Digital Omnibus on AI: What Summer 2026 Really Changed in the EU AI Act
Regulation (EU) 2026/1744 postpones high-risk obligations to December 2027. Transparency, prohibitions and AI literacy are still due today. Here is what changes and what does not.
Article written with the help of artificial intelligence — learn more about Article 50
Last updated: November 2026 · Reading time: 7 minutes
In short. The Digital Omnibus on AI, now Regulation (EU) 2026/1744, has been in force since 27 July 2026. It moves the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The rest of the timeline holds, and two new prohibitions will apply from 2 December 2026.
This summer, many executives read a reassuring headline: "the AI Act is postponed." The phrase is inaccurate, and it can be expensive. Here is what the text actually changes, what it leaves intact and what it adds.
A text adopted in record time
On 19 November 2025 the European Commission presented a digital simplification package covering the GDPR, ePrivacy, NIS2, the Data Act and the AI Act. The AI part was split from the rest and fast-tracked. The goal was to enter into force before 2 August 2026, the date on which the high-risk rules were due to apply.
- 7 May 2026: political agreement between Parliament and Council
- 16 June 2026: European Parliament vote (423 in favour, 57 against, 174 abstentions)
- 29 June 2026: final adoption by the Council
- 24 July 2026: publication in the Official Journal
- 27 July 2026: entry into force
The data part of the package, which touches the GDPR and cookies, is still under negotiation. Do not change anything in your GDPR processing on the strength of those proposals.
What is postponed, and only that
The postponement targets Chapter III of the AI Act: the requirements for high-risk systems, the obligations of their operators and the rules on notified bodies.
| Category | Examples | Original date | New date |
|---|---|---|---|
| Stand-alone high-risk (Annex III) | Recruitment, credit scoring, education, biometrics, access to public benefits | 2 August 2026 | 2 December 2027 |
| AI embedded in a regulated product (Annex I) | Medical devices, toys, lifts | 2 August 2027 | 2 August 2028 |
The substance does not move. Risk management, data governance, technical documentation, human oversight, robustness and cybersecurity remain drafted as before. The text gives you time, not an exemption.
What already applies
- Prohibited practices (Article 5), since 2 February 2025. Social scoring, manipulation, emotion recognition at work or in school, among others. This is the most heavily sanctioned regime: up to €35 million or 7% of worldwide turnover.
- General-purpose AI models, since 2 August 2025. Since 2 August 2026, the Commission can fine their providers.
- Transparency (Article 50), since 2 August 2026. Inform people that they are interacting with an AI, flag deepfakes, and label generated text published to inform the public on matters of public interest, unless it has undergone human review under editorial responsibility. Only the technical marking of generated content (Article 50(2)) gets a grace period until 2 December 2026, and only for systems placed on the market before 2 August 2026.
- AI literacy (Article 4), in its new wording, since 27 July 2026.
What the Omnibus adds
Two new prohibitions on 2 December 2026
Article 5 now bans systems that generate intimate or sexually explicit images, videos or audio of an identifiable person without their consent, so-called "nudification" apps. It also bans the generation of child sexual abuse material.
The burden differs depending on your role. The provider is caught if that outcome is the purpose of the system, or if it is reasonably foreseeable without adequate technical safeguards. The deployer is caught where the system is actually used for that purpose.
AI literacy becomes an obligation of means
The original Article 4 required ensuring a sufficient level of AI literacy. The new text asks you to take measures to support its development, among staff and anyone using the systems on your behalf. No level is required person by person.
In practice, you must still train your teams and be able to prove it. In return, the Commission and Member States must support businesses, especially SMEs, with concrete examples.
A legal basis for correcting bias
The new Article 4a allows the processing of sensitive data to detect and correct bias, under six cumulative conditions. Among them: synthetic or anonymised data must not be sufficient, access must be strictly controlled and the data must be deleted once the correction is done. This text authorises processing; it does not require it.
Relief for SMEs and small mid-caps
SMEs and small mid-cap companies will be able to file simplified technical documentation, using templates the Commission must publish. The quality management system can be proportionate and penalties are reduced. Registration of systems that escape high-risk status under Article 6(3) is lightened.
A narrower definition of safety component
A system that assists a user or optimises performance is no longer automatically a safety component if its failure does not create a risk to health or safety. Several industrial or productivity tools can thus leave the high-risk category.
A bridge to the Cyber Resilience Act
A high-risk system that meets the essential requirements of the Cyber Resilience Act is presumed to comply with the cybersecurity requirements of Article 15 of the AI Act. For a software vendor, that is one less evidence file.
An AI Office with wider powers
The AI Office becomes the sole authority competent to supervise AI systems built on a general-purpose model by the same provider, as well as those embedded in very large online platforms, with exceptions (Annex I products, law enforcement authorities, financial institutions in particular). It gains investigative powers, on-site inspection and periodic penalty payments. The timeline loosens, enforcement capacity increases.
What this means for your situation
| Your situation | What applies now | What arrives in 2027 or 2028 |
|---|---|---|
| You use a chatbot or publish generated content | Articles 4, 5 and 50 | Nothing more if usage stays the same |
| You use a CV-screening, scoring or benefit-allocation tool | Articles 4 and 5 | Deployer obligations for a high-risk system on 2 December 2027 |
| You publish AI software sold in the EU | Articles 4 and 5, Article 50 depending on system type | If high-risk, Annex IV documentation, conformity assessment and CE marking |
| You are a local authority or public body | Articles 4, 5 and 50 | Fundamental rights impact assessment (FRIA) before any use of a high-risk Annex III system, except critical infrastructure |
The FRIA also covers private companies providing a public service, as well as deployers of creditworthiness-assessment or life and health insurance pricing systems.
Should you use the postponement to wait?
No, for three reasons. Taking inventory of your systems and classifying them takes months, especially when tools were adopted without central validation. Harmonised standards are not finalised, which means fewer turnkey templates, not more time. And your contracts with vendors must provide for the documentation, logs and instructions you will need as a deployer.
There are a little over thirteen months left before 2 December 2027. That is comfortable for a well-scoped project, tight for one that starts in 2027.
FAQ
Has the AI Act been postponed?
No. Only the Chapter III obligations on high-risk systems are shifted. Prohibitions, transparency, general-purpose model rules and AI literacy already apply.
Is the Digital Omnibus final?
Yes for the AI part. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The data part, which concerns the GDPR, is still under negotiation.
What are the new dates for high-risk?
2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products under Annex I.
Is employee AI training still mandatory?
Yes. Article 4 still requires measures for adapted training and awareness. It no longer requires guaranteeing a specific level for each person.
Are SMEs exempt?
No. They benefit from simplified forms and reduced penalties, but the substantive requirements are the same.
Read also
- Am I Covered by the AI Act? The Four-Question Test
- Shadow AI: The Compliance Risk Your Organisation Doesn't See
- Is My AI Prohibited by the AI Act? The Free Article 5 Tool
What now?
To find out which deadlines apply to your own systems, the free DILAIG audit identifies your role and risk level, then lists your obligations article by article. Preview without an account, full report with a free account, data hosted in Switzerland. Public bodies and non-profits can apply for the Public & NGO plan, free subject to eligibility.
Does the postponement change your roadmap, or are you using it to get ahead?
Sources
Take action
Is your AI system compliant?
Free audit in 20 minutes. Detailed report, no commitment.
Start the audit →Keep reading
Practical guides, regulatory analysis, DILAIG news.