On 29 June 2026, the Council of the EU gave its final sign-off on the Digital Omnibus, a targeted package of amendments to the EU AI Act (Regulation EU 2024/1689). The path to that vote was long: a provisional political agreement was reached on 6-7 May 2026, following a failed first trilogue attempt the previous week; the European Parliament formally endorsed it on 16 June; the Council confirmed on 29 June. Per the EU Council press release, the legislation enters into force three days after publication in the EU Official Journal, expected in July 2026.
For organisations operating local LLMs, two changes matter most: an extended timeline for high-risk AI compliance and a substantially expanded definition of who qualifies for SME protection.
High-Risk AI Compliance: December 2027, Not August 2026
The Omnibus' headline change is a deferral of compliance deadlines for high-risk AI systems. Based on our reading of available reports from law firms and regulatory trackers including aiactblog.nl:
- Annex III systems (standalone high-risk AI in areas such as employment, credit scoring, education, biometrics, critical infrastructure): new deadline 2 December 2027: previously 2 August 2026.
- Annex I systems (AI embedded in regulated products, medical devices, vehicles, industrial machinery): new deadline 2 August 2028.
This means organisations planning or operating high-risk AI systems gain approximately 16 additional months to implement the full Chapter III requirements: data governance, risk management, technical documentation under Annex IV, human oversight mechanisms, and market transparency obligations.
The practical reason for the extension: harmonised technical standards (CEN/CENELEC) are not yet finalised for many application areas, and national market surveillance authorities are still being established. Parliament and Council chose a structured deferral over enforcement against organisations that had no reliable compliance path yet.
SME Protection Extended to 750 Employees
Until now, the AI Act's simplified compliance pathway applied only to companies meeting the EU's standard SME definition: fewer than 250 employees with annual revenue under €50 million. The Omnibus significantly extends this. According to available reports, companies with up to 750 employees and annual revenue up to €150 million: termed "small mid-caps", now benefit from:
- Simplified guidance from supervisory authorities
- Reduced maximum fines compared to large enterprises
- Access to regulatory sandboxes for testing AI systems in a protected environment
- Standardised documentation templates
This closes a meaningful gap. Companies between 250 and 750 employees were previously treated as large enterprises for compliance purposes while lacking the legal and technical resources of major corporations. For many mid-sized technology and professional services firms across Europe, this is substantive relief.
GDPR and AI Training: Bias Detection Carve-Out
Based on available reports, the Omnibus also addresses a longstanding friction between AI development and GDPR obligations. Under conditions of strict necessity, special category personal data, health records, biometric data, ethnic origin, may now be processed for the purpose of bias detection and correction in AI models. This is not a general licence; it is a narrowly scoped exception conditioned on strict necessity.
Digital policy expert Egle Markeviciute flagged on X the core tension the Omnibus attempts to resolve: making "some air for AI dev in the heavy room of the GDPR" (source). For operators of local LLMs, this tension is largely resolved by architecture: if data never leaves your infrastructure, GDPR cross-border transfer obligations do not arise in the first place.
What Still Takes Effect on 2 August 2026
The deferrals are specific to high-risk obligations. The following proceed on their original schedule:
- Art. 5, Prohibited practices: in force since 2 February 2025, no change
- Art. 4, AI literacy: an obligation since 2 February 2025, enforceable by authorities from 2 August 2026: organisations must ensure staff who use AI systems have appropriate, verifiable training
- Art. 50, Chatbot disclosure: AI systems interacting with users must identify themselves as AI at the start of the interaction, see our 8 July article for implementation detail
- Chapter V, GPAI obligations: providers of general-purpose AI models face transparency and documentation requirements from August 2026
If your organisation uses a third-party GPAI model via API, you are a deployer under the Act and need to track what your providers disclose. Running a local open-weight model means the GPAI obligations fall on the original model developer, not on you as an internal deployer.
What This Means for Local LLM Operators
The most important clarification: most internal local LLM deployments are not high-risk under Annex III. A language model such as Llama 3.3, Qwen 2.5-72B, or Mistral-Small-3.1 running on your own hardware for internal document search, meeting summarisation, email drafting, or internal Q&A is not a high-risk AI system under Annex III.
High-risk classifications are exhaustive and specific: autonomous hiring and firing decisions without human review, automated credit scoring used to determine credit access, biometric identification, law enforcement applications, border control. If your local deployment does none of those things, the December 2027 deadline does not apply to you directly.
SMB Action Checklist
Before 2 August 2026:
- Inventory all AI systems in use, internal tools and external SaaS services
- Classify: does any fall into a high-risk Annex III category?
- AI literacy training (Art. 4): roll out verifiable training for staff who use AI systems
- Chatbot label (Art. 50): if you operate any customer-facing AI interface, implement the disclosure label
Before December 2027 (if high-risk systems are in scope):
- Data governance documentation (Art. 10)
- Risk management system (Art. 9)
- Technical documentation (Annex IV)
- Logging and post-market monitoring infrastructure
Starting a local AI pilot now? Build documentation habits from day one, the data trail created during a pilot is precisely what a 2027 compliance submission will draw on.
Local AI as Compliance Architecture
The EU AI Omnibus buys time. It does not remove obligations. Organisations that treat the deadline extension as a reason to delay foundational decisions will face the same compliance crunch in 2027, with less runway and more scrutiny.
Local LLMs carry a structural compliance advantage: no data crosses borders, no third-country adequacy assessment is needed, no standard contractual clauses are required. If your AI systems run on your own data infrastructure, an entire category of data protection risk is simply not in scope. That is not a side benefit, it is a direct consequence of the architecture decision.
Not sure whether your AI use case qualifies as high-risk, or want to structure a compliant local deployment from the start? Reach out to our team, we work with SMBs and mid-caps on privacy-first, locally deployed AI.