traceability.
The classic trap? Treating compliance like a puzzle: a bit of GDPR here, a bit of AI Act there, then a slice of cybersecurity in the middle. The result: inconsistent files, blurry accountability, and hidden costs that explode at the first audit or incident.
Another point to watch: turnkey AI solutions can feel reassuring at first, but they often create technical and contractual lock-in. If you do not have access to logs, metrics, or evidence of risk control, you will not be able to demonstrate compliance properly.
The Compliance Checkpoint
If your AI systems process personal data, the issue also falls under the GDPR and, for Swiss organizations or companies operating from Switzerland, the Swiss FADP. The right move is not to multiply documents, but to align your analyses: your AI Act mapping should speak to your GDPR impact assessments, so you avoid duplication and cover both data risk and system-behavior risk.
For companies targeting the European market, the AI Act’s extraterritorial reach remains a serious issue: the Digital Omnibus does not remove obligations, it simply puts them back in order.
Conclusion & Cohesium's Support
The Digital Omnibus gives teams valuable breathing room, but it is not a license to procrastinate. For SME leaders, the right move now is to turn this clarification into an operational advantage: map use cases, identify high-risk areas, lock down vendor contracts, and build a clear AI governance framework.
Instead of improvising, Cohesium AI can perform Strategic Audits of your AI projects against the AI Act and the Digital Omnibus, support Custom Integration, prioritize compliance gaps, and help you choose a more sovereign, more robust architecture.