The European Union amended the AI Act even before it became fully applicable. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published on 24 July 2026 and entered into force on 27 July 2026. It postpones the obligations for high-risk AI systems, adds new prohibitions and introduces a range of relief measures for businesses.
Originally, most of the AI Act's obligations, including the rules for high-risk systems under Annex III, were due to apply from 2 August 2026. Practice showed, however, that neither the market nor the authorities were ready. Harmonised standards, which are meant to offer businesses concrete technical solutions, were delayed, Commission guidelines were missing, and many Member States had not yet set up national supervisory authorities or conformity assessment frameworks.
The EU legislator therefore opted for a targeted amendment. Its declared aim is to facilitate and clarify the implementation of the rules and to reduce the administrative burden, especially for smaller businesses, without lowering the level of protection of health, safety and fundamental rights. At the same time, it responds to new threats – the spread of apps that turn photographs into intimate images without consent.
Note: the postponement does not cover everything. Transparency obligations under Article 50 apply from 2 August 2026, and the prohibitions under Article 5 have applied since February 2025.
The table below provides a brief comparison of the previous wording of the AI Act with the wording as amended by Regulation (EU) 2026/1744, including references to the articles concerned.
| Area (Article) | Previous wording | After the Omnibus |
|---|---|---|
| Application dates: high-risk systems (Art. 113(c)) | Annex III from 2 Aug 2026, Annex I (Art. 6(1)) from 2 Aug 2027 | Postponed: Annex III from 2 Dec 2027, Annex I from 2 Aug 2028. |
| New prohibitions (Art. 5(1)(ba), (bb), Art. 5(1a), (1b)) | Did not exist | Prohibited: AI systems generating intimate deepfakes of an identifiable person without their explicit consent (“nudify” apps) and child sexual abuse material (CSAM). For providers, the ban applies not only where this is the system's purpose but also where it is a foreseeable outcome in the absence of reasonable safeguards. Applies from 2 Dec 2026. |
| AI literacy (Art. 4) | Obligation to ensure a “sufficient level” of AI literacy of staff | Softened: obligation to take measures to promote AI literacy, without guaranteeing a specific level. The Commission and Member States are to support businesses. |
| Processing of sensitive data to address bias (new Art. 4a, Art. 10(5) repealed) | Only providers of high-risk systems (Art. 10(5)). | Legal basis extended to deployers and to other AI systems and models, with the same safeguards. The justification is a substantial public interest. It is an exception applicable only where strictly necessary and solely for detecting and correcting bias. |
| Safety component (Art. 3(14), Art. 6(1a)–(1c)) | General definition | Clarified: the decisive factor is the intended purpose of preventing risks. User support, optimisation, automation, convenience and quality control are expressly excluded. A third-party assessment required because of other risks (e.g. radio spectrum) does not make a system high-risk. |
| New categories of businesses (Art. 3(14a), (14b)) | Only SMEs, start-ups and microenterprises | A new category of small mid-cap enterprises (SMCs) is introduced. Relief measures are extended to SMCs (simplified documentation, quality management system). |
| Relief for smaller businesses (Arts. 11, 17, 63, 99) | Simplified quality management system only for microenterprises; simplified technical documentation for SMEs | Simplified quality management system for all SMEs. Simplified technical documentation and proportionality also for SMCs. For SMCs, the cap on fines is the lower of the two amounts (new Art. 99(6a)). |
| Sectoral law, Annex I (Art. 2(2) and (13), Annex I) | Machinery in Section A of Annex I | Machinery moved to Section B, i.e. under the sectoral regime. By means of delegated acts, the Commission may limit the obligations under Arts. 9–15 and 17–25 where sectoral law provides equivalent protection (by 2 Aug 2027). Consequence: the AI Act applies to such machinery only to the extent set out in Art. 2(2). |
| Conformity assessment (Art. 43(3), Arts. 28, 29, 30, Annex XIV) | Original rules | A manufacturer is not obliged to opt for third-party assessment solely because of the AI component. Notified bodies under sectoral law may carry out assessments and must apply for designation under the AI Act by 28 Jan 2028. A single application and a single designation procedure are introduced, together with a new Annex XIV containing codes (AIP/AIB/AIH, including agentic AI). |
| Cybersecurity (Art. 42(3)) | Not addressed | Compliance with the Cyber Resilience Act (CRA) gives rise to a presumption of conformity with Art. 15. |
| Registration of systems under Art. 6(3) (Annex VIII, Section B) | Full set of data | Simplified; points 7 and 9 deleted. The assessment must still be documented. |
| Fundamental rights impact assessment – FRIA (Art. 27(4), (5)) | The FRIA complements the DPIA where the DPIA already contained the information. Unclear whether a single document suffices. | Cross-references to the DPIA or reuse of its parts are possible. The template questionnaire may take the form of an automated tool. |
| Value chain (Art. 25(2), (4); Art. 99(4)(da)) | Contract with suppliers of tools and components | The AI model is now expressly included. Cooperation by the original provider is clarified. Infringements are now subject to penalties. |
| Transparency (Art. 50, Art. 111(4), Art. 113) | Applicable from 2 Aug 2026, with no transitional period | Not postponed: transparency obligations (chatbots, deepfakes, AI-generated text published to inform the public, emotion recognition) apply from 2 Aug 2026. The postponement concerns only high-risk systems. The sole exception: systems placed on the market before 2 Aug 2026 must comply with the machine-readable marking of outputs (Art. 50(2)) by 2 Dec 2026. |
| Penalties (Art. 99) | Up to EUR 35 million / 7% of turnover for infringements of Art. 5, up to EUR 15 million / 3% for other obligations; for SMEs, the lower of the two amounts | Amounts unchanged. The new prohibitions (intimate deepfakes, CSAM) fall under the highest tier under Art. 99(3). The “lower of the two” rule is extended to SMCs. Infringements of Art. 25(2) and (4) are now subject to penalties. The economic viability of SMEs and SMCs must be taken into account when imposing penalties. |
| Codes of practice (Art. 50(7), Art. 56(6)) | Approval by implementing act | The Commission assesses the adequacy of a code and publishes the outcome. An implementing act is adopted only where the code is inadequate. |
| Post-market monitoring (Art. 72(3)) | Implementing act with a template (by 2 Feb 2026) | Replaced by guidelines with a voluntary template by 2 Sep 2027. |
| Sandboxes and testing (Arts. 57, 58, 60, new Art. 60a) | National sandbox by 2 Aug 2026; real-world testing only for Annex III | Deadline moved to 2 Aug 2027. New EU-level sandbox (AI Office). Real-world testing also for Annex I Section A, and a new framework for Section B (Art. 60a). |
| AI Office and supervision (Art. 75, new Arts. 75a–75d) | Supervision only of systems based on a general-purpose model of the same provider | Exclusive competence also within the same group of undertakings and over very large online platforms and search engines under the DSA. New powers: inspections, commitments, fines and periodic penalty payments of up to 5% of average daily turnover. Limitation period of 5 years; review by the Court of Justice of the EU. |
| Authorities protecting fundamental rights (Art. 77) | Authorities protecting fundamental rights (e.g. equality bodies) could request documentation under the AI Act only for high-risk systems listed in Annex III; they merely informed the market surveillance authority of the request | Requests are submitted through the market surveillance authority, which provides access and, if it does not hold the documents, requests them without delay from the provider or deployer. The restriction to Annex III is removed; requests may now also cover information, provided electronically in a machine-readable format. Mandatory mutual cooperation and exchange of information between both types of authorities is introduced. The authorities' own powers to request documents directly from companies under other legislation remain unaffected. |
| Systems already on the market (Art. 111(2)) | Reference date 2 Aug 2026 | The reference date is the date of application of Chapter III, i.e. the new dates. It applies per type/model: what counts is the first unit placed on the market, until a significant change in design occurs. For public authorities, the deadline of 2 Aug 2030 remains. |
| Commission guidelines (Art. 96) | — | New guidelines on the interplay with sectoral law (Art. 8(2), Art. 9(10), Art. 17(3)) by 1 Aug 2027. |
The Digital Omnibus has neither repealed nor fundamentally weakened the AI Act. Above all, it has pushed back the deadlines for high-risk systems to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Transparency obligations under Article 50 apply unchanged from 2 August 2026, and the new bans on intimate deepfakes and CSAM apply from 2 December 2026. The time gained is best used to take an inventory of AI systems, classify them and prepare the documentation.
How we can help:
If you are not sure what the changes mean for you, get in touch – we will be glad to help.
You may also be interested in:
Answers to the questions our clients ask us most often.
The Omnibus (Regulation (EU) 2026/1744) has postponed the obligations for high-risk systems. For systems under Annex III to the AI Act (e.g. recruitment, employee evaluation, credit scoring, education, biometrics), they apply from 2 December 2027. For AI used as a safety component of products under Annex I (e.g. medical devices, toys, lifts), they apply from 2 August 2028.
No. The transparency obligations – informing people that they are interacting with a chatbot, labelling deepfakes and AI-generated text intended for the public – apply from 2 August 2026. The only relief is a transitional period until 2 December 2026 for the machine-readable marking of outputs of generative systems placed on the market before 2 August 2026.
From 2 December 2026, AI systems that create or manipulate realistic intimate material of an identifiable person without their explicit consent (so-called nudify apps) and systems generating child sexual abuse material are prohibited. The ban covers systems for which this is the intended purpose as well as general-purpose generative systems where such output is foreseeable and reasonable technical safeguards are lacking. Infringements fall under the highest fines – up to EUR 35 million or 7% of worldwide annual turnover.
Yes, but in a softer form. Article 4 of the AI Act now requires providers and deployers to take measures to promote AI literacy among their staff and other persons working with AI. It no longer requires a specific level of literacy to be guaranteed for each individual. Training and internal rules therefore remain advisable.
It is a new category of companies that have outgrown the definition of a small and medium-sized enterprise (as defined in Commission Recommendation (EU) 2025/1099). The Omnibus grants them relief previously reserved for SMEs: simplified technical documentation, a proportionate quality management system, priority access to the EU-level sandbox and a cap on fines set at the lower of the fixed amount and the percentage of turnover.
Under Article 111(2) of the AI Act, the rules for high-risk systems apply to systems placed on the market before 2 December 2027 (Annex III) or 2 August 2028 (Annex I) only once they undergo a significant change in their design. What counts is the date on which the first unit of the given type and model was placed on the market. The exception is systems intended for use by public authorities – these must comply by 2 August 2030 at the latest.
The postponement is time to prepare, not to wait. We recommend: 1) drawing up an inventory of the AI systems the company develops or uses, 2) classifying each of them under the AI Act, 3) checking whether they are already subject to transparency obligations (chatbots, deepfakes, AI-generated content), 4) putting in place measures for employees' AI literacy, and 5) amending contracts with suppliers of AI solutions and models. We can help you with all of this through our AI compliance service.
