On 27 July 2026, the European Union’s Digital Omnibus on AI entered into force (the “Omnibus”). The Omnibus introduces targeted changes to the EU Artificial Intelligence Act (“AI Act”), mainly to extend certain compliance timelines, simplify implementation of the AI Act, and reduce some administrative burdens, while preserving safeguards for fundamental rights and safety.
- Extended timelines
The Omnibus delays the application of the following rules:
- High-Risk Rules. For Annex III-based high-risk AI systems (stand-alone systems used in listed use cases such as employment, education, essential services, law enforcement, and justice), the high-risk rules will now apply from 2 December 2027. For Annex I-based high-risk AI systems (AI systems that are regulated products, or are safety components of regulated products, under listed EU legislation), the high-risk rules will now apply from 2 August 2028.
- General Transparency Rules. For legacy systems generating synthetic audio, image, video or text content, already marketed prior to 2 August 2026, the Omnibus also delays the application of the “output” detection and marking requirement, to 2 December 2027. For other general transparency obligations, such as the requirement to inform people when they are directly interacting with an AI system, the application date remains 2 August 2026, even for legacy systems marketed prior to such date.
- Simplification and reduced administrative burdens
- Simplified Compliance for SMEs and SMCs. The Omnibus expands simplified compliance modalities for small and medium-sized enterprises (SMEs) and small mid-cap enterprises (SMCs). For example, the Omnibus expands the types of such enterprises that may comply with the high-risk rules around the establishment of technical documentation and the presence of a quality management system in a simplified manner.
- Reduced Overlapping Rules for Annex I-Based High-Risk AI Systems. The Omnibus further reduces duplicative requirements for Annex I-based high-risk AI systems. It provides that where EU legislation listed in Annex I imposes requirements that achieve the same or a higher level of protection as those in the AI Act, the application of certain AI Act requirements may be limited. For example, high-risk AI systems that comply with the cybersecurity requirements under the Cyber Resilience Act are deemed to comply with the AI Act’s cybersecurity requirements.
- More Flexible AI Literacy Obligations. The Omnibus provides a more flexible, support-oriented approach to the AI literacy requirement. Providers and deployers must take measures to support the development of AI literacy of their staff, but the Omnibus clarifies that this obligation does not require them to guarantee any specific level of AI literacy.
- Expanded support for innovation and compliance
The Omnibus broadens access to AI regulatory sandboxes and supervised real-world testing. The Omnibus also introduces an EU-level regulatory sandbox, starting in 2028, to support real-world testing under regulatory supervision, with priority access for SMEs, including startups, and SMCs.
- Fundamental rights and safety
- Broader Basis for Processing Sensitive Personal Data for Bias Detection and Correction. In addition, the Omnibus expands the legal basis for processing special categories of personal data for bias detection and correction. Under the Omnibus, deployers of high-risk AI systems and providers and deployers of other AI systems and models may now process special categories of personal data for bias detection and correction, subject to appropriate safeguards.
- Expanded Prohibitions on Harmful AI Content. The Omnibus expands the list of prohibited AI practices by adding AI systems that generate or manipulate non-consensual intimate material depicting identifiable natural persons (sometimes referred to as “nudification” applications), as well as AI systems that generate or manipulate child sexual abuse material.
What should organizations that develop or deploy AI in the EU do now?
- Ensure compliance with the AI Act’s general transparency requirements, which apply from 2 August 2026. Legacy AI systems placed on the market before that date have until 2 December 2027 to comply with the output detection and marking requirement.
- Assess whether their AI systems are classified as “high risk” systems and adjust compliance planning to reflect the new timelines for those systems.
- Review internal AI literacy measures and training plans, bearing in mind that a general requirement for AI literacy remains in place and is already in effect.
- Evaluate whether regulatory sandboxes or real-world testing opportunities could be applicable and useful for planned AI development and deployment.
- Consider whether bias detection and correction processes require updated governance, safeguards, and internal protocols where special categories of personal data may be used.
Please do not hesitate to contact us if you have any questions about the above or would like advice.
