The Digital Omnibus (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is now the authoritative amendment to the EU AI Act. Any compliance programme anchored to the original 2 August 2026 high-risk deadline must be updated. The Omnibus defers two high-risk tiers; all other obligations remain on the original schedule and are now enforced.
What changed: the Omnibus in one table
The Digital Omnibus made four substantive changes to the EU AI Act's compliance timeline:
| Obligation | Original date | New date (Omnibus) | Status |
|---|---|---|---|
| Prohibited AI practices (Article 5) Social scoring, subliminal manipulation, real-time biometric ID in public spaces |
2 February 2025 | 2 February 2025 (unchanged) | In force — not deferred |
| GPAI model obligations (Articles 51–56) Transparency, copyright policy, technical documentation for GPAI providers |
2 August 2026 | 2 August 2026 (unchanged) | In force — not deferred |
| Article 50 transparency duties Disclosure when users interact with AI, deepfake labelling, chatbot disclosure |
2 August 2026 | 2 August 2026 (unchanged) | In force — not deferred |
| High-risk AI — Annex III stand-alone systems Hiring, credit scoring, education, critical infrastructure, law enforcement AI |
2 August 2026 | 2 December 2027 | Deferred +16 months |
| High-risk AI — Annex I product-integrated systems AI embedded in medical devices, machinery, toys, lifts |
2 August 2026 | 2 August 2028 | Deferred +24 months |
| Nudifier prohibition (new) AI systems generating non-consensual intimate imagery or CSAM |
Not in original text | 2 December 2026 | New prohibition — added by Omnibus |
What is live right now (September 2026)
Prohibited practices (Article 5)
Social scoring, subliminal manipulation, cognitive exploitation, real-time biometric identification in public spaces. These prohibitions have been enforced since February 2025. The Omnibus did not touch them.
GPAI model obligations (Articles 51–56)
Providers of general-purpose AI models must maintain technical documentation, publish copyright policies, and comply with the AI Office's transparency requirements. Enforcement began 2 August 2026. Not deferred.
Article 50 transparency duties
All deployers of AI systems that interact with natural persons must disclose the AI nature of the interaction. Deepfakes must be labelled. Chatbot disclosure is mandatory. Enforcement is live. The Commission published its final guidance in July 2026.
What is deferred
High-risk AI — Annex III stand-alone
AI systems used in employment (CV screening, interview assessment), credit scoring, education, biometric identification (non-prohibited), and critical infrastructure management. This tier covers the majority of enterprise AI deployments. Deferred 16 months from the original August 2026 deadline. The extra time is for preparation — not a licence to delay governance work.
High-risk AI — Annex I product-integrated
AI embedded in regulated products: medical devices (MDR, IVDR), machinery, toys, lifts, personal protective equipment. These systems must comply with both the EU AI Act high-risk requirements and their sector-specific product regulation. The extra 24 months reflects the longer certification cycles in regulated product sectors.
New: nudifier prohibition
The Omnibus added a new prohibited practice not in the original text: AI systems that generate or manipulate sexually explicit or intimate images without explicit consent, or that create CSAM. This prohibition enters force on 2 December 2026 — three months from now. Fines up to €35 million or 7% of worldwide turnover.
What the Omnibus did not change
Several elements of the AI Act compliance framework that were sometimes discussed as candidates for the Omnibus were not changed:
- The risk classification system — Annex III and Annex I category definitions are unchanged. What changed is when compliance with those categories is required, not which systems are in scope.
- The fines regime — the three-tier fine structure (€35M/7%, €15M/3%, €7.5M/1.5%) remains unchanged.
- Conformity assessment procedures — the requirement for third-party conformity assessment for certain Annex III systems (biometric identification, critical infrastructure) is unchanged. Only the deadline moved.
- Human oversight requirements (Article 14) — unchanged. High-risk systems must still implement meaningful human oversight mechanisms; the Omnibus simply gives more time to implement them.
- The AI Office's enforcement powers — fully in operation from 2 August 2026, including for GPAI model obligations.
Action required
The deferral does not suspend the obligation to prepare. Organisations that were already working towards the August 2026 deadline have a 16-month extension for Annex III systems — not a reset. The compliance work already done remains valid and necessary. Organisations that had not yet begun should treat the December 2027 date as the actual deadline and begin now: risk classification, human oversight design, and technical documentation take substantially longer than the time remaining.
Three things are required immediately regardless of the deferral:
- Article 50 compliance is live. Review all customer-facing AI deployments — chatbots, recommendation systems, automated communications — for disclosure compliance. The Commission's July 2026 guidance sets out the implementation standard.
- GPAI providers must act now. If your organisation provides a general-purpose AI model — whether commercially or as part of an internal platform — GPAI obligations are in force. Technical documentation and copyright policies are not optional.
- December 2026 nudifier deadline. Organisations operating platforms that could host AI-generated intimate imagery must implement safeguards before 2 December 2026.