Digital Omnibus on AI

The Digital Omnibus on AI started as Commission proposal COM(2025)836 of 19 November 2025. After the political agreement of 7 May 2026, the European Parliament and Council adopted the final text. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. The amended AI Act is now the legal basis for planning and compliance.

Regulation (EU) 2026/1744 changed the application dates for high-risk AI. The core obligations for Annex III systems apply from 2 December 2027. For high-risk AI in products covered by EU sectoral safety legislation in Annex I, the date is 2 August 2028. This gives organisations more implementation time, but does not remove the need to classify systems now, set supplier expectations and build evidence.

Since 27 July 2026, Article 4 requires providers and deployers to take measures that support the development of AI literacy. They must consider knowledge, experience, education, context of use and affected persons. The law requires no specific individual level, standard course or certificate. Training can be an appropriate measure, but it is not the only possible measure.

The final regulation retains EU database registration for systems that are not treated as high-risk under Article 6(3), while simplifying the information that must be registered. Providers must document their assessment in advance and national competent authorities may request it. Classification evidence therefore remains important.

Article 50 generally continues to apply from 2 August 2026. Only providers of systems that generate synthetic audio, image, video or text and were already on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking in Article 50(2). The new prohibitions concerning child sexual abuse material and non-consensual intimate material apply from 2 December 2026. The AI Office gains centralised supervision for certain GPAI-based systems.

The Digital Omnibus continues to push proportionate application for SMEs, startups and small mid-cap companies. This includes simplified quality management systems, better access to regulatory sandboxes and implementation support. That lowers execution burden, but it does not remove the core questions: which AI system are you using, does it fall under Annex III, what is your role as provider or deployer, and what documentation can you show to regulators or buyers?

On 21 January 2026, the EDPB and EDPS published their Joint Opinion on the proposal then under discussion. Their core message was that simplification must not lower the level of fundamental rights protection. The final regulation retained registration under Article 49(2), although simplified, and added safeguards for processing special-category personal data in bias detection. Article 4 remained a direct duty for providers and deployers, with amended wording.