The AI Act after the Digital Omnibus: what changes for organisations, and when

What is the Digital Omnibus?

The Omnibus is a targeted simplification of the AI Act, in force across the EU since 27 July 2026.

The Digital Omnibus on AI is an EU regulation that amends the AI Act, Regulation (EU) 2024/1689. The Commission calls it a “targeted simplification” of the AI rulebook. The steps, according to the European Commission:

• 19 November 2025
  the Commission presented the proposal, as part of a wider package to simplify EU digital rules.
• 7 May 2026
  the European Parliament and the Council of the EU reached a political agreement. The Commission noted that this came “only five months” after its proposal.
• 27 July 2026
  the amended rules entered into force across the EU. The Commission links to the final text in the Official Journal of the European Union.

So this is no longer a proposal. The AI Act Service Desk now shows the AI Act “as at 27 July 2026”, with the changes marked.

Which deadlines have moved?

The rules for high-risk AI now apply from 2 December 2027 and 2 August 2028.

The most important change is the timeline for high-risk AI. Under the original AI Act, these rules were set to apply on 2 August 2026 and 2 August 2027, according to the Commission’s AI Act Service Desk. After the Omnibus, Article 113 gives two new, fixed dates:

• 2 December 2027
  for high-risk AI systems listed in Annex III. The Commission names areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control. Its policy page also lists AI used for access to essential services, such as credit scoring.
• 2 August 2028
  for high-risk AI that is part of products covered by EU product rules (Annex I). The Commission’s examples are lifts and toys.

From those dates, high-risk systems must meet strict requirements. The Commission lists among others risk assessment and mitigation, high-quality datasets to reduce discriminatory outcomes, logging of activity, detailed documentation, clear information to the deployer, human oversight, and robustness, cybersecurity and accuracy. Why the delay? According to the Commission, the sequencing “will help ensure that technical standards and other support tools are in place before the rules start to apply.” Those standards are now starting to arrive. On 19 October 2026, the Commission published the reference to the first harmonised standard for the AI Act in the Official Journal: EN 18286:2026, on quality management systems. Providers that apply it benefit from a presumption of conformity with Article 17. Further standards are “expected to follow”.

One detail for systems that are already in use. Under Article 111, high-risk systems placed on the market before the new dates fall under the rules only if their design changes significantly after that date. High-risk systems intended for use by public authorities must comply by 2 August 2030 in any case.

What became of the proposal?

The proposal linked the start to standards, but the final text sets fixed dates.

This is where many older articles and summaries go wrong, because they describe the proposal, not the final text.

The proposal (November 2025). The Commission wanted to link the start of the high-risk rules to the availability of standards and support tools. According to the AI Act Service Desk, the rules would start after a transition period once the Commission confirmed that support was available, with an end date: Annex III rules would apply “maximum 16 months later than originally envisaged”, Annex I rules a maximum of 12 months later.

The final text (July 2026). Article 113 now contains fixed dates: 2 December 2027 and 2 August 2028. In the Commission’s words, the agreement “sets a clear implementation timeline”. Those dates match the maximum delay of the proposal. An article that says the high-risk rules start “once standards are ready” describes the proposal.

What changed for AI literacy?

AI literacy remains an obligation, but the law no longer requires a specific level.

AI literacy affects almost every organisation, because it applies to all providers and deployers of AI systems, not only to high-risk systems. The amended Article 4 still says that providers and deployers of AI systems “shall take measures to support the development of AI literacy” of their staff and others who operate or use AI on their behalf. Article 4(1) now also states that this obligation “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

The Commission summarises it like this in its AI literacy Q&A: AI literacy “remains an obligation for providers and deployers of AI systems, but no specific - or ‘sufficient’ - level is mandated.” What this means in practice, according to the same Q&A:

• The obligation has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026.
• There is no need for a certificate. Organisations can keep an internal record of trainings and other initiatives.
• There is no single required format or mandatory training. What is appropriate depends on the role of the organisation, the risk of its AI systems and the knowledge of the people involved.
• For deployers of high-risk AI systems, the obligation to make sure staff are trained to carry out human oversight “remains in place”.

What is not yet there. Under Article 4(2), the Commission will publish practical examples of how to comply. Under Article 4(3), the European AI Board will adopt recommendations, taking European competence frameworks into account. Neither has been published yet, as far as these sources show. Until then, the Commission’s living repository of AI literacy practices offers examples, but the Commission notes that copying them does not automatically mean you comply. That makes AI literacy a management question more than a box to tick. We looked at the leadership side in how leaders can guide organisations through ethical AI challenges.

What else did the Omnibus do?

The Omnibus also bans nudification apps and extends relief to growing companies.

According to the Commission’s overview of the changes, the Omnibus also:

• Bans “nudification” apps.
  A new prohibition covers AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material. According to the Service Desk timeline, it applies from 2 December 2026.
• Extends relief for growing companies.
  Some simplified obligations for SMEs, such as simplified technical documentation, now also apply to small mid-cap companies (SMCs). At the proposal stage, the Commission estimated that this would make implementation easier for “an additional 8,250 companies in Europe”.
• Expands sandboxes.
  More companies get access to regulatory sandboxes, including an EU-level sandbox. According to the Service Desk timeline, each Member State should have at least one AI regulatory sandbox operational by 2 August 2027.
• Simplifies registration.
  In the Commission’s words, it “simplifies obligation to register exempted AI systems in the EU central database”.
• Allows bias detection.
  Providers and deployers may process special categories of personal data to detect and correct bias, but under Article 4a only where strictly necessary and subject to appropriate safeguards.
• Strengthens the AI Office.
  The AI Office gets more oversight of certain AI systems, including those built on general-purpose AI models and those embedded in large online platforms and search engines.
• Clarifies overlaps.
  The relation between the AI Act and other EU laws, in particular the Machinery Regulation, is clarified to avoid double rules.

What did not change?

The prohibitions, the transparency rules and the rules for general-purpose AI stayed in place.

Quite a lot. The prohibitions. Prohibitions 1 to 8, such as social scoring and emotion recognition in workplaces and education, have applied since February 2025, according to the Commission. The Omnibus added a ninth. Transparency. The transparency rules in Article 50 apply from August 2026. People must be told when they interact with an AI system, unless that is obvious, at the latest at the first interaction. Deepfakes must be disclosed. There is one transition: providers of generative AI systems that were on the market before 2 August 2026 have until 2 December 2026 to make sure their output is marked in a machine-readable way and detectable as AI-generated (Article 111(4)).

General-purpose AI. The rules for providers of general-purpose AI models have applied since August 2025. Enforcement. According to the AI Act Service Desk timeline, enforcement started on 2 August 2026, at national and EU level, for general-purpose AI models, prohibitions, transparency rules and AI literacy. From that date, the AI Office and national authorities are responsible for supervising and enforcing the AI Act.

→ Read more: AI in government: what Dutch municipalities and central government are doing now, and what the AI Act asks

What is still uncertain?

The law is settled; what is still to come is mostly guidance, such as standards and guidelines.

Five things to watch:

• More harmonised standards.
  Only one has been published so far (EN 18286:2026). The Commission says more are expected.
• Guidelines on high-risk requirements.
  The Commission says it will publish guidelines on the requirements and obligations in Articles 8 to 15 and Article 25.
• Guidelines on what counts as high-risk.
  On 19 May 2026 the Commission published draft guidelines with practical examples of AI systems that do or do not fall under high-risk. The consultation ran until 23 July 2026; according to the Commission, the final guidelines will be adopted by the end of 2026.
• AI literacy recommendations and examples.
  Article 4 provides for recommendations from the AI Board and practical examples from the Commission; the Commission’s Q&A describes both as still to come.
• National enforcement in practice.
  Supervision of AI literacy lies with national market surveillance authorities. How strictly each authority will enforce, and what it will ask for, is not set out in these sources.

What should you do now?

Use the extra time until 2 December 2027 and keep AI literacy going.

These steps follow from the dates above. They are practical, not legal advice.

1. Start with the AI-first organisation.
   Agree who owns AI in your organisation and who decides where it is used. Make clear who is responsible when AI plays a role in a high-risk area of Annex III, such as employment or education. Also list your processes, from recruitment to customer contact, and note per task whether AI does it or will do it, and which tasks stay with people. That also shows where Annex III comes into play.
2. Use the extra time.
   For Annex III systems you have until 2 December 2027. Risk management, documentation and human oversight take time to put in place.
3. Keep AI literacy going.
   The obligation is softer, but it has not gone away, and authorities can now supervise it. Train people in a way that fits their role and the risks, and keep a simple internal record.
4. Train for human oversight where it matters.
   If you deploy high-risk AI, staff must be able to carry out human oversight. That duty did not change.
5. Make someone responsible for transparency.
   People must be told when they are talking to AI, and deepfakes must be labelled. If you offer a generative AI system that was on the market before August 2026, note the 2 December 2026 deadline for machine-readable marking.
6. Public bodies: 2030 applies to existing systems.
   High-risk systems for public authorities that were on the market before the new dates must comply by 2 August 2030. New systems must comply earlier, from 2 December 2027 for Annex III uses. We looked at what governments get right and wrong with AI in how governments can get AI right, and how it might go spectacularly wrong.

Behind each of these steps are people who have to put them into practice. I think AI literacy grows when staff are allowed to try and experiment with new technology, in a way that fits their role. I would advise managers to give that enthusiasm room and ask for a critical eye at the same time, so that people can really carry out human oversight.

Frequently asked questions

Has the EU AI Act been postponed?

No. The AI Act has applied since 2 August 2026, with some parts earlier. The Digital Omnibus mainly moved the rules for high-risk AI: to 2 December 2027 for Annex III uses and to 2 August 2028 for AI in regulated products. Separate deadlines also apply to regulatory sandboxes (2 August 2027) and to machine-readable marking by systems already on the market (2 December 2026). Prohibitions, transparency rules, AI literacy and the rules for general-purpose AI models apply.

Is AI literacy still mandatory?

Yes. Article 4 still requires providers and deployers of AI systems to take measures to support the AI literacy of their staff. What changed is that no specific or “sufficient” level is required. National authorities supervise the rule from 2 August 2026. A certificate is not needed.

Do the dates apply to existing AI?

For high-risk systems already on the market before the new dates, the rules apply only if their design changes significantly from that date. High-risk systems used by public authorities must comply by 2 August 2030 in any case.

Do small companies get an exemption?

The Commission’s overview describes relief, not a general exemption. Some simplified obligations for SMEs, such as simplified technical documentation, were extended to small mid-cap companies. The Commission and Member States must also support SMEs in particular with AI literacy (Article 4(2)).

Where should you start?

Put the question of who owns AI on the agenda of your next management meeting.

The question is simple: who owns AI in our organisation, and how ready are our people for December 2027? Pair that with a short plan for AI literacy that fits your teams, and agree who keeps watch wherever customers or citizens meet AI. The Omnibus gave organisations more time and more clarity. It did not give them a reason to wait. Organisations that start building the AI-first organisation now will be ahead later, not behind. How leaders steer their organisations through changes like these is a theme in the keynote on leadership and management. The wider shift that AI brings is the subject of the keynote on the AI revolution.