The Digital Omnibus on AI, Explained. What the Final Text Changes and When

Legal status. The Digital Omnibus on AI was signed on 8 July 2026 but had not been published in the Official Journal as of 22 July 2026. The European Parliament’s Legislative Observatory lists procedure 2025/0359(COD) as completed and awaiting publication. Per recital 46 of the signed text, the regulation enters into force on the third day after publication. Until then, the original timeline in Regulation (EU) 2024/1689 remains the binding law, including the 2 August 2026 date for Annex III high-risk obligations. Every change described in this article takes effect only from that entry into force. We will update this article when the OJ reference exists.

The final text of the Digital Omnibus on AI is settled. Parliament adopted it on 16 June 2026 by 423 votes to 57 with 174 abstentions, the Council followed on 29 June, and the act was signed on 8 July. The signed text postpones the high-risk regime to 2 December 2027 and 2 August 2028, redraws who regulates what, inserts two new prohibitions, and adds a package of easings. Recital 46 declares its entry into force a matter of urgency, which is a sentence the Union rarely writes about a law whose main job is postponement.

Three Omnibuses Are in Circulation and Only One of Them Is This Law

The word Omnibus now covers several separate legislative packages, and three of them matter to compliance teams.

Omnibus I (Sustainability). Its centrepiece is in force. Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. It rewrites CSRD scope (thresholds raised to more than 1,000 employees and more than 450 million euro turnover), abolishes the CS3D phased rollout, and removes listed SMEs from mandatory sustainability reporting. If someone says “the Omnibus” without specifying which one, and they work in sustainability reporting, they mean this.

Digital Omnibus on AI (COM(2025) 836). The subject of this article. Proposed on 19 November 2025, it amends the AI Act, the Machinery Regulation and the civil aviation rules. Signed on 8 July 2026, awaiting Official Journal publication.

Digital Omnibus Regulation (COM(2025) 837). The broader sibling, proposing amendments to the GDPR, the ePrivacy Directive, NIS2 and the Data Act. It remains in negotiation at a much earlier legislative stage. When someone at a conference says the Digital Omnibus will change GDPR, they mean this one, and that change is not close. When they say the Digital Omnibus delays the AI Act, they mean the one that is now signed.

High-Risk Compliance Moves to 2 December 2027 and 2 August 2028, but Only From Entry Into Force

The signed text sets the application of the high-risk chapter at 2 December 2027 for stand-alone systems under Annex III and 2 August 2028 for AI embedded in products under Annex I, in place of the original 2 August 2026 and 2 August 2027. Recital 40 of the signed act states the reason plainly: the delayed availability of standards and the delayed establishment of national competent authorities jeopardised the effective entry into application of those obligations. The Commission’s original proposal tied the new dates to the availability of standards; the final text sets fixed calendar dates instead. In our assessment that swap is the single most useful thing in the text, because a conditional deadline is not a deadline anyone can plan against.

The timing risk sits in the next eleven days. The signed text contains no bridging provision for a late publication. If the Official Journal publishes before 2 August 2026, the new dates take effect before the old one bites. If publication slips past 2 August, the Annex III obligations of Regulation (EU) 2024/1689 start to apply on that day and are deferred only once the Omnibus enters into force, leaving a gap in which the original law governs. Our read is that publication lands in July, since recital 46 exists precisely to compress this window, but a company with candidate high-risk systems should know each system’s classification status before August regardless of which scenario materialises.

The signed text also clarifies the grace period for legacy systems. Per recital 39, the grace period in Article 111(2) attaches to the type and model of a high-risk AI system: once the first unit of a type and model is lawfully on the market before the date specified in Article 111(2), further units of the same type and model may continue to be placed on the market without additional obligations, as long as the design remains unchanged, and any significant change to the design triggers full compliance including conformity assessment. Both formulations sit in the same recital. What counts as a significant change remains undefined, and the text does not connect it to the separately defined term substantial modification in Article 3(23), so the boundary of the legacy exemption is a question the text does not answer.

Machinery Leaves the AI Act and Medical Devices Stay In

The signed text moves the Machinery Regulation (EU) 2023/1230 from Section A to Section B of Annex I, which takes AI in machinery out of the direct application of the AI Act’s high-risk chapter, while every other Section A product category, including medical devices and toys, stays in Section A. Machinery moved out of the AI Act, medical devices stayed in, and the difference between those two sentences is a delegated act due by 2 August 2028.

Per recital 42, the Commission must adopt delegated acts writing equivalent health and safety requirements into the Machinery Regulation itself, and those delegated acts should apply by 2 August 2028, aligned with the Annex I application date. In the interim, the amended Article 2(2) limits the AI Act’s application to Section B products to a short list of provisions, and manufacturers may rely on harmonised standards adopted under the AI Act for the presumption of conformity under the Machinery Regulation until machinery-specific AI standards exist. For the categories that stay in Section A, a new Article 2(13) allows specific AI Act requirements to be limited where sectoral legislation provides an equivalent or higher level of protection, with the Commission required to adopt the specifying delegated acts by 2 August 2027. Civil aviation gets a technical correction with the same logic: per recital 44, the high-risk requirements flow into delegated and implementing acts under Regulation (EU) 2018/1139 rather than applying directly. And notified bodies designated under Section A legislation get a single application and unified assessment procedure for AI Act designation, which removes the duplicate paperwork without removing the substantive requirements they must still meet.

The AI Office Takes Over Vertically Integrated Systems and the Platforms

The amended Article 75(1) makes the AI Office exclusively competent for AI systems built on general-purpose AI models where the system and model come from the same provider or the same undertaking, and for systems that constitute or are integrated into very large online platforms and search engines. The exceptions keep national authorities in charge of systems related to Annex I products, and of systems provided by law enforcement, border management and financial institutions within Article 74(6). The exclusive competence covers providers, and deployers only where they are the provider or part of the same undertaking. A bank deploying a third-party system therefore stays under national supervision on both grounds, per the final subparagraph of the amended Article 75(1).

Two New Prohibitions Carry the Top Fine Tier From 2 December 2026

The signed text inserts two new prohibited practices into Article 5, covering AI systems that generate or manipulate realistic non-consensual intimate material of identifiable persons and systems generating child sexual abuse material. For providers, the prohibition bites where such generation is the system’s intended purpose, or where it is a reasonably foreseeable and reproducible outcome and the system lacks reasonable and adequate safeguards. For deployers, the test is purpose. Using any system to generate such material is prohibited, including by circumventing its safeguards. The Council’s press release puts the application date at 2 December 2026. Because Article 5 violations sit in the top tier of Article 99(3), at up to EUR 35 million or 7% of worldwide turnover, and the penalties chapter has applied since 2 August 2025, the new prohibitions arrive with the Act’s heaviest fines attached from day one.

The same date carries the transparency carve-out. Recital 38 grants providers of generative AI systems already on the market before 2 August 2026 a transitional period of four months for the machine-readable marking duty in Article 50(2), ending 2 December 2026. The Council’s press release had described this as three months, so the signed text is the reference. The Article 50 transparency duties themselves stay on the original schedule and apply from 2 August 2026, supported by the Commission’s Article 50 guidelines of 20 July 2026 and the Code of Practice on Transparency of AI-Generated Content, which received the Commission’s adequacy opinion on 8 July 2026 and the AI Board’s assessment the following day.

Most of the Easing Reaches Every Operator and Two Measures Depend on Size

Three of the easings apply regardless of company size. The rewritten Article 4 requires providers and deployers to take measures to support the development of AI literacy, replacing the original duty to take measures to ensure, to their best extent, a sufficient level, and adds expressly that the obligation does not require guaranteeing any specific level of literacy for any individual. In our assessment that turns Article 4 from an outcome standard into an effort standard, though the duty itself stays where it was. A new Article 4a extends the legal basis for processing special categories of personal data for bias detection and correction, previously reserved for providers of high-risk systems, to providers and deployers of all AI systems and models. The extension carries the full Article 10(5) safeguard set, including strict necessity, a ban on transferring the data to other parties, deletion once the bias is corrected, and documented justification in the records of processing, so it is a narrow gate, not an open door. And a new Article 42(3) deems high-risk systems within the scope of the Cyber Resilience Act that fulfil the conditions of its Article 12(1) compliant with the AI Act’s cybersecurity requirement in Article 15, to the extent the CRA declaration of conformity covers those requirements. Since the CRA’s essential requirements only start to apply in December 2027, the presumption is a forward-looking alignment, not a shortcut available today.

Two measures are size-dependent. The text creates the small mid-cap category, defined by reference to Recommendation (EU) 2025/1099, and extends to SMCs the simplified technical documentation form and proportionate quality management previously aimed at smaller operators. And the sandbox chapter moves the national sandbox obligation to 2 August 2027, per the amended Article 57, while allowing the AI Office to run a Union-level sandbox with priority access for SMEs, start-ups and SMCs.

Classification Is the Work That Pays Off in Every Scenario

Until publication, the original 2 August 2026 Annex III date is binding law, so knowing each system’s classification status is the preparation that holds up whether the Official Journal arrives in time or not. Once the Omnibus is in force, the time gained runs to 2 December 2027 and is best spent finishing classification, inventory and vendor mapping. The Article 50 transparency duties and the two new prohibitions arrive on their own dates whatever happens to the high-risk chapter.

Not sure whether the AI Act applies to your organisation at all? Our free 3-minute AI Act readiness assessment tells you whether you sit in scope and which obligations reach you first, with a score and specific next steps.

Track all affected deadlines in our EU compliance deadline tracker.