The Original EU AI Act vs the Digital Omnibus: Every Deadline and Obligation That Changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, did not rewrite the EU AI Act, but it changed more than most headlines suggest. It pushed the high-risk deadlines back by 16 and 12 months, softened the AI literacy duty, added two new bans, widened the legal basis for bias testing, pulled AI-enabled machinery out of the main high-risk regime and gave the AI Office direct supervisory powers. It entered into force on 27 July 2026. This is the complete before-and-after.

Use this guide to update your compliance plan, roadmap and contracts. Every change is listed with the original rule, the new rule and what it means in practice.

Every deadline that changed

What did NOT move

Every obligation that changed

1. Two new prohibited practices

The Omnibus added two bans to Article 5, applying from 2 December 2026, with no exemption for systems already on the market:

• AI systems that generate or manipulate realistic intimate or sexually explicit images of an identifiable person without their explicit consent, so-called "nudifier" tools
• AI systems that generate child sexual abuse material

Providers may not place such systems on the market where generating this content is the intended purpose, or a reasonably foreseeable outcome without adequate safeguards. Deployers are caught only when they use a system to generate the material.

2. AI literacy: from "ensure" to "support"

The duty still exists. What changed is the standard: you need a credible, proportionate literacy programme, not proof that every individual reached a fixed level.

3. A wider legal basis for bias testing: new Article 4a

The original Article 10(5) let only high-risk providers process special category data, such as ethnicity or health data, to detect and correct bias. The new Article 4a extends this, under conditions, to providers and deployers of other AI systems. It is strict:

• Only where strictly necessary, and recorded as such
• Only if synthetic, anonymised or other data won't work
• Pseudonymisation, technical limits on reuse and controlled, documented access
• No transmission to other parties
• Deletion once the bias is corrected or the retention period ends

Article 4a creates a permission, not a duty. There is no new general obligation to test every AI system for bias.

4. Registration: kept, but simplified

The Commission proposed dropping EU database registration for systems that providers self-assess as not high-risk under Article 6(3). Legislators rejected that. Those providers must still register, but through a simplified procedure with less information.

5. Machinery leaves the main high-risk regime

The Machinery Regulation (EU) 2023/1230 moved from Section A to Section B of Annex I. AI-enabled machinery now follows a sectoral approach rather than the AI Act's high-risk requirements directly. The Commission will add AI requirements to the Machinery Regulation through delegated acts. Separately, for other Annex I products, specific AI Act requirements may be limited where sectoral law gives equivalent protection, again under conditions set by delegated act.

6. A narrower "safety component"

An AI component counts as a safety component only where its purpose is to prevent or mitigate risks to health, safety or property. AI used purely for convenience, assistance or efficiency is not automatically high-risk unless its failure would endanger health or safety.

7. Relief for SMEs and small mid-caps

Relief previously aimed mainly at SMEs now extends to small mid-cap enterprises (SMCs), as defined in Commission Recommendation (EU) 2025/1099.

8. The AI Office becomes a direct supervisor

The AI Office gains exclusive competence to supervise AI systems built on a general-purpose AI model when the model and the system come from the same provider or corporate group. It also covers systems that are, or are integrated into, very large online platforms or search engines. It gets structured investigation, inspection and enforcement powers, including penalties and periodic penalty payments.

National authorities keep primary competence in sensitive areas, including Annex I products, certain biometric systems, law enforcement, border management, financial institutions and the administration of justice.

9. Sandboxes and real-world testing

Each Member State now has until 2 August 2027 to set up at least one national AI regulatory sandbox. The AI Office can run a new EU-level sandbox. Real-world testing outside sandboxes is expanded for Annex III systems and certain product-law systems.

10. Grandfathering clarified

Under Article 111(2), grandfathering applies per type and model. If one unit of a high-risk system was lawfully placed on the market before the compliance date, other units of the same type and model can continue to be placed on the market without new obligations, as long as the design isn't significantly changed. A significant change triggers full compliance.

11. Conformity assessment and standards

• A single application and unified assessment for bodies seeking designation under both the AI Act and product legislation
• A new Annex XIV with designation codes for product-related, biometric, generative and agentic AI
• High-risk systems meeting the Cyber Resilience Act's conditions are presumed to meet the AI Act's cybersecurity requirement
• A duty to request joint-compliance standardisation deliverables (Article 40(2))

12. Value chain and FRIA

Where another operator becomes a provider under Article 25, the original provider must cooperate and supply information, technical access and assistance. Written arrangements between high-risk providers and third-party suppliers of models, tools and components are reinforced. For FRIAs, deployers can cross-reference or reuse an existing DPIA, and the AI Office must develop a FRIA questionnaire template, including an automated option.

The changes at a glance

The full timeline, as it now stands

• 1 Aug 2024

  AI Act enters into force.

• 2 Feb 2025

  Original prohibitions and AI literacy apply.

• 2 Aug 2025

  GPAI model obligations apply.

• 19 Nov 2025

  Commission proposes the Digital Omnibus on AI.

• 7 May 2026

  Parliament and Council reach political agreement.

• 29 Jun 2026

  Final adoption.

• 27 Jul 2026

  Regulation (EU) 2026/1744 enters into force.

• 2 Aug 2026

  Article 50 transparency for new systems; AI Office enforcement; penalties.

• 2 Dec 2026

  New nudifier and CSAM bans; Art. 50(2) marking for existing systems.

• 2 Aug 2027

  National regulatory sandboxes deadline.

• 2 Dec 2027

  Annex III high-risk obligations apply.

• 2 Aug 2028

  Annex I high-risk obligations apply.

• 2 Aug 2030

  Legacy high-risk systems used by public authorities must comply.

What to do now: a 6-step update plan

1. Re-date your roadmap

   Move high-risk milestones to 2 December 2027 or 2 August 2028. Keep everything else on its original date.

2. Check the new bans

   If you build or deploy image or video generation, confirm you have adequate safeguards against non-consensual intimate imagery and CSAM before 2 December 2026.

3. Re-scope your classification

   Re-test Annex I systems against the narrower safety-component definition, and check whether AI-enabled machinery now falls under the sectoral route.

4. Rework your AI literacy programme

   Shift from proving individual competence to a documented, proportionate programme of support measures.

5. Decide on bias testing under Article 4a

   If you want to use sensitive data for bias detection, document strict necessity and build the safeguards before you start.

6. Check if you are an SMC, or under the AI Office

   Small mid-caps can now use simplified documentation. Providers of GPAI-based systems built on their own models should expect AI Office supervision.

Common mistakes to avoid

• Treating the Omnibus as a general pause of the AI Act
• Confusing the AI Omnibus (adopted) with the separate GDPR Omnibus proposal (still not law)
• Assuming AI literacy no longer applies
• Reading Article 4a as a duty to test for bias, or as a free pass to use sensitive data
• Citing the old 2 August 2026 high-risk date in contracts or policies
• Ignoring the December 2026 deadlines while focusing on 2027

A prompt to update your AI Act compliance plan

Paste in your current plan to see exactly what the Omnibus changes for you. Verify the output against the regulation text before acting on it.

You are an EU AI Act compliance specialist. The AI Act (Regulation
(EU) 2024/1689) was amended by the Digital Omnibus on AI, Regulation
(EU) 2026/1744, in force since 27 July 2026.

Our organisation:
[size (SME, small mid-cap, large); whether we are provider, deployer
or both; AI systems with their purpose and risk classification;
whether any are machinery, safety components, GPAI-based, or
generate images or video]

Our current compliance plan:
[paste milestones, owners and dates]

Produce:
1. A table of every milestone in our plan with: original date, the
   correct date after the Omnibus, and whether it moved.
2. Any NEW obligations that apply to us (for example the December
   2026 prohibitions), with dates.
3. Any obligations that became lighter for us (AI literacy, SME/SMC
   documentation, registration), and what we can simplify.
4. Systems whose classification may change under the narrower
   safety-component definition or the machinery move.
5. Whether we may fall under direct AI Office supervision.
6. Ten actions to take before 2 December 2026, ranked by priority.

Use only what I provide and mark uncertain points UNKNOWN. Flag
anything that needs checking against the Official Journal text.

The Omnibus bought you time on high-risk AI, not a holiday from the AI Act. Use the 16 months to build properly, not to stop building. — Kumail Mehdi

Frequently asked questions

Sources

• Regulation (EU) 2024/1689 — the original EU AI Act (EUR-Lex)
• Cooley — Digital AI Omnibus delays key deadlines, introduces new rules
• DLA Piper — Digital Omnibus on AI
• Covington Inside Privacy — Timeline relief, simplification and new prohibitions
• Simmons & Simmons — Provisional agreement on the AI Omnibus
• Gibson Dunn — EU AI Act Omnibus agreement
• EU Digital Policy — GDPR Digital Omnibus status