A control says something like: Article 10(2)(c) requires you to document data-preparation operations. That is three claims in one sentence. The provision exists. It says roughly that. Nothing has repealed it.
Two hundred controls make about six hundred of those. Nobody checks them.
Every headline since 24 July has said the same thing: the AI Act got pushed back. True, and also the least interesting part of Regulation (EU) 2026/1744, the "Digital Omnibus on AI," which entered into force on 27 July 2026. I went through the consolidated EUR-Lex text rather than the summaries. Sixty-nine amendment markers, thirty-nine locations in the Act. Two new prohibited practices. A deleted article replaced by a wider one. A redefinition of what counts as a safety component. A new category of company the Act now treats differently. None of that is a date.
An AI system that processes personal data lands on your desk. Two obligations attach to it, from two regulations, answerable to two different authorities.
Almost everyone runs them as two projects. The legal text does not ask for that, and the second risk register is where the trouble starts.