Digital Omnibus: what did the EU change in the AI Act in 2026?
Short answer
The Digital Omnibus on AI (Regulation (EU) 2026/1744) was adopted on 8 July 2026 and entered into force on 27 July 2026. It delays the high-risk rules to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), turns AI literacy into a duty to take measures rather than to ensure a set level, gives relief to small and medium-sized businesses, and adds a ban on non-consensual sexual deepfakes from 2 December 2026. The rules for chatbots and labelling still apply from 2 August 2026.
The main changes
| Before | After the Digital Omnibus |
|---|---|
| High-risk in Annex III from 2 August 2026 | From 2 December 2027 |
| High-risk in products (Annex I) from 2 August 2027 | From 2 August 2028 |
| Ensure a sufficient level of AI literacy | Take measures for AI literacy |
| Bias data only for providers of high-risk AI (Article 10(5)) | New Article 4a for everyone, under strict conditions |
| – | New bans on non-consensual sexual deepfakes and child sexual abuse material from 2 December 2026 |
| Fundamental rights impact assessment (FRIA) on its own | Can build on your DPIA under the GDPR |
What did not change
The duties for businesses that use high-risk AI (Article 26) are the same – they just apply later. The rules for chatbots, deepfakes and labelling in Article 50 apply from 2 August 2026 as planned. The fine caps for prohibited AI are unchanged.
What does it mean in practice?
For an ordinary business the message is: you have more time for high-risk, but not for the basics. Use the time to get your register, training and human decisions in order so you are ready well ahead – and remember that Article 22 GDPR on automated decisions already applies.
What to do
- Don't treat the delay as a break.The bans, AI literacy, Article 50 and the GDPR still apply. These are what authorities can supervise now.
- Update your deadlines.High-risk in Annex III: 2 December 2027. Products in Annex I: 2 August 2028.
- Adjust your training.The focus is now on measures that fit the tasks and the risk – not on everyone reaching the same level.
- Check the new bans.If you build generative AI, you must prevent non-consensual sexual deepfakes from 2 December 2026.
What the law says
- Regulation (EU) 2026/1744 – Digital Omnibus on AI
- Amends Regulation (EU) 2024/1689. Published in the Official Journal on 24 July 2026.
- Article 4 AI Act (new wording)
- Providers and deployers take measures for AI literacy; the Commission and Member States must support them, especially small businesses.
- Article 4a AI Act (new)
- Under strict conditions, allows processing of sensitive personal data to detect and correct bias.
Questions and answers
Was the AI Act delayed?
Only the high-risk rules. The bans, AI literacy, the rules for general-purpose AI models and transparency (Article 50) apply as planned.
Has the AI literacy requirement been removed?
No. Businesses must still take measures, but they don't have to ensure a set level for every single employee.
What does the Omnibus mean for small businesses?
Lower fine caps (the lower of the amount and the percentage), simpler technical documentation for providers and support from the authorities – but no exemption from the basic rules.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.