On 27 July 2026, the Digital Omnibus on AI — Regulation (EU) 2026/1744 — entered into force, three days after its publication in the Official Journal. It is the first amendment to the AI Act since the Regulation was adopted in June 2024, and it landed only days before the AI Act's original general application date of 2 August 2026. For any organisation building, deploying or procuring AI systems in the EU, the practical question is simple: what changed, what did not, and what should you do differently now.

The headline change: high-risk deadlines move, but do not disappear

The most consequential amendment rewrites Article 113 of the AI Act. Obligations for stand-alone high-risk AI systems classified under Annex III — including AI used in recruitment, credit scoring, education, law enforcement and critical infrastructure — did not start to apply on 2 August 2026. They now apply from 2 December 2027. For high-risk AI systems embedded in regulated products under Annex I (medical devices, machinery, toys and similar), the deadline moves further still, to 2 August 2028. Neither deadline is conditional on the prior availability of harmonised technical standards, which had been the original proposal on the table; the Council and Parliament ultimately agreed on fixed calendar dates instead. Organisations that had been racing to complete conformity assessments before August 2026 now have a genuine planning window. But the underlying obligations have not been removed, only postponed, and the classification work (is a given system actually high-risk under Annex III or Annex I?) should not be shelved along with the paperwork.

What the Omnibus left untouched

This is where most commentary goes wrong, and where clients most often ask the wrong follow-up question. The Digital Omnibus did not change:

• The prohibited AI practices under Article 5 that have applied since 2 February 2025. They remain fully enforceable; the Omnibus only adds two new prohibitions (see below).
• The obligations for providers of general-purpose AI (GPAI) models under Articles 51–56, in force since 2 August 2025.
• The timing of the core transparency obligations under Article 50 — the duty to disclose that a user is interacting with an AI system, that content is AI-generated, and to label deepfakes. These have applied since 2 August 2026 as originally scheduled, subject only to a transitional period until 2 December 2026 for machine-readable marking by systems already on the market (see below).

In other words, the Omnibus is a targeted deferral of the highest-cost compliance layer (technical documentation, conformity assessment and quality management for high-risk systems), not a general pause on AI regulation. Providers of GPAI models, and any system with a chatbot, generated content or synthetic media component, are already subject to obligations that apply today.

Two new prohibitions, effective 2 December 2026

Article 5 gains two additional prohibited practices: AI systems used to generate non-consensual intimate imagery of identifiable persons, and AI systems used to generate child sexual abuse material. Both take effect on 2 December 2026. Providers are caught where such output is the intended purpose, or where it is reasonably foreseeable and the system lacks adequate safeguards; deployers are caught when they use a system to generate such material. The same date is the deadline for machine-readable marking of AI-generated content (watermarking and metadata obligations under Article 50(2)) for generative AI systems placed on the market before 2 August 2026.

Article 4 (AI literacy): softened, not removed

The duty under Article 4 has been rewritten from an obligation to ensure a sufficient level of AI literacy among staff to an obligation to take measures to support its development, without any requirement to guarantee a specific level of literacy for any individual. This is a real dilution — an obligation of effort rather than of result — but it remains binding on all providers and deployers, and has applied in its new form since 27 July 2026. The Commission and the Member States must, for their part, support and facilitate these efforts, particularly for SMEs. Internal AI-literacy programmes should continue; the bar for what counts as adequate has simply become easier to demonstrate.

Relief for SMEs — and a genuinely new category: small mid-caps

The Omnibus extends the AI Act's existing SME simplifications — simplified technical documentation templates that notified bodies must accept, more proportionate quality-management expectations, adapted penalty caps and priority access to regulatory sandboxes — to small mid-cap enterprises (SMCs), defined by reference to Commission Recommendation (EU) 2025/1099: companies that no longer qualify as SMEs but employ fewer than 750 people and have an annual turnover not exceeding €150 million or a balance sheet total not exceeding €129 million. This closes a real gap: mid-sized, fast-growing companies had previously faced the same documentation burden as large enterprises despite resource constraints comparable to those of SMEs. Companies that have outgrown the SME thresholds but employ fewer than 750 people should check their eligibility; the relief is not automatic and depends on meeting the turnover or balance-sheet test.

Regulatory sandboxes also move: every Member State must now have at least one operational national sandbox by 2 August 2027 (previously 2 August 2026), and a separate EU-level sandbox operated directly by the AI Office is being introduced, with priority access for SMEs, start-ups and SMCs.

A new administrative category: "agentic AI"

The most technically interesting change sits not in an Article but in a new Annex XIV, which introduces nomenclature codes used to designate what notified bodies are competent to assess. Among the new horizontal technology codes is AIH 0401, covering AI systems based on other emerging AI technologies not covered by the other codes, including agentic AI. This appears to be the first time the term "agentic AI" has entered binding EU law.

It is worth being precise about what this is and is not. It is an administrative classification code for notified-body designation purposes — not a legal definition, not a distinct risk tier, and not a new set of obligations keyed to a system's degree of autonomy. An agentic system built directly on a general-purpose AI model would in fact fall under a different, more specific code (AIH 0301); AIH 0401 is a residual category for agentic and other emerging architectures that do not fit the existing taxonomy.

For organisations deploying agents — tool-calling assistants, multi-step autonomous workflows, systems that can spawn sub-agents — the practical AI Act analysis has not changed. Classification still depends on what the agent does and in what context: an agent that screens job applicants or decides eligibility for an essential service is a different case from one that summarises internal documents. The prohibitions most likely to be relevant remain Article 5(1)(a) on harmful manipulation and Article 5(1)(b) on the exploitation of vulnerabilities.

AI Office competence clarified

The Omnibus confirms that, from 2 August 2026, the AI Office holds exclusive competence over AI systems built on general-purpose AI models where the model and the system are developed by the same provider, and extends that competence to AI systems integrated into, or constituting, very large online platforms or very large online search engines designated under the DSA. National competent authorities retain jurisdiction in specified sectors — law enforcement, border management, the judiciary and financial institutions.

What this means in practice

• The Article 50 transparency obligations, the revised AI-literacy obligation and the GPAI-model obligations already apply. If you have not yet reviewed your chatbots, AI-generated content and deepfake labelling, do so now.
• If you placed generative AI systems on the market before 2 August 2026, the deadline for machine-readable marking (watermarking and metadata) is 2 December 2026 — the same date on which the two new prohibitions take effect. Check that your systems have adequate safeguards against generating non-consensual intimate imagery or child sexual abuse material.
• Do not shelve Annex III and Annex I classification work merely because the high-risk obligations have moved to December 2027 and August 2028. The extra time is best used to get classification and documentation right, not to defer starting.
• Check whether your organisation qualifies as a small mid-cap and can access simplified documentation and quality-management pathways.
• If you build or deploy agentic systems, do not wait for a bespoke "agentic AI" legal regime that does not exist. Classify each agent by function and context under the existing framework, with particular attention to Article 5(1)(a)–(b) and Article 50 transparency.

Data Valley Consulting continues to monitor the implementation of the Digital Omnibus package, including the strand covering the GDPR, ePrivacy and the Data Act and a single entry point for incident reporting under NIS2, DORA and other regimes, and is available to support classification, documentation and compliance-roadmap work under the revised AI Act timetable.

‍

‍

‍

‍

‍