Inside the EU AI Act "Simplification": Implementation Steps for Japanese Companies Using the Digital Omnibus 2026 and ISO/IEC 42001

Hello, this is Hamamoto from TIMEWELL.

"I hear the EU has loosened its AI regulation. We can afford to wait and see for a while." Lately I have been hearing this kind of remark often from people at Japanese companies that are moving ahead with AI adoption. The reason is that on May 7, 2026, the Council of the EU and the European Parliament reached a political agreement on "simplifying" the AI Act,¹ which then became law as Regulation (EU) 2026/1744, and the postponement of high-risk AI application was widely reported. But once you read the text of the amending regulation, I came to feel that dismissing it with the single word "loosened" is dangerous. What was postponed, what was left intact, and what was newly added are all mixed together.

In this article, I will organize what changed under the amendment package known as the Digital Omnibus on the basis of primary sources, and then propose how Japanese companies should use the resulting preparation period, as implementation steps centered on ISO/IEC 42001. To state my conclusion up front: I read the postponement not as good news, but merely as the preparation deadline shifting a little.

One more thing before we begin. The reason I keep returning to primary sources here is that "AI regulation news" travels through layers of summarization, and each layer tends to round off the nuance in favor of a cleaner headline. By the time a story reaches a busy executive, "high-risk enforcement postponed" has often quietly become "the AI Act is delayed," which is simply not true. Reading the agreement and the practitioner commentary directly is the only way to separate the part that genuinely buys you time from the part that does not.

What Moved and What Did Not Under the Digital Omnibus

The first thing to keep in mind is that the Digital Omnibus is already law. The amending act was adopted on July 8, 2026 as Regulation (EU) 2026/1744, published in the Official Journal (OJ L, 2026/1744) on July 24, 2026, and entered into force on July 27, 2026. What was reported at the political-agreement stage is now a regulation with legal force. From the same date, Articles 102 to 110 of the AI Act (the provisions amending other legislation) also began to apply.

On that basis, what took center stage in the reporting was the pushing back of the application dates for high-risk AI. Stand-alone high-risk AI systems classified under Annex III, originally due to apply from August 2, 2026, now apply from December 2, 2027, and product-embedded systems under Annex I that are integrated into regulated products move from August 2, 2027 to August 2, 2028. On the Annex III date of December 2, 2027, Sections 1, 2 and 3 of Chapter III start to apply, and with them the authorised representative (Article 22), responsibilities along the value chain (Article 25), deployer obligations (Article 26), and the fundamental rights impact assessment (Article 27). The reason for the postponement is that the technical standards and support tools meant to underpin application have lagged behind; it was a pragmatic judgment that running the rules ahead on their own would leave the field unable to comply.²

This is where the misreading usually starts: what actually begins on the general application date of August 2, 2026. From that date, Chapter IV (the Article 50 transparency obligation), Chapter III Section 5 (Articles 40 to 49 on harmonised standards, conformity assessment, CE marking, and registration), Chapter VI, Chapters VIII to XI, and Article 101 (the European Commission's power to impose fines on providers of general-purpose AI models) apply. The substantive high-risk obligations do not. If you see an explanation claiming that "the AI Act applies in full from August 2, 2026," treat it with suspicion. Note also that the general provisions and AI literacy (Article 4) and prohibited practices (Article 5) have applied since February 2, 2025, and the chapters on general-purpose AI models, governance, and penalties (Articles 99 and 100) since August 2, 2025. The prohibition on emotion inference in the workplace (Article 5(1)(f)) is already in effect.

Alongside the postponement, there are things that did not move, and things that were newly added. Article 50, which sets transparency requirements for generative-AI content, was kept to the original schedule and applies from August 2, 2026. The amendment touched only Article 50(7) on codes of practice; the substantive obligations themselves are unchanged. That said, the newly inserted Article 111(4) requires providers of AI systems generating synthetic content that were placed on the market before August 2, 2026 to comply with Article 50(2) by December 2, 2026. Furthermore, new prohibitions concerning the generation of non-consensual sexual deepfakes and CSAM (child sexual abuse material) have been added as Article 5(1)(ba) and (bb), and these apply from December 2, 2026. Far from being relaxed, the net cast over socially unacceptable uses has been tightened.

The framework for fines has also basically been retained. The cap of up to EUR 35 million or 7% of global annual turnover for prohibited practices was not changed by the amendment.³ Breaches relating to general-purpose AI models and others are capped at EUR 15 million or 3% of global turnover. If the banner of "simplification" leads you to imagine a relaxation of penalties, you will be caught off guard. The point that easily gets lost is the difference between "scheduling relief" and "obligation relief." What this amendment adjusted was largely the former — when the rules begin to apply. The substance of the obligations themselves, especially the lines drawn around what society will not tolerate, was not loosened. For a company doing business with the EU market, that distinction is the difference between a planning question and a design question, and the two cannot be answered with the same posture of waiting.

The Core of "Simplification" Is SME Consideration and Procedural Relief

So what exactly is being "simplified"? My reading is that the heart of this package lies not in relaxing penalties, but in easing the burden on small and medium-sized enterprises and on procedures.

Under the amendment, SMEs (small and medium-sized enterprises) and SMCs (small mid-cap companies) are given formal definitions, and several forms of consideration are reported to have been built in. Specifically: simplified technical documentation, quality management system requirements scaled to the size of the company, lower fine caps, and priority access to AI regulatory sandboxes.³ Even if the absolute amount of the fines does not change, a different yardstick is prepared for operators with smaller resources — that is the design.

On the procedural side, the burden of registering with the central database is also lightened. Section B, paragraphs 7 and 9 of Annex VIII are deleted, narrowing down the information to be submitted while keeping the registration obligation itself.³ As for regulatory sandboxes, a new EU-level sandbox is created, with priority access granted to SMEs and small mid-caps, including startups.³

Personally, what caught my attention was that the wording of the AI literacy obligation (Article 4) has been softened. Until now it was an outcome-oriented obligation to "ensure a sufficient level of literacy," but it has shifted to a gentler phrasing: "take measures to support the development of literacy."⁴ It looks as though the obligation has been lightened, but I actually think the opposite. Because the law no longer says "ensure it," what is now tested is whether a company can judge for itself how much is enough and explain it. Once the externally given standard disappears, you have no choice but to hold the standard internally.

Let me lay out the changes so far side by side, comparing the original schedule with the position after the amendment.

Item	Original schedule	After Regulation (EU) 2026/1744
Annex III stand-alone high-risk AI	August 2, 2026	December 2, 2027
Annex I product-embedded high-risk AI	August 2, 2027	August 2, 2028
Article 50 transparency (watermarking, etc.)	August 2, 2026	Unchanged (August 2, 2026)
Article 111(4) compliance deadline for already-placed synthetic-content AI	Not provided for	December 2, 2026
New prohibitions, Article 5(1)(ba) and (bb)	Not provided for	December 2, 2026
Article 101 Commission fining power over general-purpose AI	August 2, 2026	Unchanged (August 2, 2026)
Fine cap for prohibited practices	EUR 35 million / 7% of turnover	No change
SME/SMC consideration	Limited	Added: simplified documentation, lower fines, priority access

The application dates follow Article 113 as amended. The points on SME consideration and registration procedure draw on the aforementioned commentary from Gibson Dunn and Mishcon de Reya.⁴³ Looking at the table, you can see that what was extended is the "heavy" high-risk obligations, while the "social lines" such as transparency and prohibitions were left in place or added to. Rather than feeling reassured by the postponement, the more urgent task is the work of sorting out which obligations apply to your own company, and from when.

The Postponed Grace Period Is the Time to Build Governance

This is where the main point begins. I do not read the fact that the high-risk application dates have been pushed back as "a longer period during which you can do nothing." Rather, I see it as "a secured preparation period for putting the foundations of governance in place."

The reason lies in the reality that AI governance worldwide has not caught up. In a survey McKinsey conducted in 2026 covering roughly 500 organizations, only about 30% of organizations had reached maturity level 3 or above in strategy, governance, and the control of agentic AI.⁵ Organizations running agentic AI in earnest somewhere in their operations stood at 23%, and even including those that have made a pilot start, the figure was 62% — a picture in which oversight has not kept pace with the speed at which the technology is spreading.⁵ Now that we are entering the age of agents, in which AI shifts from "something you use" to "something that acts autonomously," a lag in governance translates directly into the probability of incidents.

Regulators recognize this lag too. On April 7, 2026, NIST in the United States published a concept note for an AI RMF profile for trustworthy AI in critical infrastructure.⁶ It is an attempt to translate into practice how AI can be operated in a trustworthy form in domains where a stoppage stops society — energy, water, transportation, industrial control systems. It is a voluntary guideline with no legal force, but the fact that regulators are moving in concert toward "converting frameworks into operations" cannot be overlooked. Even while the EU has pushed back its high-risk dates, the work of building standards around the world has not stopped.

Companies that use the postponement for "waiting," and companies that use it for "groundwork." When the application date arrives, the gap between the two will become impossible to close. An AI management system is not something that works the moment you buy and install it; it takes time to take root in an organization — from taking inventory of risks to managing data and building human-oversight procedures. By my estimate, companies that start building the foundation during 2026 will just barely make it in time for December 2, 2027.

To turn AI governance from "someday" into "starting now," the visibility of where and what kinds of risks your company's AI use carries is the starting point. ZEROCK supports the groundwork of governance with a design philosophy that brings AI use and knowledge scattered across the organization under control. We also offer individual consultations for the stage where you are unsure where to begin.

Implementation Steps Centered on ISO/IEC 42001

So where to actually begin? What I recommend to Japanese companies is to make ISO/IEC 42001 the backbone of implementation.

ISO/IEC 42001, published in December 2023, is the world's first international standard for an AI management system (AIMS).⁷ It sets out the requirements for an organization to establish, implement, maintain, and continually improve an AI management system, with 38 controls organized in Annex A. Because it shares the same management-system structure as ISO/IEC 27001 for information security, the advantage is that companies already operating 27001 can introduce it by building on top of that mechanism.

Why ISO/IEC 42001 for EU AI Act readiness? Because the two mesh together in the relationship of "what should be achieved" versus "how it is operated and evidenced." According to ISACA's commentary, the AI Act's Article 9 (risk management) maps to a methodology for setting risk-acceptance criteria and assigning roles; Article 10 (data governance) maps to policies on the data lifecycle and provenance management; Article 11 and Annex IV (technical documentation) map to version-controlled model cards and document-control procedures; and Article 14 (human oversight) maps to oversight roles and training programs for operators.⁸ Many of the documents and procedures the AI Act demands are the kind that are naturally generated if you operate ISO/IEC 42001.

There is a caveat, however. Because ISO/IEC 42001 is not a harmonised standard under the AI Act, the effect of "obtain certification and conformity is presumed" does not apply.⁸ It is, at best, "a solid foundation that helps you achieve compliance," not an automatic passport.⁹ Misunderstand this point, and you will obtain certification and grow complacent. In the field of implementation, you sometimes hear figures for "what share of the high-risk documentation requirements ISO/IEC 42001 covers," but trace them back and they usually lead to vendor material, so I do not treat them as grounded values. The specific parts demanded by harmonised standards or individual laws are, in the end, yours to fill in.

As the order of implementation, let me list the steps I consider realistic.

1. Take inventory of AI use and classify risk. Identify the AI systems in use across the company and pin down which ones fall under Annex III high-risk.
2. Design the governance structure. Document policies, roles, and the division of responsibility regarding AI, and build in a management-level review process.
3. Data governance and log management. Establish the provenance and quality of training and inference data, and a retention policy for logs.
4. Prepare technical documentation and model cards. Create document-control procedures that can preserve the design specifications and test methods Annex IV demands.
5. Human oversight and education. Operate override procedures, training for operators, and measures to develop AI literacy.
6. Make continuous improvement a cycle. Embed auditing and corrective action as part of the management system.

This list maps directly onto the PDCA cycle of ISO/IEC 42001. The stretch running up to the Annex III application date of December 2, 2027 is just the right length to run through these six steps once. In practice, the order matters as much as the content. Skip the first step — the inventory — and every later step floats free of reality, because you end up writing policies for systems you have not actually located. I have seen companies start from step 2, drafting elegant governance charters, only to discover months later that shadow AI use in a single sales team had never been counted. The inventory is unglamorous, but it is the step that decides whether the rest is real or theatrical. If you would like to learn a little more about the basics of an AI management system, please also read Introduction to ISO/IEC 42001 (AIMS). For the full picture of what was postponed and what was added under the Digital Omnibus, I follow it in detail in Behind the Digital Omnibus.

Three Misreadings Japanese Companies Are Prone To

Finally, let me name three misreadings around this amendment that Japanese companies are prone to. These are misunderstandings I have actually encountered many times while taking consultations.

The first is the misreading that "since it has been postponed, it is irrelevant for the time being." The AI Act is a law with extraterritorial application, and Japanese companies that provide AI systems or their outputs to the EU market can be subject to it. The prohibitions already apply, the transparency obligation (Article 50) applies from August 2, 2026, and what was postponed is limited to the heavy high-risk obligations. Unless you first sort out which of your products fall under which obligations, you cannot even judge whether the postponement applies to you.

The second is the misreading that "obtaining ISO/IEC 42001 means you are done." As I noted earlier, this is not a harmonised standard, and no automatic presumption of conformity applies. Certification is not the goal; it is the means of acquiring a mechanism that continuously produces the evidence the AI Act demands. If operations stop after you obtain it, the documents will grow stale and lose their meaning.

The third is the misreading that "governance is nothing but a cost." As the McKinsey survey shows, organizations with mature governance are still a minority.⁵ Put the other way around, if you build the foundation now, it becomes a differentiator. A structure in which you can confidently entrust work to AI is proof of trust to customers and business partners, and it is also a precondition for using agentic AI on the offensive. Investment for defense turns into a foundation for offense. In procurement conversations, increasingly the first question is not "what can your AI do" but "how do you control it." A company that can answer the second question with documents already in hand, rather than promises, wins time and credibility that a competitor scrambling to retrofit governance simply cannot match.

The essence of the postponement news, as I read it, is not that the deadline moved, but that time you can use for preparation has been secured. How you use that time will completely change where you are standing on the application date.

To Translate AI Governance Into Implementation

The later application dates for high-risk AI are, for Japanese companies, a "grace period for preparation," not an "exemption." With ISO/IEC 42001 as the backbone, run through the inventory of AI use, the management of data and logs, and the formalization of human oversight once before December 2, 2027. That accumulation will determine the burden on the application date.

That said, the work of making AI use scattered across the company visible and bringing knowledge under control requires both wheels: tools and operational design. ZEROCK is designed to implement enterprise-AI governance on domestic servers and, through knowledge control, to make visible "who is using AI for what, and what information is flowing." It can be of help at the stage where you want to organize where to begin with AI governance.

→ Book an individual ZEROCK consultation

ZEROCK service details

Footnotes

Footnotes

1. Artificial Intelligence: Council and Parliament agree to simplify and streamline rules — Council of the EU (Consilium) — 2026-05-07 — https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/ ↩

2. EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions — Covington (Inside Privacy) — 2026-05 — https://www.insideprivacy.com/artificial-intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new-prohibitions/ ↩

3. EU AI Act simplified? Unpacking the AI Omnibus Agreement of May 2026 — Mishcon de Reya — 2026-05 — https://www.mishcon.com/news/eu-ai-act-simplified-unpacking-the-ai-omnibus-agreement-of-may-2026 ↩ ↩² ↩³ ↩⁴ ↩⁵

4. EU AI Act Omnibus Agreement – Postponed High-Risk Deadlines and Other Key Changes — Gibson Dunn — 2026-05 — https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/ ↩ ↩²

5. State of AI trust in 2026: Shifting to the agentic era — McKinsey & Company — 2026 — https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-forward/state-of-ai-trust-in-2026-shifting-to-the-agentic-era ↩ ↩² ↩³

6. Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure — NIST — 2026-04-07 — https://www.nist.gov/programs-projects/concept-note-ai-rmf-profile-trustworthy-ai-critical-infrastructure ↩

7. ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system — ISO (International Organization for Standardization) — 2023-12 — https://www.iso.org/standard/42001 ↩

8. ISO/IEC 42001 and EU AI Act: A Practical Pairing for AI Governance — ISACA — 2025 — https://www.isaca.org/resources/news-and-trends/industry-news/2025/isoiec-42001-and-eu-ai-act-a-practical-pairing-for-ai-governance ↩ ↩²

9. A Practical Guide to the EU AI Act and How ISO/IEC 42001 Can Help You Achieve Compliance — SafeShield — 2025 — https://www.safeshield.cloud/a-practical-guide-to-the-eu-ai-act-and-how-iso-iec-42001-can-help-you-achieve-compliance ↩