EU AI Act Digital Omnibus: What Regulation 2026/1744 Changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, is an adopted amendment to the EU AI Act that entered into force on 27 July 2026. It delays high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), adds two new prohibitions, softens the AI literacy duty and extends SME relief to small mid-caps.

Key takeaways

• The Omnibus is law, not a proposal: published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
• Only some obligations moved. Prohibitions, GPAI rules and Article 50 transparency were not delayed.
• Annex III high-risk systems (HR, credit, education and so on) now comply from 2 December 2027; AI in Annex I products from 2 August 2028.
• New bans on nudifier apps and AI-generated child sexual abuse material apply from 2 December 2026.
• Article 4 on AI literacy now asks providers and deployers to take measures to promote AI literacy, rather than to ensure a sufficient level.
• Small mid-caps (fewer than 750 staff) now share several SME reliefs, including proportionate documentation and tailored penalty caps.

What the Digital Omnibus is, and why it exists

The Commission tabled the Digital Omnibus package in late 2025 as part of its simplification agenda. The AI-specific part became Regulation (EU) 2026/1744, which amends Regulation (EU) 2024/1689. The practical trigger was timing. The high-risk rules were meant to apply from 2 August 2026, but the harmonised standards that providers rely on to show conformity, and several pieces of Commission guidance, were not ready. Without them, companies would have faced binding obligations with no agreed way to meet them.

The result is a targeted amendment rather than a rewrite. The risk-based structure, the role definitions and the penalty ceilings remain as they were. If you need a refresher on that structure, see how the EU AI Act works. If you would rather see straight away which amended dates hit your own systems, the AI Act gap assessment already reflects the Omnibus.

Before vs after: what changed

Was the EU AI Act delayed?

Only some obligations were delayed. This is the most common misunderstanding we hear. Headlines about an "AI Act delay" refer to the high-risk chapter. Everything else kept its date:

• Prohibitions have applied since 2 February 2025 and were extended, not delayed.
• AI literacy has applied since 2 February 2025; the wording changed, the start date did not.
• General-purpose AI model obligations have applied since 2 August 2025.
• Article 50 transparency applied on schedule on 2 August 2026.
• Penalties and governance have applied since 2 August 2025.

So a company running a customer-facing chatbot had to label it as AI from August 2026, Omnibus or not. A company using AI to shortlist candidates gained time, until December 2027, to prepare for high-risk deployer duties. The full EU AI Act timeline sets every date side by side.

The changes in more detail

High-risk deadlines: more time, same obligations

The Omnibus moves the dates but leaves the substance of Chapter III largely intact. Providers of Annex III systems still need risk management, data governance, technical documentation, logging, transparency to deployers, human-oversight design, accuracy and robustness controls, a quality management system, conformity assessment and EU database registration. Deployers still carry the Article 26 duties and, where relevant, the Article 27 fundamental rights impact assessment. The extra 16 months are meant to let standards land, not to let organisations wait. Our guide to high-risk AI systems under Annex III lists what each role must do.

Two new prohibitions

Article 5 now also bans placing on the market, putting into service or using AI systems to generate non-consensual intimate imagery of identifiable people (the "nudifier" category) and child sexual abuse material. These apply from 2 December 2026 and fall under the highest penalty tier. For general-purpose image generators, the practical questions are safeguards, abuse monitoring and how marketplace or plug-in ecosystems are policed.

Article 50: unchanged date, short grace period

Disclosure duties for chatbots, emotion recognition, biometric categorisation and deepfakes applied from 2 August 2026 as planned. The one concession is for providers of generative AI systems already on the market before that date: they have until 2 December 2026 to implement machine-readable marking of outputs. Systems launched after 2 August 2026 get no grace period. See our Article 50 transparency obligations article for chatbot and deepfake examples.

Article 4: AI literacy reframed

The amended Article 4 frames the duty as taking measures to promote AI literacy among staff and other people operating or using AI systems on the organisation's behalf. It expressly does not require an organisation to guarantee a specific level of literacy for any individual, and it gives the Commission and Member States a supporting role, especially for smaller companies. In practice this lowers the risk of an impossible-to-prove standard, but it does not remove the duty. A proportionate programme (role-based training for people using AI in HR, finance or customer service, an acceptable use policy, records of what was delivered) is still the sensible baseline. Our article on AI literacy under Article 4 walks through what that can look like. Always check the consolidated text for the exact wording.

Small mid-caps join the SMEs

Companies with fewer than 750 employees and either turnover up to €150 million or a balance sheet up to €129 million now benefit from simplified technical documentation, a proportionate quality management system, priority access to regulatory sandboxes and tailored penalty caps. For many European scale-ups and mid-sized software vendors, this materially reduces the documentation burden for high-risk systems.

Bias detection and special-category data

A new Article 4a replaces Article 10(5) and provides a broader legal basis to process special categories of personal data, such as ethnicity or health data, where strictly necessary to detect and correct bias. It now reaches deployers of high-risk systems and providers of other AI systems and models as well, and it is a permission, not a duty to carry out bias detection. GDPR still applies in full, so you need safeguards, minimisation, access controls and deletion once the purpose is met.

More central supervision

The AI Office now has exclusive supervision over AI systems built on a GPAI model by the same provider or group, and over AI integrated in very large online platforms and search engines. For most businesses deploying such tools this changes little day to day, but it does mean one EU-level regulator rather than 27 national ones for the largest model providers' own products.

What the Omnibus means for your compliance plan

1. Do not pause the programme. Re-sequence it. Prohibited-use checks, AI literacy measures and Article 50 disclosures are enforceable now.
2. Update your AI inventory. Re-tag each system with its post-Omnibus date, and note whether you are provider or deployer.
3. Check your size category. If you are a small mid-cap, you may qualify for lighter documentation and lower penalty caps.
4. Use the extra time for the hard parts. Vendor due diligence, contract clauses, logging and human-oversight design take longest. Start them in 2026.
5. Refresh your policies. Policies written in 2025 often quote the old Article 4 wording and the old August 2026 high-risk date.

Frequently asked questions

Is the Digital Omnibus on AI still a proposal?

No. It was adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act directly, so the amended dates and wording are binding EU law. Refer to the consolidated text rather than to the 2025 Commission proposal, which differs in places.

Does the Omnibus remove the AI literacy requirement?

No. Article 4 still applies to providers and deployers. The amended text frames it as a duty to take measures to promote AI literacy, rather than to ensure a sufficient level, and states that it does not require guaranteeing a specific level for any individual. Training, guidance and records remain the practical way to show compliance.

Did the Digital Omnibus change the fines?

The maximum ceilings in Article 99 stayed at €35 million or 7%, €15 million or 3%, and €7.5 million or 1% of worldwide annual turnover. The main change is that tailored penalty caps for SMEs now also cover small mid-caps. The new nudifier and abuse-material bans fall in the top tier.

Should we wait for more changes before starting compliance work?

No. The Omnibus has settled the dates for the next few years, and several obligations are already enforceable. Waiting compresses high-risk work into 2027, when vendors, auditors and notified bodies will be busiest. An inventory and a gap analysis now cost little and make later decisions cheaper.

Get your AI Act documents written

The Omnibus changed the calendar, not the need for governance. Opsio's free AI governance assessment takes about 40 minutes across 14 steps. When you submit, you receive four editable Word documents written from your answers (AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template) and a maturity score across ten governance areas. No card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Statements reflect the position as of October 2026.