Digital Omnibus on AI
What changed
Regulation (EU) 2026/1744 is enacted law. It was adopted on 8 July 2026, published on 24 July and entered into force on 27 July 2026. It amends the AI Act, Regulation (EU) 2018/1139 on civil aviation and Regulation (EU) 2023/1230 on machinery. It does not amend GDPR, NIS2, the Data Act or DORA.
| Provision | Position after the amendment |
|---|---|
| Article 6(2) / Annex III high-risk rules | Deferred to 2 December 2027 |
| Article 6(1) / Annex I high-risk rules | Deferred to 2 August 2028; account for Article 2(2) and sector-specific legislation |
| Article 4 literacy | Measures supporting literacy development, taking account of people, experience and context; no guarantee of a particular individual’s literacy level |
| Article 5(1)(ba), (bb), and paragraphs 1a, 1b | New prohibited-practice provisions apply from 2 December 2026 |
| Article 50 | General transparency obligations still apply from 2 August 2026, according to role, use and exceptions |
| Article 111(4) | Providers of generative systems placed on the market before 2 August 2026 must meet Article 50(2) by 2 December 2026 |
| Article 50(7) | Commission assessment of the adequacy of codes of practice for Article 50(2) and (4) |
| Articles 102–110 | Apply from 27 July 2026 |
| Article 99(6a) | Lower-of-the-two penalty ceilings for small mid-caps under paragraphs 4 and 5; the SME rule has a different scope |
The high-risk deferral concerns Chapter III Sections 1–3, except Article 6(5), with dates distinguished in Article 113. Chapter III Section 4 and other already applicable duties are not all postponed. Article 111 contains further existing-system/model transition rules.
New prohibitions: purpose and safeguards matter
New point (ba) concerns realistic intimate or sexually explicit material depicting an identifiable person without the specified free, specific, informed, unambiguous and explicit consent. Point (bb) concerns child sexual abuse material or performances within the referenced Directive 2011/93/EU definitions, subject to the stated national-law justification condition.
Read these with paragraphs 1a and 1b. For placing on the market or putting into service, intended purpose or reasonably foreseeable and reproducible outputs without significant technical modification matter, together with the absence of adequate safeguards in the latter case. Deployer use is prohibited when the system is used for the purpose of creating or manipulating the specified material or performances. Paragraph 1b further limits what manipulation means for point (ba). These are not a blanket prohibition of every generative model with any potential misuse.
Transparency: do not confuse provider and deployer duties
Article 50(2) concerns providers’ technically detectable, machine-readable marking of synthetic outputs, with qualifications in the article. Article 111(4) applies to systems placed on the market before 2 August 2026, not the wider phrase “placed on the market or put into service”. The transition covers paragraph 2 only.
Deployers separately assess Article 50(4) disclosure for deepfakes and texts published to inform the public on matters of public interest, including its editorial-control and other qualifications. Other Article 50 paragraphs address direct interaction, emotion recognition and biometric categorisation in their respective scope. This does not mean every business email generated with AI must carry the same visible label.
Codes and Commission guidance help interpret and implement the duties. Guidance is not legislation; the binding interpretation of EU law ultimately belongs to the Court of Justice. Article 53(4)‘s harmonised-standard presumption concerns GPAI provider duties, not a general rule for all Article 50 disclosures.
Literacy and evidence
The amended Article 4 requires providers and deployers to take contextual measures supporting AI literacy development among their staff and others dealing with AI operation/use on their behalf. It explicitly does not require guaranteeing a particular level for each individual. Select measures based on roles, experience, intended use and affected people, and retain useful evidence of what was done. A single course certificate does not certify the entire organisation’s compliance.
Penalty ceilings remain offence-specific
Article 99(3) uses EUR 35 million or 7% of worldwide annual turnover for prohibited practices, normally the higher value. Listed duties under Article 99(4), including Article 50, use EUR 15 million or 3%; incorrect information has its separate paragraph 5 ceiling. Apply the SME lower-value rule in paragraph 6 and the narrower small mid-cap rule in paragraph 6a. The current consolidated Article 101 sets the GPAI provider ceiling at 3% of worldwide annual turnover or EUR 15 million, whichever is higher, under its stated conditions. Maxima are not predicted fines or guaranteed savings.
What to do with the extra high-risk preparation time
- Confirm the system, role, purpose and Article 6 classification.
- Keep current prohibitions, literacy, transparency, GDPR and sectoral duties working.
- Map provider documentation, deployer duties, and conditional FRIA/DPIA separately.
- Select the relevant conformity assessment route. Article 43(2) requires internal control for Annex III points 2–8, while paragraph 1 governs point 1. Assess the sectoral procedure in paragraph 3 where Annex I Section A also applies; a notified body is not universally required.
- Set an evidence-based remediation plan and actual acceptance criteria.
Using a third-party GPAI API does not by itself make an organisation a GPAI model provider. If you do provide a model, Chapter V has its own obligations and the Article 111(3) transition for models placed on the market before 2 August 2025.
AI Act overview · Dates and triggers · GPAI user guide
Content reviewed: 6 September 2026. Primary sources: Digital Omnibus on AI, Consolidated AI Act.