Digital Omnibus: what changes in the AI Act, and when?

The Digital Omnibus on AI is the EU law that simplifies parts of the AI Act and moves the high-risk dates. It started as Commission proposal COM(2025)836 of 19 November 2025. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. The amended AI Act is now the legal basis for planning and compliance; earlier status updates on the agreement or the votes have been overtaken.

The deferral is selective. Article 50 on transparency has applied since 2 August 2026 and was not postponed; only the machine-readable marking gets extra time until 2 December 2026 for systems already on the market before that date (Article 111(4)). The prohibited practices in Article 5 have applied since 2 February 2025 and the Omnibus only adds a ban. The GPAI model obligations have applied since 2 August 2025 and since 2 August 2026 the Commission can enforce them, including fines (Article 101). Providers of GPAI models already on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)).

Regulation (EU) 2026/1744 changed the application dates for high-risk AI. The core obligations for Annex III systems apply from 2 December 2027. For high-risk AI in products covered by EU sectoral safety legislation in Annex I, the date is 2 August 2028 (Article 113). The fundamental rights impact assessment in Article 27 follows the high-risk timeline. A high-risk system already in use before those dates is caught only once it is significantly changed; systems intended for use by public authorities must comply by 2 August 2030 at the latest (Article 111(2)). The proposed mechanism that tied the dates to available standards did not make the final text: the dates are fixed.

Since 27 July 2026, Article 4 requires providers and deployers to take measures that support the development of AI literacy. They must consider knowledge, experience, education, context of use and affected persons. The law requires no specific individual level, standard course or certificate. Training can be an appropriate measure, but it is not the only possible measure. The original proposal wanted to replace the duty with encouragement; that did not make the final text.

The final regulation retains EU database registration for systems that are not treated as high-risk under Article 6(3) (Article 49(2)), while simplifying the information that must be registered (Annex VIII, Section B). Providers must document their assessment in advance and national competent authorities may request it. Classification evidence therefore remains important. The proposal to delete this registration did not make the final text.

The Omnibus adds two bans to Article 5: AI systems that generate or manipulate realistic intimate or sexually explicit images of an identifiable person without explicit consent, and AI systems that generate child sexual abuse material (Article 5(1)(ba) and (bb)). They apply from 2 December 2026 (Article 113(a)). For a system that does not have such material as its purpose but can foreseeably produce it, what counts is whether it has reasonable and adequate technical safeguards (Article 5(1a)). On the same date the extra time for machine-readable marking of existing systems ends (Article 111(4)). For AI systems built on a GPAI model from the same provider and for AI in very large online platforms, the AI Office is the exclusive supervisor (Article 75(1)).

Since the Omnibus, SMEs, including start-ups, may meet parts of the quality management system in a simplified way (Article 63); previously only micro-enterprises could. Small mid-cap companies may also provide the technical documentation in simplified form (Article 11(1)) and get priority access to the AI Office’s Union-level regulatory sandbox (Article 57(3a)). For fines, SMEs pay the lower of the amount or percentage (Article 99(6)); small mid-caps only for the fines in paragraphs 4 and 5, not for a prohibited practice (Article 99(6a)). That lowers the burden, but the core questions remain: which system, which role and what evidence?

In January 2026, the EDPB and EDPS published their Joint Opinion on the proposal then under discussion. Their core message was that simplification must not lower the level of fundamental rights protection. The final regulation retained registration under Article 49(2), although simplified, and added safeguards for processing special-category personal data in bias detection. Article 4 remained a direct duty for providers and deployers, with amended wording.