The AI Omnibus: What Changed in the EU AI Act and What It Means for Your AI Strategy

The EU AI Act entered the books in 2024 as the first comprehensive law on artificial intelligence. It was always going to need adjustment as the market and the standards behind it matured. The AI Omnibus is that adjustment.

On 19 November 2025 the European Commission published the Digital Omnibus, a wider simplification package covering data, cybersecurity, and AI rules. The AI-specific track within it, commonly called the AI Omnibus or Digital Omnibus on AI, proposed targeted amendments to the AI Act rather than a rewrite.

That track is now law. The European Parliament and the Council adopted it on 8 July 2026 as Regulation (EU) 2026/1744, it was published in the Official Journal on 24 July 2026, and it entered into force on 27 July 2026. Wherever it does not amend the original AI Act timeline, that timeline still applies.

So the Omnibus is best read as three things at once: a timeline reset for high-risk systems, a simplification pass on documentation and registration, and a short list of new prohibitions. It is not a repeal, and it is not deregulation.

The headline change is the deadline relief for high-risk AI systems. The original AI Act made most high-risk obligations applicable from 2 August 2026. The Omnibus splits that into two later dates:

• Stand-alone high-risk systems (Annex III) move to 2 December 2027. These are use-case driven systems such as AI in recruitment, credit scoring, education, or access to essential services.
• High-risk systems embedded in regulated products (Annex I) move to 2 August 2028. These are AI components in products already covered by EU product-safety law, like medical devices or machinery.

Two related dates also changed. The machine-readable marking of AI-generated content under Article 50(2) still applies from 2 August 2026, but providers of generative AI systems placed on the market before that date get a four-month transitional period, until 2 December 2026. And member states must have at least one national regulatory sandbox operational by 2 August 2027.

One detail matters for planning. The Commission's original November proposal tied the high-risk start date to the availability of harmonised standards and support tools, a conditional trigger with a backstop. The final text dropped that conditional approach and settled on fixed dates. That removes ambiguity: you can now plan against 2 December 2027 and 2 August 2028 as firm targets, not moving ones.

It would be a mistake to read the Omnibus as pure relief. The regulation adds two new prohibited practices to Article 5, the article that lists AI uses banned outright in the EU. From 2 December 2026, it is prohibited to use AI systems that generate or manipulate:

• Non-consensual intimate imagery, meaning realistic images, video, audio or similar material of an identifiable person's intimate parts, or of that person engaged in sexually explicit activities, without that person's explicit consent.
• Child sexual abuse material, in line with the existing definition under Directive 2011/93/EU.

Providers carry liability where generating such material is the system's intended purpose, or a reasonably foreseeable and reproducible outcome without significant technical modification while the system lacks reasonable and adequate safety measures. Deployers are liable where they use a system for the purpose of generating such material. The recitals make clear that accidental generation is not covered. For most enterprises these prohibitions will not touch day-to-day use, but they confirm the direction of travel: the EU is still willing to add hard limits, not only defer them.

The other half of the Omnibus is genuine simplification. The changes target paperwork and overlap rather than the substance of the obligations.

• Registration trimmed. For systems the provider has assessed as not high-risk under Article 6(3), two data points are deleted from the Annex VIII registration entry. Registration itself stays, so core transparency is intact.
• AI literacy softened. The Article 4 wording moves from a duty to ensure a sufficient level of AI literacy to a duty to take measures to support it among staff. The duty remains, but it no longer requires any specific level of literacy.
• SME and small mid-cap relief. Simplified technical documentation now extends to SMEs and small mid-caps. Penalties must weigh their economic viability, and fines for small mid-caps are capped at the lower amount, as they already were for SMEs.
• Post-market monitoring flexibility. The Commission no longer adopts a mandatory template for the monitoring plan. Providers can tailor their plan, and the Commission publishes guidance, with a voluntary template, by 2 September 2027.
• Bias-detection basis widened. A new Article 4a moves and extends the existing Article 10(5) basis for processing special-category data to detect and correct bias. The safeguards are strict: only where other data, including synthetic or anonymised data, will not do; state-of-the-art security and privacy-preserving measures such as pseudonymisation; no transfer to third parties; and deletion once the bias is corrected.
• Centralised supervision. The EU AI Office gains exclusive competence over AI systems based on a general-purpose AI model where model and system come from the same provider or undertaking, and over AI systems that are, or are integrated into, a designated very large online platform or search engine. Exceptions include law enforcement, border management, financial institutions, critical infrastructure and the administration of justice.

None of this removes the need to govern AI. It lowers the friction of proving that you do.

The risk-based architecture of the AI Act is intact. The Omnibus moves dates and trims forms; it does not redraw the map.

Risk classification still applies. The four-tier model of unacceptable, high, limited, and minimal risk stays. Your obligations still depend on where each system sits, and the high-risk categories in Annex III and Annex I are unchanged in substance.

Earlier obligations already bind you. The prohibited-practice rules have applied since February 2025. The obligations for general-purpose AI models have applied since August 2025. The Omnibus does not roll those back.

The underlying work is unchanged. A high-risk system still needs a risk-management system, data governance, technical documentation, logging, human oversight, and traceability of the data behind it. That work takes months. The new dates change when you must finish, not what you must produce.

For most organizations the right response is to treat the extra time as runway, not as permission to pause. Four moves make the most of it.

1. Inventory and classify every AI system. You cannot apply the right obligations until you know which systems are high-risk, which are limited-risk, and which fall outside scope. Build a living inventory that records purpose, data sources, and risk tier for each system, including the models embedded in tools you buy.

2. Treat documentation as a data problem. The Act's technical documentation, logging, and data-governance requirements all depend on knowing where your data came from and how it flows. End-to-end data lineage and a clear record of sources turn a scramble before the deadline into a standing capability.

3. Align AI compliance with GDPR. The Act and the GDPR overlap wherever AI touches personal data. Tracking personally identifiable information through your systems serves both regimes, and the new bias-detection provision sits squarely on that boundary. Do the mapping once and reuse it.

4. Connect it to the wider regulatory picture. For regulated sectors the AI Act lands alongside DORA and the NIS2 Directive. The evidence base they each demand, accurate records of systems, data, and controls, is largely shared. A single governed source of truth pays for itself across all of them.

For a deeper look at the original deadlines and obligations, see our earlier guide on EU AI Act compliance deadlines, and for the broader picture, our guide to governing AI safely across classification, GDPR, copyright, and internal policy.

Every obligation the AI Act keeps comes back to the same question: can you show, with evidence, what your AI uses and where that data came from? That is a metadata and governance problem, and it is the problem Dawiso is built to solve.

The Data Catalog gives you the living inventory of data assets and the systems that consume them. Interactive Data Lineage traces data end to end, so technical documentation and impact analysis stop being manual archaeology. The AI governance solution ties classification, ownership, and policy to the assets themselves rather than to a spreadsheet that drifts out of date.

For teams putting AI to work, the Context Layer and Model Context Protocol (MCP) support give agents the governed business context they need to reason about your data, with the access controls and traceability that compliance expects. The result is the same record serving both your AI strategy and your AI Act evidence.

The Omnibus bought you time. The organizations that use it to build a governed, AI-ready foundation will meet the 2027 and 2028 deadlines without a fire drill, and they will have a better data platform to show for it.