The Digital Omnibus on AI is Regulation (EU) 2026/1744, which amends the Artificial Intelligence Act (AI Act). Its main change is to postpone the obligations for high-risk systems: those under Annex III apply from 2 December 2027, and those for AI embedded in Annex I regulated products from 2 August 2028. It was published in the Official Journal of the EU on 24 July 2026 and has been in force since 27 July.
What has not moved matters just as much. Prohibited practices, AI literacy, the obligations for general-purpose AI models and the Article 50 transparency rules keep their dates, and some already apply.
Which dates move
The postponement covers Sections 1 to 3 of Chapter III of Regulation (EU) 2024/1689: classification, the requirements for high-risk systems and the obligations of providers and deployers. That block includes risk management, technical documentation, human oversight and the fundamental rights impact assessment.
Annex III lists the uses that are high-risk in their own right: recruitment, creditworthiness assessment, life and health insurance, education, access to essential public services and biometrics, among others. Annex I covers AI that acts as a safety component of products already subject to their own EU legislation, such as machinery or medical devices.
The full timeline after the Omnibus
| Date | What applies | Under the Omnibus |
|---|---|---|
| 2 Feb 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) | Unchanged. Article 4 is reworded |
| 2 Aug 2025 | General-purpose AI models, governance and penalties | Unchanged |
| 2 Aug 2026 | Article 50 transparency and the rest of the Regulation except high-risk | Unchanged |
| 2 Dec 2026 | Two new prohibitions and end of the marking grace period for generative systems already on the market | New |
| 2 Aug 2027 | Each Member State must have at least one national AI regulatory sandbox | New deadline |
| 2 Dec 2027 | Annex III high-risk systems | Postponed |
| 2 Aug 2028 | Annex I high-risk systems | Postponed |
The legally binding text is the one published in the Official Journal. EUR-Lex has a consolidated version of the AI Act as at 27 July 2026 that already includes the amendments and is the easiest one to work from.
What changes besides the dates
Two new prohibitions. Article 5 now also covers generating or manipulating intimate images of people without their consent, and generating child sexual abuse material. Both apply from 2 December 2026 and fall into the highest fine bracket: up to EUR 35 million or 7% of worldwide annual turnover.
A grace period for marking synthetic content. Systems that generate images, audio, video or text and were already on the market before 2 August 2026 have until 2 December 2026 to mark their output as AI-generated, as Article 50(2) requires. New systems have to comply from day one.
AI literacy is reworded. It has been mandatory since February 2025, but the new text makes clear that providers and deployers must promote a sufficient level of AI literacy among their staff according to their role, without having to guarantee a specific level for each person.
Sensitive data to correct bias. A new Article 4a allows special categories of personal data to be processed to detect and correct bias, subject to conditions: synthetic or anonymised data must not be sufficient, the data must be pseudonymised, it must not be shared and it must be deleted once the work is done.
Lighter requirements for SMEs. The simplified quality management system and technical documentation are extended to SMEs and small mid-cap enterprises, which also get a cap on fines.
FRIA and DPIA together. Article 27 now allows the fundamental rights impact assessment to refer to the GDPR data protection impact assessment or incorporate parts of it. We explain this in what a FRIA is and who has to carry one out.
What we would do with the extra time
Our reading is that the Omnibus buys time to do the work properly, not to start it later. The hardest part of high-risk compliance is not drafting the technical documentation. It is knowing which AI systems the company uses, who bought them, what data they run on and what decisions they make. That inventory underpins everything else and does not depend on any deadline.
If we had to plan the coming months, this is the order we would follow:
- Before 2 December 2026, review the generative systems already in production (assistants, image generators, chatbots) and check that their output is marked.
- During 2026, complete the inventory and classification: which systems are high-risk, which are limited-risk and what role the company plays in each one, provider or deployer.
- In 2027, the requirements for each high-risk system: risk management, data, logging, human oversight and, where it applies, the FRIA.
In GlobalSuite® AI Governance the Regulation is already loaded with 2 December 2027 as the date for every high-risk requirement, and the inventory classifies each system by its AI Act risk level. That way you can see what is missing for each system and how much time is left.
For more detail on roles, risk levels and fines, see our practical guide to the AI Act, already updated for the Omnibus, and our article on the EU Artificial Intelligence Act.
