In June we wrote that the EU AI Act was no longer a framework in progress but law, and set out what high-risk operators would need in place. Since then the timetable has changed, and the change has been widely misread. The deadline that mattered most to compliance teams moved. The obligations that landed this month did not, and neither did the underlying requirement that makes both sets of rules workable.
What the Omnibus Actually Changed
In June 2026 the European Parliament and Council approved the Digital Omnibus, which defers the AI Act's high-risk obligations. The provider requirements in Articles 9 to 17 and the deployer requirements in Article 26 move from 2 August 2026 to 2 December 2027, taking effect once the amendments are published in the Official Journal. High-risk systems embedded in regulated products move further out, generally to 2 August 2028.
That is a substantial deferral affecting the most demanding parts of the Act: risk management systems, data governance, technical documentation, record-keeping, human oversight and the conformity assessment machinery around them. For organisations building credit scoring, employment screening, biometric identification or systems touching critical infrastructure, roughly sixteen additional months is real relief.
It is also the narrowest reading of the news that most coverage adopted, because a deferral of the hardest obligations was reported as a deferral of the deadline. The deadline did not disappear. It split.
What Took Effect on 2 August
The Omnibus left most of the Act's transparency obligations exactly where they were. If an organisation provides EU-facing chatbots or generative AI systems, deploys synthetic media, operates emotion recognition or biometric categorisation, or publishes certain AI-generated content on matters of public interest, the relevant Article 50 duties applied from 2 August 2026.
These obligations are less architecturally demanding than the high-risk regime, which is precisely why they were left in place. They are largely disclosure duties: telling people they are interacting with a machine, marking synthetic content as synthetic, informing individuals when emotion recognition or biometric categorisation is applied to them. No conformity assessment, no notified body.
But a disclosure duty is only as good as an organisation's ability to demonstrate it was discharged. A regulator asking whether AI-generated output was properly marked in March is not asking about current configuration. It is asking what the system did at a specific past moment — and that is an evidentiary question, not a policy one.
The Requirement That Did Not Move
Both halves of the split timetable converge on the same practical need. The deferred high-risk rules are, in substance, record-keeping rules: maintain technical documentation, log system operation, preserve enough of the development and deployment history to show a system behaved as claimed. The transparency rules now in force require showing that disclosures happened when they should have.
Neither can be satisfied retroactively. An organisation that begins constructing its record in late 2027 will have a record starting in late 2027, covering none of the period during which its systems were already operating in the European market and already generating the outputs a regulator may later ask about.
This is the part the deferral does not help with. Sixteen months of additional time to build a compliance function is genuinely useful. Sixteen months of operating without generating the evidence that function will need is a liability that accrues quietly and cannot be repaired by working faster in 2027.
Why the Evidence Has to Be Independent
There is a further problem that neither the original text nor the Omnibus resolves, and it is the one we have returned to across this research. Documentation and logs maintained by an operator are, by construction, under that operator's control. They can be updated, regenerated or reconstructed, and in the ordinary course of engineering they frequently are. Nothing in a conventional logging system distinguishes a record written contemporaneously from one produced later that describes the same event.
For most of the Act's history that gap was theoretical, because enforcement had not begun. It stops being theoretical the moment a supervisory authority asks a firm to substantiate what a system did eighteen months earlier and the only available answer is a document the firm produced itself, after the question was asked.
The fix is not more logging. It is anchoring: committing a cryptographic fingerprint of documentation, model versions, policy configurations and disclosure events to a ledger the operator does not control, at the time those things are true. The underlying material stays private. What becomes verifiable is that the record submitted later is the record that existed then. This is the same property that makes a proof of reserves meaningful and an attestation report merely reassuring.
Where Mintlayer Fits
Mintlayer is a Bitcoin Layer 2 for asset issuance and settlement, anchored to Bitcoin's Proof-of-Work chain. For compliance evidence the relevant properties are finality and operator independence. A commitment anchored to Bitcoin is expensive to alter and does not depend on the continued cooperation or solvency of the party that made it — which is what allows the record to serve as evidence to a regulator years after the system it describes was retired.
Mintlayer Web Services provides that anchoring infrastructure for institutions that need their compliance record to be verifiable rather than merely maintained.
The Omnibus bought European AI deployers time. It is worth being precise about what the time is for. It is not a pause on obligation, since the transparency rules are live now and the high-risk rules will ask about a period that has already begun. It is an opportunity to start generating provable records while the cost of doing so is still a design decision rather than an emergency.
This article is for informational purposes only and does not constitute legal advice. Organisations should consult qualified counsel regarding their obligations under the EU AI Act.
Mintlayer Web Services provides Bitcoin-anchored infrastructure for verifiable compliance records. Learn more →
