EU AI Act After the Digital Omnibus: The 2026–2028 Build Plan for One Evidence Layer Across Europe

The EU AI Act high-risk deadline slipped to December 2027. National enforcement did not. Here is how to turn 14 months into one system that every regulator, buyer and works council can read.

A procurement team in Munich, a works council in Milan and a regulator in Paris each ask how your AI system reaches its decisions. You answer all three from the same evidence, without three separate scrambles.

That is the outcome worth planning for. The Digital Omnibus on AI (Regulation 2026/1744, in force since 27 July 2026) makes it reachable, but only if you treat the delay as build time.

New here? Start with EU AI Act Compliance Is an Engineering Problem. It covers inventory, logging and oversight basics. This article starts where that one ends.

What the Omnibus Quietly Changed

Most coverage says “high-risk rules slip to December 2027.” Three smaller changes matter more for planning.

AI literacy was rewritten, not removed. Article 4 no longer demands a specific literacy level, but you must still take measures. National authorities have enforced it since 2 August 2026, and the Commission says an internal training record is enough.

Two new bans apply from 2 December 2026. They cover systems that generate non-consensual intimate imagery or child abuse material. Providers must be able to show their technical safeguards work.

Bias testing got a legal footing. A new Article 4a allows special-category data to be processed to detect bias, under safeguards, without making bias testing mandatory.

The Fresh Perspective: One Regulation, Many Enforcers

The AI Act applies directly in every Member State, so the text reads the same everywhere. Enforcement does not.

• Germany is operational. The KI-MIG law took effect on 29 July and names the Bundesnetzagentur as market surveillance authority.
• France is still waiting. Its authority structure sits in a bill with no committee text as of early October.
• Italy moved first. Legislative Decree 179/2026, in force since 23 October, reserves dismissals and sanctions for a human with real authority and makes breaching decisions null and void.

The risk is not missing one EU date. It is building to the minimum text and then meeting a national rule that is stricter in practice. The answer is one core system with country overlays, not three programmes.

What Companies Are Doing Now

Research shows governance trailing ambition:

• A Coface barometer of 900 decision-makers found 60% of French companies have no formal AI framework, and only 17% have a communicated policy. It is self-reported, but the direction is clear.
• Many enterprises deferred readiness work expecting a delay. The delay came and the work is still undone.
• Standards arrive one at a time. EN 18286, the quality management standard, was cited by Commission Decision 2026/2274 on 12 October and gives providers a presumption of conformity for Article 17. Standards for risk management, documentation and logging are still to come.

Our Technical View: Treat Evidence as a Data Product

Most compliance programmes produce documents. Documents go stale the day after sign-off. At Incresco we build evidence as a data product: structured, versioned, queryable and generated by the systems themselves. Four patterns do most of the work.

1. One System Record, Many Regulators

Each AI system gets a single machine-readable record. Country rules become overlays on that record, not new records.

system_id: hr-screening-assist-07
role: deployer
risk_class: annex_iii_employment
art_6_3_exception: { claimed: false, rationale_ref: doc/1182 }
owners: { business: head-of-talent, engineering: platform-ai }
jurisdictions: [DE, FR, IT]
oversight_points: [shortlist_review, final_offer]
log_retention_days: 365
overlays:
  IT: { final_decision_by: human_with_authority, explanation_on_request: true }
  DE: { regulator: bundesnetzagentur }

A new national rule then becomes a configuration change, not a new project.

2. Decision-Event Logs That Prove Human Authority

Italy’s rule shows why generic application logs fail. You must show who decided, with what authority, and whether the AI recommendation was followed. Log one structured event per consequential decision:

{
  "decision_id": "d-88213",
  "system_id": "hr-screening-assist-07",
  "model_version": "2026.10.3",
  "ai_recommendation": "reject",
  "human_reviewer": "emp-4471",
  "reviewer_authority": "hiring_manager",
  "final_outcome": "advance",
  "override": true,
  "rationale_ref": "note/55102",
  "explanation_available": true
}

Track the override rate and time spent per review. A reviewer who approves 100% of recommendations in two seconds each is not exercising oversight, and a regulator or court will notice. This is our engineering heuristic, not a statutory test.

3. Compliance Gates in the Pipeline

A deployment should fail if its system record is incomplete. The check is small and cheap:

# ci/ai-compliance-gate.yml
- name: AI system record check
  run: |
    ai-gate verify --record systems/${SYSTEM_ID}.yaml \
      --require risk_class,owners,oversight_points,log_retention_days \
      --require-overlay ${TARGET_COUNTRIES}

For generative features, add a test stage that runs your safeguard suite before the 2 December 2026 bans apply, and a check that machine-readable output marking is on where Article 50 requires it.

4. Reuse Your Existing Assessments

The Omnibus lets deployers reference a GDPR data protection impact assessment inside the fundamental rights impact assessment. Build one shared assessment template, and you stop writing the same analysis twice.

The 2026–2028 Plan

Window	Focus	Done when
Now to Dec 2026	Close what already applies	AI usage policy and training record exist; labelling checked; generative safeguards tested
H1 2027	Build the spine	System records live for every system; decision-event logging in production; country overlays for your top markets
H2 2027	Rehearse	Mock regulator request answered in hours; impact assessments complete; standards mapped as they publish
2028	Extend and sustain	Product-embedded AI covered before 2 August 2028; evidence refreshed automatically

Where Incresco Compliance (EU-wide) Fits

Our Compliance (EU-wide) work builds exactly this layer. We work with engineering teams across Germany, the Netherlands, France and the Nordics. Typical engagements deliver the system register, decision-event logging, pipeline gates and country overlays, wired into the Salesforce, ERP and data platforms you already run.

What you get:

• One build, many markets. New national rules become configuration.
• Procurement-ready evidence. Buyers get answers the same day they ask.
• A calmer 2027. You rehearse the audit before anyone schedules a real one.

Hospitality, financial services, education and PropTech teams often start here, because their AI touches guests, customers, students and tenants directly.

Start With One Question

Ask your CTO, legal lead and HR head to answer this together this week:

“If Italy’s human-decision rule applied in every country we operate in, which of our AI-assisted decisions would fail today?”

The answer tells you which systems to fix first, and it doubles as a stress test for every market you serve.

Book a 30-minute Compliance (EU-wide) working session with Incresco

Related: Can You Prove Which Company Content Is AI-Written? | Muse Wonder for Business: What AI Agents Mean for Hotels, Property Managers and Universities in Europe

---

Incresco is a technology consulting firm working with global enterprises on AI engineering, production readiness and regulatory compliance. This piece reflects the EU AI Act as amended by Regulation (EU) 2026/1744 and is not legal advice.