Digital Omnibus and the EU AI Act: what changed in 2026

1. What is it?

On 19 November 2025 the European Commission proposed a package simplifying EU digital law, including a part on AI. After a political agreement in May 2026, the text was signed on 8 July 2026 and published in the Official Journal on 24 July 2026 as Regulation 2026/1744. It directly amends Regulation (EU) 2024/1689 (the "AI Act"): to know the applicable law, read both texts together, or the consolidated version on EUR-Lex.

2. What is postponed

• Annex III high-risk systems (recruitment, credit, education, biometrics, essential services…): obligations apply from 2 December 2027 instead of 2 August 2026.
• High-risk systems embedded in regulated products (Annex I): medical devices, toys, etc., from 2 August 2028 instead of 2 August 2027.
• Marking of generated content (Article 50(2)): systems placed on the market before 2 August 2026 have until 2 December 2026. The other Article 50 obligations apply since 2 August 2026.
• National regulatory sandboxes: set-up deadline moved to 2 August 2027.

3. What changes in substance

• AI literacy (Article 4): the duty to "ensure" a sufficient level of AI literacy becomes a duty to take measures to support it. The text states that no specific level has to be guaranteed.
• Two new prohibitions (Article 5): systems generating non-consensual intimate imagery of an identifiable person, or child sexual abuse material. Applicable from 2 December 2026.
• SMEs and small mid-caps: simplified documentation, proportionate quality management system, priority access to sandboxes.
• Registration: Annex III systems that the provider considers not high-risk (Article 6(3)) must still be registered, with less information.
• Safety components: a system that merely assists an operator or optimises performance, with no health or safety risk on failure, is not a safety component.
• Bias detection: processing special categories of data to detect and correct bias is extended beyond high-risk systems, subject to strict necessity.
• AI Office: stronger competence over systems built on a general-purpose AI model by the same provider, and over those integrated into very large online platforms.

4. What already applies

• Prohibited practices (Article 5): since 2 February 2025.
• Staff AI literacy (Article 4): since 2 February 2025, in its softened form since July 2026.
• General-purpose AI models (Articles 51 to 56): since 2 August 2025.
• Transparency (Article 50): since 2 August 2026.

For high-risk systems already on the market before their application date, Article 111 sets transitional rules; systems intended for use by public authorities must comply by 2 August 2030 at the latest. Check your situation in the consolidated text.

5. Consolidated timeline