Digital Omnibus on AI: What Regulation (EU) 2026/1744 Changed in the AI Act, Including the New High-Risk Dates

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026, which amends the AI Act in 43 points and has applied since its entry into force on 27 July 2026. Its most visible change moves the high-risk rules of Chapter III Sections 1 to 3 to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems. It also adds two prohibited practices, on non-consensual intimate material and on child sexual abuse material, which apply from 2 December 2026.

The amendment changes the law without replacing it. Regulation (EU) 2026/1744 amends the EU AI Act, Regulation (EU) 2024/1689 in force since 1 August 2024, and two sector regulations: Regulation (EU) 2018/1139, the EASA Basic Regulation, and Regulation (EU) 2023/1230 on machinery. This page sets out the 22 changes, the dates moved and kept, and what the co-legislators dropped from the Commission proposal.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Is the Digital Omnibus on AI?

The Digital Omnibus on AI is an amending regulation of the European Parliament and the Council that changes application dates, several duties and the governance rules of Regulation (EU) 2024/1689, together with two sector acts. Adopted under Article 114 TFEU, it has four articles: Article 1 amends the AI Act in 43 points, Article 2 amends Regulation (EU) 2018/1139, Article 3 amends Regulation (EU) 2023/1230, and Article 4 sets the entry into force. Its own 47 recitals explain the changes but are not inserted into the AI Act, which keeps its 180 recitals.

Regulation (EU) 2026/1744 at a Glance: Title, Official Journal and Entry into Force

Regulation (EU) 2026/1744 was signed in Strasbourg on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, the third day after publication (Article 4), with these identifiers:

Regulation (EU) 2026/1744, Official Journal text; Publications Office Cellar, checked 24 October 2026.

The consolidated text 02024R1689-20260727 merges the amendment into the AI Act but has no legal effect; the two Official Journal publications are the authentic texts. The single corrigendum of 29 September 2026 corrects only the German wording of Article 6(1b), replacing "Unbeschadet" with "Ungeachtet", and changes no date.

Two Different Omnibus Files: the Adopted Regulation and the Pending COM(2025) 837

The Digital Omnibus COM(2025) 837 is a separate proposal of 19 November 2025, pending under procedure 2025/0360(COD), that does not amend Regulation (EU) 2024/1689. The Commission tabled it on the same day as COM(2025) 836, the AI proposal that went through procedure 2025/0359(COD). COM(2025) 837 would amend the GDPR, the ePrivacy Directive, eIDAS, Regulation (EU) 2018/1725, Regulation (EU) 2018/1724, DORA, NIS2, the CER Directive and the Data Act, and its Parliament stage reads "Awaiting committee decision" in the Legislative Observatory as of 24 October 2026.

The Change Register: 22 Changes and Where This Guide Covers Each

Regulation (EU) 2026/1744 touches 42 articles of the AI Act (36 amended, 6 inserted) and three annexes, grouped here into 22 changes with their amending point and date:

Regulation (EU) 2026/1744, Article 1 points (1) to (43), Articles 2 and 3; consolidated text 02024R1689-20260727.

Five rows carry a date later than 27 July 2026, from 2 December 2026 (rows 2 and 3) to 2 August 2028 (rows 1 and 8); the other 17 changes took effect with the amended text on 27 July 2026.

Which Dates the Omnibus Moved, and Which It Left Unchanged

The Omnibus moved Chapter III Sections 1 to 3, except Article 6(5), to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced). Before 27 July 2026, the same sections were to apply from 2 August 2026 and 2 August 2027, a shift of 16 months for Annex III and 12 months for Annex I; the dates around them now read:

Article 113 as replaced by Article 1 point (40) of Regulation (EU) 2026/1744; Articles 43(3), 57(1), 72(3), 111 and 2(13) as amended.

The Commission FAQ "Navigating the AI Act", last updated on 20 October 2026, states: "The rules for high-risk AI systems will apply starting 2 December 2027." Its date is the Annex III date of Article 113, third paragraph, point (c)(i); for Annex I systems point (c)(ii) sets 2 August 2028.

Fixed Dates Instead of the Proposed Stop-the-Clock Mechanism

The adopted text sets fixed dates; the proposed stop-the-clock mechanism, which tied the high-risk rules to a Commission decision, was not adopted. Under Article 113, point (d), as proposed in COM(2025) 836, Chapter III Sections 1 to 3 would have applied 6 months (Annex III) or 12 months (Annex I) after a Commission decision confirming that support measures were available, with long-stop dates of 2 December 2027 and 2 August 2028. The co-legislators dropped the decision and kept the long-stop dates as the application dates of Article 113, third paragraph, point (c).

Why the Chapter III Dates Moved: Recital 40

Recital 40 of Regulation (EU) 2026/1744 gives the reason: harmonised standards, common specifications and guidance were not available in time, and national competent authorities were set up late. The gap is visible in the record: EN 18286:2026 on quality management systems, cited by Commission Implementing Decision (EU) 2026/2274 (OJ of 14 October 2026), is the only harmonised standard cited under the AI Act as of 24 October 2026. The Article 6(5) guidelines on high-risk classification, due by 2 February 2026, exist only as a draft of 19 May 2026 (as of 24 October 2026), and Article 6(5) is the one provision of Sections 1 to 3 excluded from the deferral.

Dates the Omnibus Did Not Move

Five sets of dates stay as adopted in 2024, covering Chapters I and II, governance and GPAI rules, the general date, Article 101 fines and the legacy GPAI deadline:

• Chapters I and II (Article 113, third paragraph, point (a)): apply since 2 February 2025, including Article 4 and Article 5(1), points (a), (b) and (c) to (h); only the new points (ba) and (bb) and Article 5(1a) and (1b) apply from 2 December 2026.
• Governance, notified bodies, GPAI rules and penalties (point (b)): Chapter III Section 4, Chapters V, VII and XII and Article 78 apply since 2 August 2025.
• The general date (Article 113, second paragraph): 2 August 2026, including the Article 50 transparency duties.
• Article 101 fines on providers of general-purpose AI models: from 2 August 2026, up to 3 % of total worldwide annual turnover or EUR 15 000 000, whichever is higher.
• The legacy GPAI deadline (Article 111(3)): models placed on the market before 2 August 2025 comply by 2 August 2027.

Does the Omnibus Change Your Position? Decision Logic in Five Questions

Five questions show whether Regulation (EU) 2026/1744 changes what an operator must do and by when, as an orientation, not a legal assessment:

1. Is the system an Annex III high-risk system? Yes: Chapter III Sections 1 to 3 apply to it from 2 December 2027.
2. Is it a safety component of, or itself, an Annex I product? Yes: for Section A products, Sections 1 to 3 apply from 2 August 2028; for Section B products, which now include machinery, only Article 6(1), Article 60a and Articles 102 to 112 apply.
3. Does it generate synthetic audio, image, video or text, and was it placed on the market before 2 August 2026? Yes: its provider meets the Article 50(2) marking duty by 2 December 2026 (Article 111(4)).
4. Is the operator an SME, a start-up or a small mid-cap enterprise? Yes: simplified technical documentation, proportionate quality management and the lower fine cap of Article 99(6) or (6a) can apply.
5. Is the system built on the provider's own general-purpose AI model, or part of a designated very large online platform or search engine? Yes: the AI Office, not a national authority, supervises it under Article 75(1), subject to four exceptions.

What Changed for Providers, Deployers and Other Operators

Providers gain later high-risk dates, new duties under Article 25(2) and (4) and a shorter registration file, while deployers keep the Article 4 duty and may cross-reference the DPIA in a FRIA. Which change applies depends on the provider vs deployer roles an operator holds for each system among the six operators of Article 3(8). The duties keep their place in Chapter III; their dates, scope and some content moved:

Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; consolidated text 02024R1689-20260727.

Article 25(2) now lists what cooperation covers, in new points (a) to (c): technical documentation, known limitations and failure modes, and targeted technical access. Under Article 25(4), the written agreement with third-party suppliers now names AI models, and the open-source carve-out does not extend to general-purpose AI models. Breaches of Article 25(2) and (4) carry fines of up to EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher (Article 99(4), point (da)).

New Bans, Bias-Data Processing and the Rewritten Literacy Duty

Regulation (EU) 2026/1744 adds two prohibited practices to Article 5(1), points (ba) and (bb), which apply from 2 December 2026. Point (ba) covers AI systems that generate or manipulate realistic images, videos, audio or similar material of an identifiable natural person's intimate parts, or of that person engaged in sexually explicit activities, without freely-given, specific, informed, unambiguous and explicit consent; point (bb) covers systems that generate or manipulate material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a "without right" defence applies under national law. Neither of the bans on AI-generated intimate images and abuse material was in COM(2025) 836; the co-legislators added both, with new paragraphs 1a and 1b, while points (a), (b) and (c) to (h) have applied since 2 February 2025. Article 5(1) now holds ten lettered points, although the Commission's AI Act page counts "nine practices", and breaches carry the highest fine tier of EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)).

Article 4a, inserted by point (6) and headed "Processing of special categories of personal data for bias detection and correction", replaces the deleted Article 10(5) and has applied since 27 July 2026. Paragraph 1 lets providers of high-risk AI systems process such data exceptionally, to the extent strictly necessary for bias detection and correction, under six conditions, points (a) to (f), among them no effective alternative such as synthetic or anonymised data. Paragraph 2 extends the same permission to providers and deployers of other AI systems and models and to deployers of high-risk systems without creating any obligation to detect bias, and Article 2(7) now opens "Without prejudice to Articles 4a and 59".

Article 4, replaced by point (5), keeps AI literacy as a duty: "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". Before 27 July 2026, the single paragraph required them to "take measures to ensure, to their best extent, a sufficient level of AI literacy"; the new text has three paragraphs, adding Commission and Member State support (paragraph 2) and Board recommendations (paragraph 3). Article 4 has applied since 2 February 2025, the Commission's AI literacy Q&A places its supervision with national market surveillance authorities from 2 August 2026, and Article 99(4) does not list it, so the act sets no EU fine amount for it.

Classification, Conformity Assessment and Notified Bodies after the Amendment

Five changes refine the Annex I product route and its conformity assessment: the safety-component definition, Article 6(1a) to (1c), the machinery move to Section B, Article 43(3) and the unified notified-body procedure. Article 3(14) now adds that "a component fulfils a safety function where its intended purpose is to prevent or mitigate risks to health and safety of persons or property". Article 6(1a) states that "AI systems solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control shall not qualify as safety components", while Article 6(1b) makes any AI system whose failure or malfunctioning would endanger health and safety a safety component, and Article 6(1c) excludes products needing third-party assessment solely for risks other than health and safety.

Machinery left Annex I Section A when point 1 was deleted and moved to Section B as point 21, Regulation (EU) 2023/1230 (point (41)). For Section B products, Article 2(2) as replaced applies only Article 6(1), Article 60a and Articles 102 to 112, with Articles 57 to 59 only in so far as sector law integrates them. Article 3 of the Omnibus amends the Machinery Regulation, which applies from 14 January 2027, so that its AI delegated acts apply by 2 August 2028, and Article 2 makes acts on AI safety components under Regulation (EU) 2018/1139 take Chapter III Section 2 into account.

Article 43(3) lets Annex I Section A products follow their sector conformity procedure, which now covers the Section 2 requirements and the Article 17 quality management system, without forcing a third-party route that the sector law does not require (point (19)). Article 28(8) and (9) introduce a single application and a unified assessment for bodies designated under both the AI Act and Section A legislation, and those sector notified bodies apply for AI Act designation by 28 January 2028. Annex XIV, added by point (43), sets the AIP, AIB and AIH codes that define the scope of a designation in the Article 30 notification.

Article 40(2) gains a fourth subparagraph on standardisation deliverables for joint compliance with the AI Act and the Annex I legislation (point (17)), and Article 42(3) deems high-risk AI systems that meet Article 12(1) of the Cyber Resilience Act, Regulation (EU) 2024/2847, to meet the Article 15 cybersecurity requirement.

Small Mid-Caps and SMEs: Definitions, Documentation and Reduced Fines

The Omnibus defines small mid-cap enterprises (SMCs) in Article 3(14b) by reference to Recommendation (EU) 2025/1099 and extends five SME measures to them. The definition reads "'small mid-cap enterprise' or 'SMC' means a small mid-cap enterprise as defined in point (2) of the Annex to Recommendation (EU) 2025/1099", while Article 3(14a) defines SMEs through Recommendation 2003/361/EC. An SMC is by definition not an SME, and five measures now reach it:

• Simplified technical documentation under Article 11(1) (point (10)), previously open to SMEs only.
• Proportionate quality management under Article 17(2), "in particular, if the provider is an SME, including a start-up, or an SMC".
• Priority access to a Union-level sandbox that the AI Office may establish under Article 57(3a).
• Guidance and advice from national competent authorities under Article 70(8) (point (29)).
• A lower fine cap in the Article 99(4) and (5) tiers, where each fine is up to the percentage or amount, whichever is lower (Article 99(6a)).

SMEs, including start-ups, keep the lower amount in all three tiers (Article 99(6)), while for SMCs the Article 99(3) tier for Article 5 breaches stays at the higher of the two amounts. Article 63(1) now grants the simplified quality management system to SMEs, including start-ups, without partner or linked enterprises, where the 2024 text named only microenterprises; Article 95(4) adds SMCs to the interests that the AI Office and Member States take into account for codes of conduct, and Article 62 is unchanged.

AI Office Powers, Sandboxes and Real-World Testing

Since 27 July 2026 the AI Office is exclusively competent for AI systems based on a general-purpose AI model from the same provider or undertaking, with listed exceptions, and for AI systems in designated very large online platforms and search engines (Article 75(1)). The exceptions, Article 75(1), point (a)(i) to (iv), keep four groups outside AI Office competence: AI systems related to products covered by the Annex I legislation; AI systems referred to in Annex III, point 2; AI systems provided by law enforcement authorities, border management authorities and financial institutions, insofar as they fall under Article 74(6); and Annex III, point 8, systems as regards the administration of justice. Before the amendment, Article 75(1) covered only systems built on a model of the same provider; deployers now fall under AI Office competence only when they are also the provider or part of the same undertaking.

Articles 75a to 75d, inserted by point (32), give the AI Office the powers of a market surveillance authority, binding commitments, fines and periodic penalty payments, and procedural safeguards. Article 75(1e) makes the AI Office responsible for third-party conformity assessment of high-risk systems under its competence, entrusted to notified bodies acting on behalf of the Commission. A draft implementing act under Articles 75c and 75d(3), dated 12 October 2026, is open for feedback until 9 November 2026 and has not been adopted.

Article 57(1) now requires each Member State to have at least one national AI regulatory sandbox operational by 2 August 2027, a year later than the 2024 text required, and Article 57(3a) empowers the AI Office to establish a Union-level sandbox for Article 75(1) systems. Article 60 extends testing in real-world conditions outside sandboxes from Annex III systems to Annex I Section A systems. New Article 60a lets Member States, optionally, allow real-world testing of Annex I Section B products under frameworks they notify to the Commission before implementing them.

Proposed versus Adopted: How COM(2025) 836 Changed in the Legislative Procedure

Four points of the Commission proposal COM(2025) 836 of 19 November 2025 did not survive the procedure, and two changes were added by the co-legislators:

COM(2025) 836 final; Regulation (EU) 2026/1744, Official Journal text.

The AI Act Service Desk FAQ on the Omnibus describes the proposal, not the adopted text, so it is no source for the final wording. The staff working document SWD(2025) 836 that accompanied the proposal estimates the EU AI Act compliance costs and savings of the proposed text, not of the adopted regulation.

From Proposal to Official Journal: Procedure 2025/0359(COD)

Procedure 2025/0359(COD) took 247 days from the Commission proposal of 19 November 2025 to publication in the Official Journal on 24 July 2026:

Legislative Observatory 2025/0359(COD) and OEIL summaries of T10-0098/2026 and T10-0198/2026; Commission AI Act page.

Opinions came from the European Central Bank (CON/2026/0010, OJ C, C/2026/2285, 15.4.2026), the European Economic and Social Committee (18 March 2026), the Committee of the Regions (7 May 2026) and, jointly, the EDPS and the EDPB (20 January 2026, recital 47). The original act took longer: the EU AI Act legislative history runs from proposal COM(2021) 206 of 21 April 2021 to publication on 12 July 2024.

How to Update a Compliance Programme after the Omnibus

Five updates bring a compliance programme in line with Regulation (EU) 2026/1744: the new dates, the 2 December 2026 bans and transition, the Article 4 wording, the SME and SMC status and the supervising authority. Each starts from the system inventory, in this order:

1. Re-date the Chapter III Sections 1 to 3 milestones of each high-risk system to the Annex III or Annex I date of Article 113, third paragraph, point (c).
2. Check generative systems placed on the market before 2 August 2026 for Article 50(2) marking, and screen image, video and audio generators against Article 5(1), points (ba) and (bb).
3. Update AI literacy policies to the Article 4 wording in force since 27 July 2026.
4. Determine whether the organisation is an SME, a start-up or an SMC under Article 3(14a) and (14b).
5. Identify the supervising authority, the AI Office or a national market surveillance authority, under Article 75(1).

The requirements of Articles 9 to 15 keep their place in Chapter III Section 2; what moved for Annex III systems is the date from which they apply. A step-by-step EU AI Act compliance programme sets out the sequence for providers and deployers, from inventory to conformity planning.

The simplified quality management system of Article 63(1) lifts no other duty: Article 63(2) keeps Articles 9 to 15, 72 and 73 fully applicable to SMEs that use it.

Obligations differ by role and by risk class. The compliance checklist by role sorts the obligations by role and risk class, with the dates as amended by Regulation (EU) 2026/1744.

Digital Omnibus on AI: Related Questions

Articles 111, 56, 4a and 27 of the AI Act and Articles 2 and 3 of Regulation (EU) 2026/1744 answer the questions on versions, legacy systems, codes, data protection and sector law that follow the main changes.

Is the Consolidated Text of 27 July 2026 Legally Binding?

No: the consolidated text 02024R1689-20260727 is a documentation tool without legal effect.

The consolidated text of 27 July 2026 is the only consolidation since the original version 02024R1689-20240712, and the authentic texts remain the Official Journal publications. The four corrigenda to the 2024 act, of 9 October 2025, 19 December 2025, 27 March 2026 and 4 May 2026, correct other language versions; none corrects the English text.

What Happens to Systems Already on the Market before the New Dates?

Article 111(2) as amended covers high-risk systems placed on the market or put into service "before the date of application of Chapter III referred to in Article 113".

The transitional rules for AI systems already on the market link this cut-off to Article 113 rather than to a calendar date. Providers and deployers of such systems intended for use by public authorities comply by 2 August 2030.

Did the Omnibus Change the Rules for General-Purpose Models?

The Omnibus left the obligations in Articles 51 to 55 and Annexes XI to XIII unchanged and moved no Chapter V date.

The obligations for general-purpose AI models apply since 2 August 2025. The Omnibus changed only the codes of practice: Article 56(6) no longer lets the Commission approve a code by implementing act, and recital 41 of Regulation (EU) 2026/1744 states that codes "do not grant a presumption of conformity".

How Do the Omnibus Changes Interact with the GDPR?

The Omnibus changes how the AI Act meets the GDPR at two points, Article 4a and Article 27(4), without amending the GDPR itself.

The overlaps covered in AI Act vs GDPR now include the Article 4a legal basis for processing special categories of personal data in bias detection and the Article 27(4) option to cross-reference a DPIA in a FRIA instead of complementing it. Changes to the GDPR itself belong to the separate data and cyber proposal COM(2025) 837.

Which Sibling Regulations Does the Omnibus Touch?

The Omnibus amends two sector regulations directly and links a third through a presumption.

Article 3 amends the Machinery Regulation, Regulation (EU) 2023/1230, and Article 2 amends the EASA Basic Regulation, Regulation (EU) 2018/1139. Article 42(3) ties Article 15 cybersecurity to the Cyber Resilience Act, and the NIS2 changes proposed in COM(2025) 837 sit outside the AI Act.

Frequently Asked Questions about the Digital Omnibus on AI

What is the Digital Omnibus on AI?

It is Regulation (EU) 2026/1744 of 8 July 2026, an amending act that changes the AI Act's high-risk dates, several duties and its governance rules, and amends the EASA Basic Regulation and the Machinery Regulation.

Has the EU AI Act been delayed?

Yes, for the high-risk rules only: 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 5(1), points (a), (b) and (c) to (h), apply since 2 February 2025, points (ba) and (bb) from 2 December 2026, and Article 50 keeps 2 August 2026.

Has the Digital Omnibus been approved?

Yes. The Council adopted it on 29 June 2026, after the Parliament's position of 16 June 2026. The separate COM(2025) 837 is still pending, awaiting a Parliament committee decision as of 24 October 2026.

When did Regulation (EU) 2026/1744 enter into force?

On 27 July 2026, the third day after its publication in the Official Journal (Article 4). Commission pages that still say "mid-July 2026" are outdated.

Did the Omnibus remove the literacy obligation in Article 4?

No. Providers and deployers still "shall take measures to support the development of AI literacy" under Article 4(1). The proposal to make literacy a Commission and Member State task to encourage was not adopted.

Does the Digital Omnibus on AI change the GDPR?

No. It amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 only. Changes to the GDPR are proposed separately in COM(2025) 837.