The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It amends the AI Act (Regulation (EU) 2024/1689) on a number of points. It is widely described as a postponement, and in one important respect it is: the obligations for high-risk AI systems will now apply later than originally planned. That description is incomplete, however. Much of the AI Act already applies, and the Omnibus also introduces new prohibitions and stronger enforcement tools.
In this note, we set out the main changes and what they mean in practice for companies that develop, procure or use AI systems in the European Union.
Obligations that already apply
The AI Act is not a future regime. Its first provisions have applied since 2 February 2025.
Since that date, the practices prohibited under Article 5 have been unlawful. They include manipulative or deceptive techniques, social scoring, untargeted scraping of facial images, and emotion recognition in the workplace and in education, subject to limited exceptions. Infringements may lead to fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher.
Providers of general-purpose AI models have been subject to Chapter V since 2 August 2025. They must maintain technical documentation, put in place a copyright policy and publish a summary of the content used for training. The Commission’s power to fine these providers has applied since 2 August 2026.
The transparency obligations in Article 50 have also applied since 2 August 2026. Users must be informed when they interact with an AI system, synthetic content must be marked in a machine-readable format, and deepfakes must be disclosed. The Omnibus grants one limited transitional period. Under new Article 111(4), providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking obligation in Article 50(2).
New application dates for high-risk AI systems
The most significant change concerns the timetable for high-risk AI systems. The requirements and obligations in Sections 1 to 3 of Chapter III will now apply on the following dates.
They apply from 2 December 2027 to the systems listed in Annex III. Annex III covers areas such as recruitment and workforce management, creditworthiness assessment, risk assessment and pricing in life and health insurance, education, biometrics, critical infrastructure, law enforcement, migration and the administration of justice.
They apply from 2 August 2028 to AI systems that are safety components of products, or are themselves products, covered by the EU legislation listed in Annex I, such as medical devices, toys and lifts.
The recitals explain that the postponement responds to the late availability of harmonised standards and to delays in setting up national authorities. Importantly, the legislator chose fixed dates. The Omnibus does not link application to the publication of standards, so companies should not plan on the assumption of a further extension.
The transitional rule in Article 111(2) has also been adjusted. High-risk systems placed on the market or put into service before the relevant application date fall within the AI Act only if their design is significantly changed after that date. According to the recitals, this assessment is made per type and model. Systems intended for use by public authorities must in any event comply by 2 August 2030. Companies considering an early launch to benefit from this rule should bear in mind that a later significant change in design will bring the system within scope.
New prohibitions and stronger enforcement
The Omnibus adds two prohibitions to Article 5, which apply from 2 December 2026. The first covers AI systems that generate or manipulate realistic intimate images or sexually explicit content of an identifiable person without that person’s explicit consent. The second covers AI-generated child sexual abuse material.
Under new Article 5(1a), a provider may be caught even where its system was not designed for this purpose. This is the case where such output is a reasonably foreseeable outcome that can be reproduced without significant technical modification, and the system lacks adequate safeguards to prevent it. A deployer, by contrast, is caught only where it uses the system for the purpose of generating such material. Providers of general-purpose image and video generation tools should therefore review their technical safeguards.
The Omnibus also strengthens obligations along the value chain. Article 25 now specifies the information, technical access and assistance that an initial provider must give to the party that becomes the provider of a high-risk system. It also requires written agreements with suppliers of AI models, tools and components. A breach of these obligations may now be fined up to EUR 15 million or 3% of turnover (new Article 99(4)(da)).
At EU level, the AI Office has obtained exclusive competence over certain AI systems. These include systems based on a general-purpose AI model where the model and the system are developed by the same provider, and AI systems that constitute or are integrated into very large online platforms or search engines. Some exceptions apply. The AI Office now has inspection powers and may impose periodic penalty payments.
Simplification measures
Several amendments reduce the compliance burden. Article 4 on AI literacy now requires providers and deployers to take measures to support the AI literacy of their staff. It states expressly that no specific level of literacy has to be guaranteed. A training framework remains advisable, but the obligation is now one of means rather than result.
SMEs and the new category of small mid-cap enterprises may provide technical documentation in a simplified form and apply a quality management system proportionate to their size. Where they are fined, the lower of the fixed amount and the percentage of turnover applies.
New Article 4a allows providers of high-risk systems to process special categories of personal data where this is strictly necessary to detect and correct bias, subject to specific safeguards. In exceptional cases, the same possibility extends to deployers of high-risk systems and to providers and deployers of other AI systems and models. This provides a clearer legal basis in an area that previously raised difficult questions under data protection law.
The classification question
In practice, the central issue for most businesses remains whether a given system qualifies as high-risk. The Commission has published draft guidelines on classification under Article 6. The consultation closed in July 2026 and, at the time of writing, the final guidelines have not been adopted. Two positions in the draft are particularly relevant.
First, human involvement in the decision-making process does not, in itself, prevent a system from being classified as high-risk. Human oversight is a compliance requirement, not a classification criterion. Second, a limitation in the terms of use will not be sufficient where the product’s overall presentation and marketing promote high-risk uses.
Article 6(3) allows certain Annex III systems to be treated as not high-risk, for example where they perform only a narrow procedural or preparatory task. This exception never applies to systems that perform profiling. Providers relying on it must document their assessment before placing the system on the market and register the system.
Practical considerations
The new dates give businesses additional time, but the preparatory work remains considerable. In our experience, the first steps are to establish an inventory of the AI systems a company develops and procures, to assess which of them may fall within Annex III or Annex I, and to review contracts with AI suppliers in light of the revised Article 25. Companies that complete this exercise early will be better placed to meet the 2027 and 2028 deadlines without disruption to their products or operations.
Image Designed by Magnific
