EU publishes Digital Omnibus on AI, deferring high-risk AI Act duties

A compliance guide from Whistic, a risk operations software company, explains how Regulation (EU) 2026/1744, the Digital Omnibus on AI, altered the schedule of the EU AI Act, Regulation (EU) 2024/1689. According to the guide, the Omnibus was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The guide, last reviewed in October 2026, is written for third-party vendor risk assessment.

The central change concerns dates. High-risk rules now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for most Annex I products, while AI-enabled machinery leaves the Act's direct high-risk coverage. The transparency duties in Article 50 were not moved, and apply since 2 August 2026, although generative systems already on the market have until 2 December 2026 to meet the marking requirement in Article 50(2). Two new prohibitions also begin then, aimed at AI that creates or alters non-consensual intimate imagery or child sexual abuse material.

Other changes listed include delegated acts due by 2 August 2027 allowing the Commission to limit certain high-risk requirements where sector product law gives equal or higher protection, and guidelines due by 1 August 2027. Lighter technical documentation and quality management rules open to SMEs now also reach small mid-cap enterprises. The AI Office became exclusively competent for systems built on a general-purpose model by the same provider, and for AI embedded in the largest online platforms and search engines, while national authorities keep several exceptions.

The guide stresses that the Omnibus did not repeal or restructure the Act. Its risk tiers, the prohibitions in force since 2 February 2025, and the general-purpose model duties in force since 2 August 2025 are unchanged in substance.