The Digital Omnibus on AI: What Just Changed in the EU AI Act

On 2 August 2026, the toughest parts of the EU AI Act were supposed to switch on. They won't. A new law — the Digital Omnibus on AI, carried in the Official Journal as Regulation (EU) 2026/1744 — rewrites the AI Act's timetable, hands most teams a year or more of breathing room, and draws two brand-new red lines that take effect sooner, not later. Here is what actually changed, and what it means if you build, deploy, or fine-tune AI in Europe.

What the "Digital Omnibus on AI" actually is

The AI Act itself — Regulation (EU) 2024/1689 — became law in 2024 and switches on in stages. The Digital Omnibus on AI does not replace it; it is a targeted amendment that changes when and how some of those stages apply, part of a wider "Digital Omnibus" simplification package the European Commission tabled on 19 November 2025 to trim the EU's digital rulebook.

The AI half of that package moved unusually fast:

• 19 November 2025 — the Commission publishes the Digital Omnibus proposals.
• 7 May 2026 — Parliament and Council reach a provisional political agreement.
• 16 June 2026 — the European Parliament approves the agreed text.
• 29 June 2026 — the Council gives its final green light, formally adopting it.
• July 2026 — published in the Official Journal as Regulation (EU) 2026/1744; it enters into force on the third day after publication.

The broader Digital Omnibus also proposes changes to other rules — the GDPR, the ePrivacy regime, the Data Act — but those travel in separate instruments. Regulation (EU) 2026/1744 is the piece that touches the AI Act, and that is what this post is about.

The headline: high-risk AI gets more time

The AI Act sorts systems into tiers. The heaviest tier — high-risk — carries the real compliance weight: risk management, data governance, logging, human oversight, technical documentation, conformity assessment and registration. All of that was due to apply from 2 August 2026. The Omnibus pushes it back and splits it in two, depending on why a system is high-risk.

Annex III systems are the ones that are high-risk because of what they do — standalone use cases such as AI in recruitment, credit scoring, education, biometrics, essential public services, law enforcement and migration. Their deadline moves from 2 August 2026 to 2 December 2027. Annex I systems are high-risk because they are a safety component of a product already regulated under EU law — medical devices, machinery, and the like. They get longer still: 2 August 2028.

Why the clock now depends on readiness, not just the calendar

The more structural change is how those high-risk dates work. Under the original AI Act, the calendar ran regardless of whether the harmonised standards, common specifications and guidance that companies need to comply actually existed — and they largely did not. The Omnibus flips that: high-risk duties now start once the support ecosystem is genuinely ready, with hard backstop dates so the clock can never slip forever.

In practice that means Annex III obligations begin six months after the Commission confirms the necessary standards and tools are available — or on 2 December 2027, whichever is earlier. For Annex I the lag is twelve months, backstopped at 2 August 2028. The extra time is real, but it is not a snooze button: the backstop dates are fixed, and the readiness clock could start the countdown well before them.

Two new red lines: CSAM and deepfake "nudification"

Not everything in the Omnibus is relief. It adds two new entries to the AI Act's list of outright prohibited practices — and these land before the high-risk deadlines, on 2 December 2026. They apply to everyone placing these systems on the EU market or putting them into use, with no risk-tier analysis required: they are simply banned.

If you work anywhere near generative image, video or audio models, treat these as immediate design constraints rather than distant compliance items. They are hard prohibitions, they arrive a full year before the high-risk regime, and they attract the AI Act's steepest penalties.

Smaller companies get a lighter load

The Omnibus also widens the AI Act's relief for smaller players. The simplifications that were reserved for SMEs — a lighter-touch technical-documentation format, and explicit consideration of company size when penalties are set — now reach small mid-caps too, defined as companies with up to 500 employees. It is a meaningful bracket: plenty of scale-ups that had outgrown "SME" but are nowhere near big-tech now qualify for proportionate treatment.

Alongside that, two governance changes are worth flagging:

• A broader AI Office remit. The EU's central AI Office gets clearer oversight of AI systems built on general-purpose AI models where the model and the system come from the same company, and of AI folded into very large online platforms and search engines.
• A wider legal basis for bias testing. Processing special categories of personal data to detect and correct bias is extended beyond high-risk systems to providers and deployers of AI systems and models more generally — useful cover for responsible evaluation work.

What changed — and what didn't

It is easy to read "delay" as "the AI Act is being gutted." It isn't. The risk tiers, the prohibitions already in force, the general-purpose-AI rules and the fundamental-rights protections all stand. The Omnibus re-times the heaviest obligations and adds two bans; it does not repeal the framework.

What this means if you build or deploy LLMs

For anyone shipping AI features to European users — including with open-weight models on your own hardware — the practical takeaways are straightforward:

• Use the runway, don't down-tools. High-risk requirements are delayed, not deleted. The extra 16–24 months is time to build data governance, logging and human-oversight properly — not to ignore them.
• Classify your systems now. Your deadline depends on whether you are Annex III (Dec 2027) or Annex I (Aug 2028). That mapping drives everything else, so do it early.
• If you generate media, act on the bans immediately. The CSAM and non-consensual-intimacy prohibitions hit on 2 December 2026 and apply to everyone. Build the guardrails into image, video and audio pipelines today.
• Model providers still carry GPAI duties. Transparency, a copyright policy and technical documentation for general-purpose models have applied since August 2025 and are untouched. Self-hosting a model does not move those duties, nor does it exempt a deployer from the high-risk regime when it arrives.
• Smaller team? Bank the relief. If you are under 500 staff, the lighter documentation format and size-aware penalties are worth structuring your compliance around.

If part of your answer to all this is keeping data and inference on infrastructure you control, that is exactly the trade-off our guides and the rest of the blog dig into.

The bottom line

The Digital Omnibus on AI is the EU blinking on timing while holding firm on substance. Europe still wants the world's strictest AI rulebook — it has simply accepted that the rulebook cannot bind before the tools to follow it exist. For builders, that means more time on the hardest obligations, two new bright-line bans to respect right away, and a lighter path for smaller companies. The direction of travel has not changed; the schedule has.

This article is a plain-English summary for people building with AI — it is not legal advice. Dates and details reflect the adopted text as reported around its mid-2026 publication; for anything that matters, read Regulation (EU) 2026/1744 in the Official Journal and talk to qualified counsel.

Sources & further reading

• Regulation (EU) 2026/1744 — Official Journal (EUR-Lex)
• European Commission — Regulatory framework for AI (AI Act)
• Council of the EU — final green light to simplify AI rules (29 June 2026)
• Council of the EU — Parliament and Council agree to streamline rules (7 May 2026)
• European Parliament — Digital Omnibus on AI (Legislative Train)