The EU's Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and came into force on 27 July. It postpones the main high-risk obligations of the EU AI Act. Requirements for stand-alone high-risk systems listed in Annex III, which include credit scoring and some uses of AI in insurance and employment, now apply from 2 December 2027 rather than 2 August 2026. Obligations for AI embedded in regulated products move to 2 August 2028.
Not everything has moved. The transparency obligations in Article 50, including telling people when they are interacting with an AI system, still applied from 2 August 2026, with a short grace period to 2 December 2026 for machine-readable marking of AI-generated content in systems already on the market. The obligations on general-purpose AI models have applied since August 2025. The AI literacy duty has been softened: firms must take measures to support AI literacy rather than ensure a sufficient level for every individual.
Why the delay matters less than it appears
For UK firms with EU operations or EU customers, the delay gives more time to prepare for conformity requirements. For UK financial services firms more generally, it changes very little, because the most important expectations of AI governance do not come from the EU AI Act. They come from existing UK regulation.
Model risk. The PRA's supervisory statement SS1/23 on model risk management has applied to banks with internal model approval since May 2024. It covers AI and machine learning models, and it sets clear expectations for model inventories, tiering, validation and governance.
Consumer Duty. Where AI drives decisions about pricing, eligibility, affordability or customer support, firms must be able to show that those decisions deliver good outcomes, including for customers with characteristics of vulnerability. An algorithm that produces poor outcomes for a group of customers is a Consumer Duty issue whether or not it is classified as high risk in Brussels.
Accountability. Under SM&CR, the use of AI does not dilute individual responsibility. A Senior Manager accountable for an area in which AI is used must be able to show they took reasonable steps to understand and control the associated risks.
Operational resilience and third parties. Many firms' AI capability depends on a small number of external model and cloud providers. Those dependencies need to be mapped and managed in the same way as any other material third-party arrangement.
What good looks like now
The firms making the most progress have stopped treating AI governance as a separate compliance project. They have a complete inventory of AI and automated decision-making in use, including generative AI tools and AI embedded in vendor products. They tier those uses by impact. They apply proportionate validation and monitoring, and they have a clear line of accountability from each material use to a named Senior Manager. Crucially, they can explain to a regulator or a customer how a material decision was reached.
Where internal audit fits
Internal audit should not wait for the EU deadlines to begin covering AI. A governance review that tests the completeness of the AI inventory and the effectiveness of oversight is a natural starting point, followed by targeted reviews of the highest-impact models. Generative AI deserves specific attention: staff use of public tools, data leakage and the controls around AI-generated content are areas where policy often runs well ahead of practice.
Getting specialist support
We provide independent audit and assurance over AI governance, model risk and algorithmic fairness, aligned to FCA and PRA expectations. If you need to bring AI into your audit plan or want an independent view of your current framework, we are happy to have a practical conversation.
