The Office of the Information and Data Protection Commissioner (IDPC), in its role as Malta’s Market Surveillance Authority (MSA) for high-risk AI systems in law enforcement, mitigation & border control and justice & democracy, draws the attention of the public to the EU Council’s recent adoption of the AI Omnibus legislative package which streamlines aspects of the AI Act and introduces important revisions to the coming into force timelines.

Provisions on high-risk AI systems, originally scheduled to take effect on 2 August 2026, will now apply from 2 December 2027 for standalone systems. This additional grace timeframe aims to ready the market for adequate fundamental rights safeguards, such as data protection.

Further changes affect implementation at national level. The establishment of AI regulatory sandboxes by competent authorities has been postponed by one year, with the new deadline set for 2 August 2027. These sandboxes are intended to support innovation by allowing controlled testing of AI systems under regulatory oversight, while ensuring compliance with EU rules.

Most other AI Act obligations remain on track, such as transparency requirements, mandating providers to clearly label AI-generated or manipulated content, will still enter into force as planned on 2 August 2026. 

The IDPC will continue monitoring developments and supporting stakeholders in understanding and preparing for the evolving requirements under the AI Act.