Digital Omnibus EU AI Act changes beyond the high-risk deadline: what is now law

From proposal to adopted law

Most coverage of the Digital Omnibus has centred on the shifted high-risk dates: 2 December 2027 for Annex III use cases and 2 August 2028 for Annex I products. This page leaves those aside and looks at everything else the amending act touches.

The sequence matters for roadmap hygiene. The Commission adopted its proposal (COM(2025)0836) on 19 November 2025. Parliament adopted amendments to it on 26 March 2026, and Council and Parliament reached a provisional agreement on 7 May 2026. Regulation (EU) 2026/1744 was adopted on 8 July 2026 and entered into force on the third day after publication in the Official Journal, which the Commission gives as 27 July 2026.

The Regulation amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230. Parliament's March text covered only the first two, so the adopted act is wider than the proposal it started from. The working legal baseline is now the consolidated AI Act dated 27 July 2026, not the original 2024 text. Any control mapping, policy library or roadmap that still cites proposal-stage dates should be re-baselined.

Changes that are now in the text or the agreed package

Amended Article 113(3)(a) splits the application dates for Chapters I and II. Those chapters have applied since 2 February 2025, except Article 5(1) first subparagraph points (ba) and (bb) and Article 5(1a) and (1b), which apply from 2 December 2026. The Commission also states that a new prohibition, referred to as Prohibition 9, takes effect in December 2026 and was introduced through the AI Omnibus. Teams should map each of these Article 5 provisions to their system inventory before that date.

The 7 May 2026 provisional agreement set two further timing changes. National-level AI regulatory sandboxes are postponed to 2 August 2027. The grace period for providers to implement transparency solutions for artificially generated content is shortened from six months to three, with the new deadline at 2 December 2026.

The second change has operational weight. A transparency solution for generated content is a technical control on the systems that produce the content, so it belongs on the engineering roadmap alongside the legal one. Providers of content-generating systems should treat 2 December 2026 as a delivery date, and confirm it against the final Articles before hard-coding it.

Amendments that began as Commission proposals

The following items were described by the Commission and Council as proposals. Record each separately as adopted text, agreement item or proposal-only, and have legal review confirm the Official Journal wording before changing a control.

• AI literacy: Proposal: replace the horizontal company obligation with a duty on the Commission and Member States to encourage providers and deployers to ensure adequate literacy. Implication: keep existing training programmes and records until the final wording is confirmed.
• Special-category data for bias detection: Proposal: extend the possibility to process sensitive personal data for bias detection and mitigation. Implication: hold data governance and DPIA practice steady until the final conditions and safeguards are confirmed.
• SME and small mid-cap relief: Proposal: extend SME exemptions to small mid-caps. Implication: confirm eligibility and thresholds in the final text before relying on any exemption.
• AI Office powers and governance: Proposal: reinforce the AI Office's powers and reduce governance fragmentation. Implication: expect more centralised supervisory contact; review who in the organisation handles regulator engagement.
• Reduced requirements in limited cases: Proposal: reduce requirements in a very limited number of cases. Implication: do not retire any control on this general description alone.

The AI literacy question

AI literacy deserves separate attention because it is the change most likely to prompt premature action. The Commission's staff working document concluded that the horizontal obligation on companies to ensure sufficient AI literacy does not achieve its objective and causes compliance concerns. Its proposed remedy shifts the duty from companies to public bodies, which would soften the obligation for providers and deployers.

That is the proposal-stage position. A compliance team that dismantles its literacy programme on the strength of a proposal risks being wrong if the final text differs. A team that ignores the proposal entirely may carry cost that the adopted text no longer requires. The balanced course is to keep the programme and its records, and to schedule a decision once legal review has compared the adopted wording with the proposal.

Literacy also has a second anchor. The original Act's recitals expect persons assigned to human oversight of high-risk systems to have adequate literacy, training and authority. Even if the general duty is reshaped, oversight roles still need people who can do the work.

What stays the same and what to do now

The Omnibus is framed as simplification of implementation, not removal of the Act's operating model. The original recitals tie deployers of high-risk systems to technical and organisational measures for using systems according to their instructions, to monitoring of system functioning, to record-keeping, and to human oversight by trained and authorised people. Nothing in the amendments described here shows these duties being removed, so current control mapping should keep them.

That has a practical consequence for evidence. Evidence of how AI systems behave in use, such as which interactions were allowed, modified or stopped and which tool calls were made, stays relevant whichever proposal elements survived. Documentation written once at deployment does not show behaviour in operation.

• Re-baseline the roadmap on Regulation (EU) 2026/1744 and the 27 July 2026 consolidated text, and retire proposal-stage dates.
• Add the 2 December 2026 milestones: the Article 5 provisions (ba), (bb), (1a) and (1b), and generated-content transparency.
• Keep AI literacy programmes and records until legal review confirms the final wording.
• Retain deployer monitoring and record-keeping controls and their evidence.
• Track each Omnibus change with its own status label: adopted text, agreement item or proposal-only.

Where runtime enforcement fits

Obligations that depend on the demonstrable behaviour of AI systems in use are the ones least affected by legislative movement. Trussed enforces policy in the execution path, across models, agents, tools and MCP servers, so that each interaction or tool call can be allowed, redacted, blocked, rate limited or escalated for human approval at runtime, not reviewed after the fact. That enforcement generates audit-ready evidence mapped to the EU AI Act, which gives compliance teams a record of what the AI was permitted to do and what it did.

This addresses monitoring and record-keeping expectations. It does not decide which Omnibus amendments apply to your organisation, a question for legal review of the adopted text.