Der Digital Omnibus on AI: Was sich am AI Act geändert hat — und was jetzt gilt

Artikel auf Englisch

The EU has amended its AI rulebook before most of it applies. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends three regulations at once: the AI Act (Regulation (EU) 2024/1689), the EASA Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230.

It does not replace the AI Act. It changes specific provisions of it — above all the dates. One point of naming, because the two are easily confused: the Digital Omnibus on AI is adopted law. The Digital Omnibus on data (COM(2025) 837), which would amend the GDPR and the cookie rules, is still a proposal.

The new timeline

The Omnibus rewrites the application dates in Art. 113 AI Act and the transitional rules in Art. 111. There is no longer one "go-live" for high-risk AI, but two.

Date	What applies	Status
2 Feb 2025	Prohibited practices (Art. 5) and AI literacy (Art. 4)	in force
2 Aug 2025	General-purpose AI models, governance, penalties	in force
2 Aug 2026	Transparency (Art. 50) and general application	in force
2 Dec 2026	New bans on sexual deepfakes and AI-generated child sexual abuse material (Art. 5(1)(ba), (bb)); Art. 50(2) marking duty for generative systems already on the market before 2 Aug 2026 (Art. 111(4))	upcoming
2 Dec 2027	High-risk AI systems under Art. 6(2) and Annex III (e.g. recruitment, credit, education)	moved — was 2 Aug 2026
2 Aug 2028	High-risk AI systems under Art. 6(1) and Annex I (safety components of regulated products)	moved — was 2 Aug 2027
2 Aug 2030	High-risk systems used by public authorities that were placed on the market earlier (Art. 111(2))	long-stop

Recital 40 gives the reason for the delay: standards, common specifications and national authorities were not ready in time, which did not justify keeping 2 August 2026 as the start date for high-risk rules.

What changed in substance

Two new prohibitions

For the first time, Art. 5 has been extended. From 2 December 2026, it prohibits AI systems that generate or manipulate realistic intimate or sexually explicit images, videos or audio of an identifiable person without that person's explicit consent (Art. 5(1)(ba)), and AI systems that generate child sexual abuse material (Art. 5(1)(bb)). New paragraphs 1a and 1b define when providers and users are caught — for providers, for example, where such output is a reasonably foreseeable and reproducible result and adequate safeguards are missing.

AI literacy: support, not guarantee

Art. 4 has been rewritten. Providers and deployers must still take measures to support the AI literacy of their staff, but the new text says expressly: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The Commission is to publish practical examples. The duty itself has applied since February 2025 and continues to apply.

Sensitive data for bias correction

A new Art. 4a allows providers of high-risk AI systems to process special categories of personal data where this is strictly necessary to detect and correct bias, subject to safeguards such as pseudonymisation and deletion once the bias has been corrected. The former basis in Art. 10(5) has been deleted.

What counts as a safety component

New paragraphs in Art. 6 clarify the product route to high-risk: AI used solely for non-safety purposes such as user assistance, performance optimisation or convenience is not a safety component (Art. 6(1a)), but AI whose failure would endanger health and safety is (Art. 6(1b)).

Less duplication

Conformity assessment: for AI in products under Annex I, Section A, the AI Act requirements are assessed within the existing sectoral procedure (Art. 43(3)).
FRIA and DPIA: the AI Office is to develop a template questionnaire for the fundamental rights impact assessment, with the option to cross-refer to or include parts of the GDPR data protection impact assessment (Art. 27(5)).
Cyber Resilience Act: high-risk AI systems that meet the conditions of Art. 12(1) CRA are deemed to meet the AI Act's cybersecurity requirements (Art. 42(3)).
Registration: systems that a provider has assessed as not high-risk under Art. 6(3) must still be registered, but with less information (Annex VIII, Section B, points 7 and 9 deleted).

Relief for smaller companies

The Omnibus introduces small mid-cap enterprises (SMCs) alongside SMEs. Both may provide technical documentation on a simplified Commission form, the simplified quality management route now covers all SMEs, and fines for SMCs are capped at the lower of the amount or the percentage. Member States have until 2 August 2027 to make at least one AI regulatory sandbox operational.

A stronger AI Office

The AI Office becomes exclusively competent for certain systems — for example AI systems built on a general-purpose AI model by the same provider — and receives investigation and enforcement powers, including fines (Arts. 75 to 75d).

What did not change

The general application date of 2 August 2026 stands, including the transparency duties under Art. 50. The obligations for general-purpose AI models have applied since August 2025. The existing prohibitions and the AI literacy duty have applied since February 2025. And the AI Act still applies in addition to the GDPR, not instead of it.

What this means in practice

Now: AI literacy measures and the Art. 50 transparency duties already apply. If you place a generative AI system on the market that predates 2 August 2026, the marking duty under Art. 50(2) applies from 2 December 2026.
By 2 December 2026: check that no system you provide or use can produce the newly prohibited content.
High-risk: the extra time is not a reason to stop. Classify your systems now — Annex III or Annex I decides whether your date is December 2027 or August 2028 — and use the time to build documentation, risk management and human oversight.

If you are unsure which date applies to your AI systems, I can help you classify them and plan the next steps.

Sources

This article is a summary for orientation and does not replace legal advice on a specific case.