EU Adopts 'Digital Omnibus' Regulation Delaying AI Act High-Risk Rules

The European Union adopted Regulation (EU) 2026/1744, a "Digital Omnibus on AI," on 8 July 2026, postponing high-risk AI obligations under the AI Act: stand-alone Annex III systems (recruitment, credit, education, biometrics) now face obligations from 2 December 2027 instead of 2 August 2026, and high-risk AI embedded as safety components in Annex I products (medical devices, machinery, toys) from 2 August 2028 instead of 2 August 2027. The regulation, published in the Official Journal on 24 July and in force from 27 July, cites "delayed preparation of standards" and delayed national governance and conformity assessment frameworks as reasons the compliance burden proved "heavier than expected." The Omnibus also adds two Article 5 prohibitions effective 2 December 2026—AI generating non-consensual intimate content, including "nudifier apps," and AI creating or manipulating child sexual abuse material—while GPAI obligations (2 August 2025) and Article 50 transparency rules (enforceable 2 August 2026) stay on schedule, with generative AI systems placed on the market before 2 August 2026 given until 2 December 2026 for Article 50(2) machine-readable marking.

EU Adopts 'Digital Omnibus' Regulation Delaying AI Act High-Risk Rules The European Union has published Regulation EU 2026/1744, a "Digital Omnibus on AI" that postpones the application of high-risk AI rules under the AI Act and introduces broad simplifications. The regulation was adopted on 8 July 2026, published in the Official Journal on 24 July, and entered into force on 27 July—three days after publication rather than the standard twenty-day period—given the imminence of the original 2 August 2026 deadline for high-risk obligations \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai . High-risk deadlines pushed back The headline change is a two-step delay for high-risk AI systems. Stand-alone high-risk systems listed in Annex III such as AI used in recruitment, credit decisions, education and biometrics now face obligations from 2 December 2027 instead of 2 August 2026. High-risk AI embedded as safety components in products covered by Annex I such as medical devices, machinery and toys now face obligations from 2 August 2028 instead of 2 August 2027 \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 2\ https://primumlaw.com/does-the-eu-ai-act-still-apply-to-my-u-s-ai-startup-after-the-delay \ 3\ https://natlawreview.com/article/eu-ai-act-readiness-practitioners-guide-corporate-leaders . The recitals cite "delayed preparation of standards" and "delayed establishment of the governance and the conformity assessment frameworks at national level" as having "resulted in a compliance burden that is heavier than expected" \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . What did not move Several AI Act obligations remain on their original schedule. Prohibited practices and AI literacy duties have applied since 2 February 2025. Obligations for general-purpose AI GPAI model providers have applied since 2 August 2025. The Article 50 transparency requirements—for chatbots, synthetic content labelling, emotion-recognition disclosure—became enforceable on 2 August 2026 \ 2\ https://primumlaw.com/does-the-eu-ai-act-still-apply-to-my-u-s-ai-startup-after-the-delay \ 3\ https://natlawreview.com/article/eu-ai-act-readiness-practitioners-guide-corporate-leaders \ 5\ https://gdprlocal.com/what-is-ai-governance-a-practical-framework-for-companies-using-ai . Providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking duty under Article 50 2 \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 5\ https://gdprlocal.com/what-is-ai-governance-a-practical-framework-for-companies-using-ai . New prohibitions added The Omnibus adds two categories to Article 5's prohibited practices, both effective 2 December 2026 : - AI systems generating non-consensual intimate content NCIC , including "nudifier apps" - AI systems creating, manipulating or synthesising child sexual abuse material CSAM \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 3\ https://natlawreview.com/article/eu-ai-act-readiness-practitioners-guide-corporate-leaders \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 The prohibition distinguishes providers may not place such systems on the market where designed or reasonably foreseeably usable for these purposes without adequate technical safeguards from deployers may not use systems to create or manipulate such material \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . Narrower 'safety component' definition The regulation amends Article 3 14 and inserts Articles 6 1a and 6 1b to narrow what counts as a "safety component." AI systems used solely for "non-safety-related user assistance, performance optimisation, service efficiency, automation, convenience or quality control" are no longer safety components and therefore not high-risk on that basis. Systems whose failure or malfunction would endanger health and safety remain safety components \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . AI literacy obligation softened Article 4 originally required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among staff. The Omnibus shifts this to taking "appropriate measures to promote and support" AI literacy, confirming that organisations "need not guarantee any individual's specific level of AI literacy." The Commission and Member States now play a primary role in developing training initiatives \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 5\ https://gdprlocal.com/what-is-ai-governance-a-practical-framework-for-companies-using-ai \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . Simplifications for smaller enterprises The Omnibus extends several SME reliefs to "small mid-cap companies" SMCs —undertakings employing fewer than 750 persons with annual turnover up to €150 million or balance-sheet total up to €129 million, per Recommendation EU 2025/1099 \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai : - Simplified technical documentation notified bodies must accept the Commission's template - Simplified quality management system option extended to all SMEs - More favourable fine calculation lower of percentage of turnover or fixed maximum extended to SMCs - Priority access to AI regulatory sandboxes, now including an EU-level sandbox coordinated by the AI Office - Deadline for establishing at least one national sandbox pushed from 2 August 2026 to 2 August 2027 \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai The Machinery Regulation moves from Section A to Section B of Annex I, shifting safety-component AI in machinery to a sectoral approach with delegated acts applicable from 2 August 2028 \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai . AI Office powers expanded The European Commission's AI Office gains exclusive supervisory competence over AI systems based on general-purpose AI models where the system and model are developed by the same provider or same undertaking , with carve-outs for certain biometric, law-enforcement, financial and justice-sector systems that remain under national supervision. It also gains market-surveillance competence over AI systems integrated into or constituting very large online platforms/search engines VLOPs/VLOSEs under the Digital Services Act, with enforcement powers modelled on competition authorities—including on-site inspections, commitment decisions, and periodic penalty payments up to 5% of average daily turnover for continuing infringements \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . Context: a broader simplification drive The Digital Omnibus on AI is part of the EU's "Omnibus legislative packages to reduce administrative burdens and enhance competitiveness," accompanying a forthcoming "Digital Omnibus" amending GDPR, ePrivacy, the Data Act and other acts \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai . What remains uncertain Whether the extended deadlines and simplifications will suffice—or whether further postponements will be sought—is unclear. The EY analysis notes that "it remains uncertain whether the simplification and extended compliance deadlines will suffice or further postponements will be required" \ 1\ https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai . Harmonised standards and notified-body capacity for high-risk conformity assessment are still maturing, as suggested by the recitals' reference to delayed preparation of standards and conformity assessment frameworks \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . The Commission is tasked with publishing guidelines on integrating AI Act requirements with sectoral legislation by 1 August 2027 \ 7\ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 . For now, the AI Act's core structure and risk-based approach remain intact. The prohibitions, GPAI rules, transparency duties and AI literacy obligations are in force. The high-risk compliance window has been widened, but the underlying obligations have not changed. Sources 1. Regulation EU 2026/1744 – Digital Omnibus on AI | EY - Greece https://www.ey.com/en gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai ey.com 2. Does the EU AI Act Still Apply to My U.S. AI Startup After the ... https://primumlaw.com/does-the-eu-ai-act-still-apply-to-my-u-s-ai-startup-after-the-delay primumlaw.com 3. EU AI Act Readiness: A Practitioner's Guide for Corporate ... https://natlawreview.com/article/eu-ai-act-readiness-practitioners-guide-corporate-leaders natlawreview.com 4. Longevity Washing, AI And The Regulatory Fault Lines Of The ... https://www.legal500.com/intelligence/germany/food-drugs-healthcare-life-sciences/longevity-washing-ai-and-the-regulatory-fault-lines-of-the-longevity-industry-a-european-perspective legal500.com 5. What Is AI Governance? A Practical Framework for Companies ... https://gdprlocal.com/what-is-ai-governance-a-practical-framework-for-companies-using-ai gdprlocal.com 6. Employment and Social Security – October 2026 | IPG Law Firm https://www.ipglex.it/pagine.aspx?s=ipg-journal&p=update-on-employment-and-social-security-october-2026 ipglex.it 7. L 202601744EN.000101.fmx.xml https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL 202601744 eur-lex.europa.eu 8. Regulation - EU - 2024/1689 - EN - EUR-Lex https://eur-lex.europa.eu/eli/reg/2024/1689/oj eur-lex.europa.eu