The Digital Omnibus on AI: What Regulation 2026/1744 Changed

The legal framework

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, the third day after publication (Article 4). It amends three texts: the AI Act, Regulation (EU) 2024/1689 (Article 1), the civil aviation Regulation (EU) 2018/1139 (Article 2) and the Machinery Regulation (EU) 2023/1230 (Article 3).

The amendments are now part of the AI Act itself. EUR-Lex publishes a consolidated version of the AI Act of 27 July 2026. When this article cites an AI Act article, it means the article as amended.

The recitals explain why. Standards that give providers of high-risk AI technical solutions were late, and so was the set-up of national authorities (recital 2). The Omnibus therefore buys time and makes targeted changes. It does not rewrite the risk-based structure of the AI Act.

The new dates

Article 113 of the AI Act, as amended, now reads as follows:

• 2 February 2025: Chapters I and II (definitions, AI literacy, prohibitions) keep their date.
• 27 July 2026: Articles 102 to 110 (the amendments to other EU acts) apply.
• 2 August 2026: the general date of application stays. This includes the transparency duties of Article 50.
• 2 December 2026: the two new prohibitions in Article 5(1), points (ba) and (bb), and the rules in Article 5(1a) and (1b) apply.
• 2 December 2027: Chapter III, Sections 1 to 3 apply to high-risk AI systems under Article 6(2) and Annex III, such as AI used in recruitment, education or credit scoring.
• 2 August 2028: the same rules apply to high-risk AI systems under Article 6(1) and Annex I, which are safety components of products such as toys, lifts or medical devices.

Two transition rules in Article 111 matter too. Providers of generative AI systems placed on the market before 2 August 2026 must mark synthetic output under Article 50(2) by 2 December 2026 (Article 111(4)). High-risk systems already on the market before their Chapter III date fall under the Act only if their design changes significantly afterwards, but systems intended for public authorities must comply by 2 August 2030 in any case (Article 111(2)).

What else changed, article by article

• AI literacy (Article 4). Providers and deployers must "take measures to support the development of AI literacy" of their staff and others operating AI on their behalf. The text now says the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". The Commission will publish practical examples.
• Bias detection (new Article 4a). Providers of high-risk AI may exceptionally process special categories of personal data to detect and correct bias, under six cumulative conditions: no other data will do, technical limits and pseudonymisation, strict access controls, no transfer to other parties, deletion once the bias is corrected, and a record of why it was necessary. Article 10(5), which held the old rule, was deleted. Article 4a(2) gives the same option, under the same safeguards, to other providers and to deployers.
• Two new prohibitions (Article 5(1), points (ba) and (bb)). AI systems that generate or manipulate realistic intimate images of an identifiable person without that person's explicit consent are banned, and so are systems that generate child sexual abuse material, except where national law allows a "without right" defence. Article 5(1a) limits the ban for providers to systems whose intended purpose is such content, or where it is a "reasonably foreseeable and reproducible outcome" and the system lacks adequate safeguards. Deployers are caught only when they use a system for that purpose.
• Safety component (Article 3(14) and Article 6(1a) to (1c)). AI used only for user assistance, performance optimisation, efficiency, automation, convenience or quality control is not a safety component, unless its failure would endanger health and safety. A product that needs third-party assessment only for non-safety reasons, such as radio interference, no longer meets the condition of Article 6(1)(b).
• SMEs and small mid-caps. New definitions in Article 3(14a) and (14b) bring in the small mid-cap enterprise (SMC) from Recommendation (EU) 2025/1099. SMEs and SMCs may file technical documentation on a simplified Commission form, which notified bodies must accept (Article 11(1)). The quality management system is proportionate to size (Article 17(2)). Fines for SMCs are capped at the lower of the percentage and the amount (Article 99(6a)).
• The supply chain (Article 25). When someone else becomes the provider of a high-risk system, the initial provider must hand over technical documentation, explain known limitations and failure modes and give targeted technical access, unless it clearly specified that its system is not to be changed into a high-risk system (Article 25(2)). Suppliers of AI systems, models, tools, services or components used in a high-risk system must agree in writing with the provider on the information, capabilities, technical access and other assistance it needs (Article 25(4)). Breaching Article 25(2) or (4) can now be fined under Article 99(4), point (da).
• Fundamental rights impact assessment (Article 27(4) and (5)). A deployer may cross-refer to its data protection impact assessment, and the AI Office will offer a questionnaire template.
• Cybersecurity (Article 42(3)). High-risk AI that meets the Cyber Resilience Act's conditions in its Article 12(1) is deemed to comply with Article 15 of the AI Act.
• Sandboxes and testing (Articles 57, 58, 60 and new 60a). Each Member State must have a national AI regulatory sandbox operational by 2 August 2027. The AI Office may run a sandbox at EU level. Real-world testing outside sandboxes is extended to products under Section A of Annex I, and Member States may allow it for Section B products.
• The AI Office (Articles 75 and 75a to 75d). The AI Office becomes exclusively competent for AI systems based on a general-purpose AI model where the model and the system come from the same provider or group, and for AI in very large online platforms and search engines, with some exceptions (Article 75(1)). It gets inspection powers, can accept binding commitments and can impose fines and periodic penalty payments, the latter of up to 5% of average daily income or worldwide annual turnover per day (Article 75c(5)).
• Codes and guidelines (Articles 50(7), 56(6) and 96). The Commission assesses whether codes of practice are adequate and can adopt implementing acts if they are not. New guidelines on combining AI Act duties with sector product rules are due by 1 August 2027 (Article 96(1)(g)).
• Machinery. Machinery moves from Section A to Section B of Annex I. The Commission must add AI requirements to the Machinery Regulation by delegated acts that apply by 2 August 2028 (Article 3 of the Omnibus).

In practice

An HR software company in Leuven sells a CV-ranking tool. That is an Annex III use. Its high-risk duties start on 2 December 2027, not on 2 August 2026. If it is an SME, it can use the simplified documentation form once the Commission publishes it. What has not moved: AI literacy since 2 February 2025, and Article 50 transparency since 2 August 2026 for its candidate chatbot.

A Ghent design agency uses an image generator that its supplier put on the market in 2025. Under Article 111(4) the supplier must mark synthetic output by 2 December 2026. As a deployer, the agency must still disclose deepfakes under Article 50(4). The agency should ask its supplier, in writing, how and when marking will work.

A machine builder in Kortrijk integrates a vision system that stops a press when a hand comes near. That system fulfils a safety function, so it is a safety component. Its quality inspection camera, which only sorts parts, is not, unless its failure would endanger health and safety (Article 6(1a) and (1b)). Because machinery now sits in Section B of Annex I, most AI Act duties do not apply to it directly (Article 2(2)). The AI requirements will reach the press through delegated acts under the Machinery Regulation, which must apply by 2 August 2028.

A software group that builds a model and an assistant on top of it now deals with the AI Office as regulator for that assistant, not with a national authority, unless an exception in Article 75(1)(a) applies.

Contracts and practical steps

1. Update your AI inventory. Record for each system which date applies: Annex III (2 December 2027), Annex I (2 August 2028) or Article 50 (now). Our AI Act register does this per system.
2. Check your size. Confirm whether you are an SME or an SMC under the two Recommendations. It decides whether you can use the simplified forms and the lower fine cap.
3. Rewrite supplier contracts. Article 25(4) now requires a written agreement on information, capabilities and technical access. Add a clause on known limitations and failure modes, testing access and cooperation if your customer becomes a provider. See AI clauses in vendor contracts. Document Studio helps you draft and review these clauses.
4. Review your bias testing. If you process sensitive data to test for bias, document the six conditions of Article 4a(1) in your records of processing.
5. Adjust AI literacy. Keep the training programme. Record what measures you take, for whom and why, rather than test scores.
6. Use the time. Technical documentation, risk management and a quality management system take months to build.

Frequently asked questions

Did the Omnibus postpone Article 50?

No. Article 50 applies from 2 August 2026. Only generative systems already on the market before that date get until 2 December 2026 for output marking under Article 50(2).

Is AI literacy still mandatory?

Yes. Article 4 still applies since 2 February 2025. The duty is to take measures that support AI literacy. You do not have to guarantee a specific level for each person.

Who counts as a small mid-cap?

An enterprise that meets the definition in point (2) of the Annex to Recommendation (EU) 2025/1099, as referred to in Article 3(14b). Check the Recommendation itself for the thresholds.

Can a supplier refuse to help me comply?

Not if it supplies components for your high-risk AI system: Article 25(4) requires a written agreement on the help you need. The duty does not apply to tools and components made public under a free and open-source licence, except general-purpose AI models.

Does the Omnibus change the GDPR?

No. Article 2(7) of the AI Act still says the Act does not affect the GDPR, without prejudice to Articles 4a and 59. A separate proposal, the wider Digital Omnibus, would change the GDPR. See the wider Digital Omnibus.

How this connects

This article is part of our series on the EU digital rulebook. Start with the EU digital rulebook in 2026. For every AI Act date in one table, see the AI Act timeline. The rules for general-purpose models are in general-purpose AI: codes, guidelines and standards, and the proposed changes to the GDPR, cookies and the Data Act in the wider Digital Omnibus. For the basics, read the practical overview of the AI Act.

Our AI Act compliance service maps the new dates to your systems, and our commercial contracts team updates your supplier and customer terms.

Provisions cited. Regulation (EU) 2026/1744, Articles 1 to 4. AI Act, Articles 3(14), (14a) and (14b), 4, 4a, 5(1)(ba) and (bb), 5(1a) and (1b), 6(1a) to (1c), 11(1), 17(2), 25(2) and (4), 27(4) and (5), 42(3), 50, 57, 60a, 75 to 75d, 96(1)(g), 99(4)(da) and (6a), 111 and 113.

Key dates. 24 July 2026: publication. 27 July 2026: entry into force. 2 December 2026: new prohibitions and Article 50(2) for older generative systems. 2 August 2027: national sandboxes operational. 1 August 2027: guidelines under Article 96(1)(g). 2 December 2027: Annex III high-risk. 2 August 2028: Annex I high-risk. 2 August 2030: high-risk systems used by public authorities.

Sources. Regulation (EU) 2026/1744, AI Act, Regulation (EU) 2024/1689 and its consolidated text of 27 July 2026.