The Digital Omnibus on AI: What Changed in 2026

Update - 29 July 2026: The Digital Omnibus on AI is now law. It was formally adopted on 8 July 2026, published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744, and entered into force on 27 July 2026. The dates below are now binding.

On 6 May 2026 the European Council and Parliament reached a provisional agreement on the Digital Omnibus on AI, a targeted set of amendments to the EU AI Act. The European Parliament granted its final approval on 16 June 2026, and the regulation was signed into law in July 2026.

Here is what actually changed - and what did not.

1. High-risk obligations postponed

The most consequential change: the applicability dates for high-risk AI systems move by more than a year.

• Stand-alone Annex III systems (HR, credit scoring, law enforcement, education, biometrics, border control): apply from 2 December 2027.
• AI embedded in Annex I regulated products (medical devices, machinery, vehicles, toys): apply from 2 August 2028.

The original conditional trigger mechanism proposed by the Commission was replaced with these fixed dates.

2. New Article 5 prohibition: nudifiers and CSAM

A new prohibition is added to Article 5: AI systems that generate or manipulate non-consensual intimate imagery or child sexual abuse material are banned. Notably, the prohibition also captures general-purpose image/video tools where such misuse is a reasonably foreseeable outcome and adequate technical safeguards are missing. A transitional period runs until 2 December 2026.

3. Watermarking grace period

AI systems placed on the market before 2 August 2026 benefit from a 4-month grace period on the Article 50(2) watermarking obligation - until 2 December 2026. The broader Article 50 transparency obligations (chatbot disclosure, deepfake labelling) are unaffected and apply on 2 August 2026.

4. AI literacy softened

The Article 4 AI literacy obligation - in force since 2 February 2025 - is softened. Providers and deployers are required to support the development of AI literacy among their staff, rather than to guarantee a specific level.

5. Bias detection broadened

The legal basis to process special-category personal data for bias detection extends beyond high-risk providers to all AI systems and GPAI models - subject to a strict necessity standard.

6. AI Office powers reinforced

The EU AI Office gains exclusive competence over AI systems built on GPAI models where the model and system come from the same provider, and over AI in VLOPs/VLOSEs under the DSA. It also gets new investigation, inspection and fining powers.

7. Sandboxes

The deadline for member states to establish national AI regulatory sandboxes moves to 2 August 2027, and real-world testing outside sandboxes is opened up to Annex I high-risk systems.

What did NOT change

• 2 August 2026 remains a live date for Article 50 transparency obligations.
• Prohibited practices (Art. 5) and AI literacy duties, both applicable since 2 February 2025, remain in force.
• GPAI model obligations (Art. 51-56), applicable since 2 August 2025, continue as before.
• The core architecture of the AI Act - risk-based classification, provider/deployer duties, penalties - is intact.

What this means for your compliance programme

1. Do not stand down. The high-risk delay is a deferral, not a repeal. Annex IV technical documentation, data governance, human oversight and post-market monitoring take 12-18 months to build properly.
2. Deliver Article 50 by August. Chatbot disclosure, labelling of AI-generated content, and watermarking for new systems all bite on 2 August 2026.
3. The new dates are binding as of 27 July 2026 - update your compliance roadmap accordingly.
4. Reassess your risk register - the softened AI literacy standard changes what "compliant" looks like, and the new Article 5 prohibition may reach general-purpose image/video tools you already use.

Not sure what applies to your AI systems today? Take our free readiness assessment - updated for the Omnibus - and get a personalised report in minutes.