The EU AI Act Digital Omnibus: what changed in 2026

What is the Digital Omnibus on AI?

The Digital Omnibus on AI is Regulation (EU) 2026/1744. It amends the EU AI Act, Regulation (EU) 2024/1689, to simplify how it is implemented. Its Article 1 holds the AI Act changes. Articles 2 and 3 adjust EU aviation and machinery law, and Article 4 covers entry into force.

Why it was needed: recital 40 points to the delayed availability of standards, common specifications and guidance, and to delays in setting up national authorities. Businesses faced high-risk duties they could not yet show compliance with. The Commission's proposal linked the start dates to standards being ready. The final law set fixed dates instead.

Which AI Act deadlines moved?

Only the high-risk dates, the national sandbox deadline and a narrow marking grace period moved. Art. 1(40) rewrote Art. 113, the Act's application clause.

The legacy rule still applies. High-risk systems already on the market before their application date are caught only if their design changes significantly afterward, except those used by public authorities. The Commission's AI Act Service Desk timeline shows the amended dates.

What new prohibitions did the Omnibus add?

Art. 1(7) inserted two bans into Art. 5:

• Point (ba): AI that generates or manipulates realistic intimate or sexually explicit images, video or audio of an identifiable person. The person must not have given freely given, specific, informed, unambiguous and explicit consent.
• Point (bb): AI that generates or manipulates child sexual abuse material, as defined in Directive 2011/93/EU.

New Art. 5(1a) sets who is caught. A provider is caught if generating such material is the system's intended purpose. It is also caught if that output is a reasonably foreseeable and reproducible result and the system lacks adequate safeguards. A deployer is caught only when it uses a system to generate such material. New Art. 5(1b) clarifies that edits which do not increase exposure, or change depicted sexual activity, are not "manipulation" under point (ba).

Both bans apply from 2 December 2026, not from entry into force. Breaches fall in the top fine tier: €35 million or 7% of worldwide annual turnover. See high-risk vs prohibited AI and deepfake.

What else changed?

Each change below cites the point of Art. 1 of Regulation (EU) 2026/1744 that made it.

People and data

• AI literacy (Art. 1(5), Art. 4). Providers and deployers must now take measures to support their staff's AI literacy. The new text says they need not guarantee any specific level. See AI literacy.
• Bias-detection data (Art. 1(6), new Art. 4a). Providers of high-risk systems may exceptionally process special-category data where strictly necessary to detect and correct bias, with safeguards. Paragraph 2 extends this, under conditions, to other providers and deployers. The old Art. 10(5) was deleted (Art. 1(9)).

Smaller companies

• New definitions (Art. 1(4), Art. 3(14a) and (14b)). SMEs and small mid-caps (SMCs) are defined by reference to Commission recommendations.
• Lighter paperwork (Art. 1(10) and (11)). SMEs and SMCs may use a simplified form of technical documentation (Art. 11(1)). Quality management systems scale to their size (Art. 17(2)).
• Lower fines (Art. 1(38), new Art. 99(6a)). SMCs now face the lower of the fixed amount and the turnover percentage. This covers the €15 million and €7.5 million tiers, not the prohibited-practices tier. SMEs already had the lower-of rule for all tiers.

High-risk systems and the value chain

• Safety components (Art. 1(4) and (8)). Art. 3(14) now covers only components that perform a safety function or whose failure endangers health and safety. New Art. 6(1a) to (1c) refine the Annex I route.
• Art. 6(3) registration (Art. 1(42)). Two items were dropped from the data providers register for systems they assess as not high-risk (Annex VIII, Section B). Registration itself remains (Art. 49(2)).
• Value chain cooperation (Art. 1(12), Art. 25(2)). When another party becomes the provider, the original provider must supply technical documentation, known limitations and failure modes, and targeted technical access. Breaches of Art. 25(2) and (4) now carry fines of up to €15 million or 3% (new Art. 99(4)(da)).
• FRIA and DPIA (Art. 1(13), Art. 27(4) and (5)). A fundamental rights impact assessment may cross-reference or include relevant DPIA parts. The AI Office will provide a questionnaire template, including an automated tool. See FRIA vs DPIA.
• Cybersecurity (Art. 1(18), new Art. 42(3)). High-risk systems covered by the Cyber Resilience Act can be presumed to meet the Art. 15 cybersecurity requirements, under conditions.
• Machinery (Art. 1(41)). Machinery moved from Section A to Section B of Annex I. AI requirements for machinery will now flow through the Machinery Regulation, which Article 3 of the Omnibus amends.

Enforcement

• AI Office competence (Art. 1(31), Art. 75). The AI Office becomes exclusively competent for AI systems built on a provider's own general-purpose AI model. Exclusions include AI in Annex I products, critical infrastructure, certain law enforcement, border and financial uses, and the administration of justice. It also covers AI in very large online platforms and search engines.
• New powers (Art. 1(32), Arts. 75a to 75d). The AI Office gets supervisory and enforcement powers, including commitments, fines and periodic penalty payments, with procedural safeguards. Serious incidents for high-risk systems under its competence are reported to it (Art. 75(1a)).
• Sandboxes and testing (Art. 1(22) and (25)). National sandboxes must be running by 2 August 2027. The AI Office may run an EU-level sandbox. New Art. 60a allows real-world testing for Annex I Section B products.

What did the Omnibus not change?

The consolidated text on the AI Act Service Desk marks every Omnibus change. These provisions carry no change markers:

• the eight original prohibitions in Art. 5(1)(a) to (h), applying since 2 February 2025;
• the GPAI provider obligations in Arts. 53 to 55, including adversarial testing for systemic-risk models;
• the penalty amounts: €35 million or 7%, €15 million or 3%, €7.5 million or 1% (Art. 99);
• Art. 50(1) to (6) and their 2 August 2026 date; only Art. 50(7), on codes of practice, was amended;
• serious-incident deadlines of 15, 10 and 2 days (Art. 73);
• deployer duties (Art. 26), provider duties (Art. 16) and the right to an explanation (Art. 86).

How does the Omnibus affect the AIGP exam?

The AIGP Body of Knowledge v2.1 was approved in September 2025, before the Omnibus existed. It took effect on 2 February 2026.

• Read the stem's framing. A question may test the Act as adopted (Annex III from 2 August 2026) or as amended (2 December 2027).
• Art. 50 is the 2 August 2026 answer. If a question asks what applies from that date, pick transparency, not Annex III high-risk duties.
• The grace period is narrow. Only generative systems on the market before 2 August 2026 get until 2 December 2026 for marking.
• New bans start on 2 December 2026, not on entry into force in July 2026.
• The fixed-date outcome matters. "Dates float until standards are published" describes the proposal, not the final law.

Our lesson on the AI Act clock and the 2026 Omnibus drills these dates. The AIGP exam guide covers the Body of Knowledge.

Change log

• 7 Nov 2026: Page published. Each change checked against the EUR-Lex text of Regulation (EU) 2026/1744 and the AI Act Service Desk consolidated text.