AI Act Digital Omnibus: addressing the deployer gap

An unintentional oversight? The proposed Digital Omnibus on the AI Act contains certain deadline extensions but a key one is missing, suggesting a disconnect between the text itself and the reality that organisations face.

While many other aspects merit discussion (such as the yet unresolved overlap issues between the GDPR and the AI act), there is an important gap in the AI Omnibus proposal – what one might call the “deployer gap”.

Articles 50(2) & 50(4) of the AI Act provide for transparency/labelling obligations for both AI system providers (50(2)) and AI system deployers (50(4)). In practice, as from 2 August 2026, AI-generated or AI-manipulated output has to be detectable/disclosed as such.

The AI Omnibus proposal suggests pushing the deadline for Art. 50(2) compliance (=> for providers) back to 2 February 2027 for systems placed on the market before 2 August 2026. But deployers? Nothing is said about Art. 50(4).

If adopted as is, AI system providers could wait until February 2027 before labelling is required, while deployers (i.e. organisations using third-party AI tools) would be legally required to have their own AI content disclosures in place beforehand. Yet deployer AI content disclosures would quite naturally benefit from provider labelling. Think of the watermarks certain image generators place automatically today – if the watermark exists, deployers’ own obligation to disclose the AI-generated nature of content is also met.

In other words, there might be a 6-month “limbo” period, where providers (= upstream) can wait in theory while deployers (= downstream, who would benefit from provider labelling) must foresee disclosures.

This isn’t pragmatism but putting the cart before the horse, and I hope some will take note of this gap and move to fix it by equally giving more time to deployers.

Yet reactions in general suggest many are not moved by the need for pragmatism – as shown by the topic of AI literacy (Art. 4 AI Act).

In its current form the AI Act pushes the task of educating users onto deployers, i.e. the organisation whose staff/user base uses the AI system, rather than e.g. government/regulators. It’s not a new idea – the GDPR requires something similar re data protection – but it has been translated by many as an obligation to provide all-encompassing training on AI in general.

The Commission’s idea – to transform AI literacy *obligations* for deployers into an obligation for the Commission & Member States to *encourage* AI literacy – is a welcome move away from paternalism.

In my view, a user should understand the opportunities & limitations of a given AI system, but that might be intuitive. Best then to provide a manual + *if someone needs it* training. This seemed to be the AI Act’s initial intent, but its implementation has moved away from that.

Pragmatism for both deployer and provider obligations can make the AI Act a success – perhaps the AI Act Digital Omnibus can be improved to help us get there.