The Digital Omnibus and the AI Act: What Changes and What to Do Now

The Digital Omnibus was adopted as Regulation (EU) 2026/1744 and has applied since 27 July 2026. It moves the core obligations for standalone Annex III systems to 2 December 2027 and amends Article 4 AI literacy. Article 50 has continued to apply since 2 August 2026. Only providers of synthetic content systems already on the market before that date have until 2 December 2026 for the machine-readable marking in Article 50(2).

The practical message is calm but clear. Update your roadmap to the dates now fixed in the amended AI Act and use the additional high-risk preparation time to build a stronger file. Below you will read what changed and what that means for your organisation.

What did the Digital Omnibus change?

The final Digital Omnibus simplifies several AI Act obligations. Three practical points matter most: new high-risk application dates, amended wording for AI literacy, and a limited Article 50 transition for older synthetic content systems.

The postponement follows the two routes by which a system can be high-risk. The first route runs through Article 6(2) in combination with Annex III: standalone AI systems in sensitive domains such as recruitment, credit scoring, education, biometrics, critical infrastructure and law enforcement. For this category the date of application shifts from 2 August 2026 to 2 December 2027. The second route runs through Article 6(1) in combination with Annex I: AI embedded as a safety component in regulated products, such as medical devices. For those systems the date shifts to 2 August 2028. The fundamental rights impact assessment of Article 27, the FRIA, follows the high-risk timeline and moves along to 2 December 2027.

For Article 4 AI literacy, the final wording requires providers and deployers to take measures that support the development of AI literacy. The measures should reflect knowledge, experience, education, context of use and affected persons. Organisations do not have to guarantee a specific individual level, and the law prescribes no standard course or certificate.

The third point is what the Omnibus deliberately does not do. The transparency obligations under Article 50, such as making clear that someone is talking to a chatbot and labelling deepfakes and synthetic content, are not postponed. They simply took effect on 2 August 2026.

What is the legal status now?

The legislative process is complete. The amendment is binding law.

In concrete terms, 2 December 2027 is now the fixed application date for the core obligations concerning Annex III systems. For high-risk systems covered by Article 6(1) and Annex I, the fixed date is 2 August 2028.

The timeline at a glance

The table below shows the dates in the amended AI Act.

What applies regardless?

The postponement is selective. Three blocks do not move and therefore call for action now.

Prohibited practices (Article 5) have applied since 2 February 2025 and stand entirely apart from the high-risk timeline. The Omnibus in fact adds a new prohibition on non-consensual intimate imagery, with a transition period until 2 December 2026.

GPAI model obligations have applied since 2 August 2025, with the final GPAI Code of Practice of 10 July 2025 as a practical guide. Since 2 August 2026 the Commission and the AI Office gain full enforcement powers, with a fine via the supervisory authority of up to 3 percent of worldwide annual turnover or 15 million euro. Existing GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

Transparency obligations (Article 50) have applied since 2 August 2026 and are not touched by the Omnibus. For the machine-readable marking of AI content there is a grace period until 2 December 2026 for systems already on the market. Anyone deploying chatbots, deepfakes or synthetic content should prepare for this now. For a step-by-step approach, see the transparency obligations checklist.

What does this mean for your planning?

The core is simple: use the dates in Regulation (EU) 2026/1744 and use the additional time for high-risk systems to work more thoroughly, not to begin later.

How do you put this into practice?

For execution it helps to separate the two tracks: governance and evidence on the organisation side, and people and literacy evidence on the side of your staff.

Embed AI runs an AI governance scan and a Readiness Sprint with which you order scope, AI inventory, risk classification and evidence around the right dates. The scan separates obligations that apply now from the later high-risk dates, so implementation effort goes to the right controls first.

LearnWize makes the people side demonstrable: per role which knowledge is appropriate, with assessments, learning paths and training records that can support internal evidence. Under the amended Article 4, it is sensible to select role-based measures and record the choices made and initiatives delivered.

For the legal background on the postponement, read the explainer on the postponement of the high-risk obligations to December 2027, and for the state of the political process the status of the Digital Omnibus.