The Digital Omnibus on AI enters into force today

The Digital Omnibus on AI was published in the Official Journal of the European Union on 24 July 2026 and enters into force today, 27 July 2026, three days after publication. This Omnibus amends the EU AI Act, aiming to simplify and reduce the regulatory burden and address acknowledged implementation challenges, representing the first formal set of amendments to the EU's flagship AI legislation since its adoption in June 2024.

Key Provisions

In our previous articles we've written about the political negotiations to get here and key changes in more detail, including what they mean in practice, but for an aide memoire here is a quick run down:

Postponement of high-risk AI obligations. The most consequential change defers the application date for stand-alone high-risk AI systems classified under Annex III (covering certain specified use cases in areas including employment, education, critical infrastructure and law enforcement – though not all AI systems operating in those sectors are classified as high-risk) from 2 August 2026 to 2 December 2027. For AI systems embedded in products already subject to EU sectoral safety legislation under Annex I, the deadline shifts further to 2 August 2028. For more information see - EU AI Act: guidance on classifying high-risk AI systems
Transparency and labelling. Providers of AI systems that generate synthetic audio, image, video, or text content must mark outputs in a machine-readable format. Systems placed on the market before 2 August 2026 benefit from a short grace period, with compliance required by 2 December 2026, where any such systems places on the market on or after 2 August 2026 must comply from 2 August 2026. The remaining transparency obligations under Article 50, including the duty to inform users that they are interacting with an AI system, continue to apply from 2 August 2026. For more information see - The EU's new AI labelling rules: what every organisation needs to know
New prohibited practices. A significant addition is the prohibition on AI systems used to generate non-consensual intimate imagery, so-called "nudifier" applications, and child sexual abuse material (CSAM). This was introduced at the European Parliament's initiative during trilogue negotiations and was not part of the Commission's original text.
AI literacy mandatory but measured. In a relaxation from the original strict obligation, Article 4 now requires providers and deployers to take measures supporting AI literacy among staff and others who operate AI systems on their behalf. But the law does not demand that organisations guarantee a "sufficient level" of literacy for each individual. In other words, no specific outcome is required. The Commission and Member States must support these efforts and, in practice, this means documenting training and awareness programmes, but not, say, certifying individual competence. That said, deployers of high-risk AI systems remain subject to more specific competence and training requirements under Article 26(2).
The AI Office and regulatory sandboxes. National authorities now have until 2 August 2027 to establish at least one AI regulatory sandbox, which is later than originally required. The AI Office may also create an EU-level sandbox for systems covered by Article 75(1), with priority access for SMEs, start-ups and small mid-cap enterprises.
Bias detection and special category data. The legal basis for processing special categories of personal data for bias detection and correction has been extended beyond high-risk systems to providers and deployers of all AI systems and models. However, the co-legislators reinstated the "strict necessity" threshold, reversing the Commission's proposal to lower it to a simple necessity test.
Sectoral overlap and the Machinery Regulation. AI embedded in products governed by the Machinery Regulation is now excluded from the direct scope of the AI Act's high-risk rules, with the Commission empowered to adopt delegated acts under the Machinery Regulation to impose AI-specific health and safety requirements instead.
Registration relaxed for self-assessed non-high-risk AI systems under Article 6(3). While the obligation to register such systems in the EU database remains, the Annex VIII information requirements have been simplified. Providers must still document their Article 6(3) assessment before placing the system on the market or putting it into service and national competent authorities may request that assessment.
SME and small mid-cap enterprises. Regulatory support measures, including sandbox priority access, now extend to small mid-cap enterprises, plugging a gap that previously left growing companies without support the moment they exceeded SME thresholds.

Practical implications and next steps

Although the extended deadlines provide welcome breathing space, organisations should not treat this as an invitation to delay. The underlying obligations, such as the risk management frameworks, technical documentation, conformity assessments and governance structures, remain unchanged and take considerable time to build.

If you have any questions, or if we can help you prepare for the revised deadlines in any way, please do reach out to your usual LS contact.