EU AI Act Deadlines for Training Data After the Digital Omnibus: Planning Acquisition for 2027 and 2028

Last reviewed: 9 October 2026. The new dates are reported by secondary sources; confirm them against the Official Journal text of Regulation (EU) 2026/1744 [1] and the consolidated AI Act [2] before you fix internal milestones.

What Regulation (EU) 2026/1744 changed, and what it left alone

The Omnibus is a timing amendment for high-risk systems, not a rewrite of the data rules. It is dated 8 July 2026 and was published in the Official Journal on 24 July 2026 [1]; secondary sources report entry into force on 27 July 2026 [4]. Commentary describes the high-risk regime as "deferred, not cancelled" [10], and law-firm analysis reports that data governance, technical documentation and conformity assessment requirements are substantively unchanged [3].

For data buyers, that means three things:

• Article 10 is amended by Regulation (EU) 2026/1744 [1]. Training, validation and testing data sets must be subject to documented governance and management practices and meet the quality criteria in Article 10(2) to (4), including relevance, representativeness, freedom from errors and completeness under Article 10(3) [5]. See the cluster page on Article 10 data governance for licensed training data.
• Annex IV documentation is the same. Technical documentation must still describe data provenance, scope, main characteristics, collection and labeling procedures, and cleaning methods. The Annex IV dataset description guide covers the fields.
• Retention is the same. Providers keep technical documentation for 10 years after the system is placed on the market or put into service [6]. Any dataset license that ends earlier than your documentation duty creates a gap between what you must describe and what you may still hold.

The GPAI timeline was not the subject of the high-risk deferral. Article 53 duties (technical documentation, information for downstream providers, a copyright policy and a public training-content summary) have applied since 2 August 2025 [7].

The dates that govern training data, as of October 2026

Each training-data duty now has its own date, and the right one depends on how your system is classified. The table below collects the dates buyers most often need; treat the high-risk rows as reported until you have read the OJ text [1][3].

Two cautions apply. First, Article 50 transparency duties were not part of the high-risk deferral, and secondary sources disagree on the marking deadline for AI-generated content, so check that date separately if your system generates synthetic media. Second, if you fine-tune someone else's GPAI model or substantially modify a high-risk system, you may take on provider duties yourself; the page on fine-tuning and provider duties explains when.

Why a 16-month deferral does not mean waiting 16 months

The deferral helps only if dataset acquisition, preparation and evidence work finish before conformity assessment begins. Article 10 is about how data sets were designed, collected and governed [5], and that history is hard to reconstruct after the fact.

Several failure modes show up when teams treat the new date as the start date:

• Provenance you cannot recover. A dataset acquired in 2025 without a data sheet, collection dates or a consent basis cannot be described under Annex IV. Re-acquiring a comparable set takes longer than documenting the original would have.
• Validation and test sets drawn from the training pool. Article 10 applies to all three splits [5]. Test sets carved out late often share suppliers, time windows or customers with training data, which undermines your performance claims. The validation and test data requirements page covers separation.
• Representativeness gaps found during assessment. Article 10(4) requires data sets to account for the geographical, contextual, behavioral or functional setting of intended use [5]. A credit model trained mostly on US loan files and deployed in the EU has a gap that only new data closes.
• License terms shorter than retention. A three-year license that requires deletion conflicts with a 10-year documentation duty [6] unless the license separates training copies from documentation and audit copies.
• Bias examination without lawful special-category data. If you need Article 10(5) to process sensitive attributes for bias detection, the conditions must be met when processing happens, not at assessment. See Article 10(5) and special-category data.

Planning backward from 2 December 2027 and 2 August 2028

Work backward from your applicable date, reserving the last two quarters for conformity assessment and remediation. The lead times below are planning assumptions for the purpose of the example, not regulatory figures; replace them with your own procurement and engineering history.

Illustrative example: invented to show structure; it does not describe an available dataset.

Acquisition and evidence plan: Annex III hiring-screening model, EU launch, applicable date 2 Dec 2027

The same structure works for an Annex I system with a 2 August 2028 date, shifted by eight months. Product teams should align it with the notified-body schedule under the relevant sectoral regulation, which often sets the real constraint.

Supplier documents to request now, keyed to each article

Ask for evidence at contract stage, because suppliers rarely reconstruct it later. The list below maps requests to the provision that needs them.

Supplier evidence checklist for EU AI Act training data

• Article 10(2)(b) origin and collection: collection period, collection system (for example, Zendesk ticket exports, Salesforce opportunity objects, Jira issue history), and the original purpose of collection [5].
• Article 10(2)(c) preparation: annotation guidelines, labeling vendor, cleaning and enrichment steps, aggregation rules, and the de-identification method with its residual-risk note.
• Article 10(2)(d)-(e) assumptions and suitability: what each field measures, known proxies, quantity by segment and time window.
• Article 10(3)-(4) representativeness: population description by geography, language, product line and period; known exclusions.
• Article 10(5) special-category data: whether sensitive attributes are present, their legal basis and the safeguards applied.
• Annex IV and Article 18 retention: license language that lets you keep documentation, samples and hashes for the 10-year period [6], and lets authorities inspect them. See regulator access to licensed datasets.
• Article 53(1)(c)-(d) for GPAI: source category for the training-content summary template [8], confirmation that content was not collected against an Article 4(3) machine-readable opt-out [7], and whether the data is private, licensed or publicly available. The SourceX guide to what buyers need from suppliers for training-data summaries goes field by field.

GPAI providers: the 2027 date that did not move

GPAI providers face a fixed 2 August 2027 deadline for models placed on the market before 2 August 2025, under the AI Act's own transitional rule [2]. That deadline is separate from the Omnibus high-risk deferral and is easy to conflate with it.

For legacy models, the work is retrospective: you must summarize training content you already used, using the Commission template [8], and show that your copyright policy covered it [7]. The voluntary Code of Practice, published 10 July 2025, offers a route to demonstrate Article 53 compliance through its Transparency and Copyright chapters [9]. Licensed and private datasets acquired now for continued pre-training or post-training should arrive with source descriptions that drop straight into the summary. See completing the training content summary for licensed and private datasets and the Article 53 obligations guide.

How to keep the schedule current

Treat the dates as configuration, not constants, and assign someone to recheck them. Secondary sources supplied most of the reported dates [3][4], and the consolidated AI Act on EUR-Lex is the text to cite in your quality management system [2].

A practical routine:

1. Record the article, paragraph and OJ reference for each date in your Article 17 data management procedure, rather than a summary from a newsletter.
2. Recheck after any further implementing act, guideline or standardization deliverable, since harmonized standards affect how you evidence Article 10.
3. Keep the dataset register keyed to splits and suppliers, so a date change reschedules acquisition automatically.
4. Review license expiry dates against the Article 18 retention period [6] each quarter.

For a broader view of how these duties fit with US and standards-based regimes, start at the AI training data compliance hub, the SourceX overview of the EU AI Act for AI data licensing, or the guide for AI governance leads. If your gap analysis shows you need new operational data before your deadline, you can describe the dataset to SourceX.

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Source training data for your EU AI Act timeline

SourceX sources operational datasets from US companies on request, such as support and sales histories, engineering records, documents and finance and legal workflows, and manages licensing; a request does not guarantee a match. Every dataset is rights-reviewed and delivered under a license defining records, uses, term and delivery, with diligence materials on source, rights, preparation and allowed use prepared per dataset. Describe the data your EU launch needs.