EU AI Act Digital Omnibus changes: what shifted in 2026

What changed in the EU AI Act Digital Omnibus, and does it move our deadline?

Regulation (EU) 2026/1744 amended the AI Act on 8 July 2026 and entered into force on 27 July 2026. It moved the high-risk rules in Chapter III Sections 1 to 3 to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I product systems, instead of 2 August 2026 and 2 August 2027. Whether that moves your deadline depends on which risk tier your AI systems fall into, the role you hold (provider, deployer, importer or distributor), and whether a system is already on the market. A deployer of a non-high-risk system may see no change to its core duties, while a provider of a high-risk Annex III system gets more time to build its quality management system and technical documentation. Confirm your tier and role first, because the new dates only help if your classification is correct.

Some duties did not move. The new prohibition on non-consensual intimate imagery and child sexual abuse material applies from 2 December 2026. Providers of generative systems placed on the market before 2 August 2026 must meet the Article 50(2) marking duty by the same date, under the transition in Article 111(4). Those dates are not delayed by the high-risk change, so a team that reads only the headline could miss them. Ask your legal or compliance lead to list each system with its market placement date, because that date decides whether the Article 111(4) transition applies to it.

Your organization keeps ownership of its compliance decisions, and the delay does not remove the need for evidence. An implementation partner can prepare systems, risk files, logs and technical documentation so they are ready when the new dates arrive. Only an independent auditor, or a notified body where one is required, issues conformity outcomes. When you request quotes, ask the partner to scope the work against the 2027 and 2028 dates and to state which deliverables assume a notified body review. Budget owners should treat the extra time as a planning window, not a reason to pause preparation.

Which amendments affect which obligations

This table maps each change made by Regulation (EU) 2026/1744 to the article it touches, the date it applies and the operator group most affected. Read each row as a question: which article changed, when the change bites, and whether your role as provider, deployer, SME or small mid-cap is the one it targets.

Change	Article touched	Applies from	Operator group most affected
High-risk rules for Annex III systems	Chapter III Sections 1 to 3	2 December 2027, instead of 2 August 2026	Providers and deployers of Annex III high-risk systems such as HR, credit and education tools
High-risk rules for Annex I product systems	Chapter III Sections 1 to 3	2 August 2028, instead of 2 August 2027	Manufacturers of regulated products with AI safety components
Ninth prohibition on non-consensual intimate imagery and CSAM	Article 5 (as amended)	2 December 2026	Providers and deployers of generative and image tools
AI literacy duty reworded	Article 4(1)	Applies with the amended text from 27 July 2026	Providers and deployers training staff who operate AI systems
Simplified Annex IV documentation using a Commission form	Article 11(1)	Applies with the amended text from 27 July 2026	SMEs, start-ups and small mid-cap enterprises supplying high-risk systems
Lower fine caps for small mid-caps	Article 99(6a)	Applies with the amended text from 27 July 2026	Small mid-cap enterprises facing paragraph 4 and 5 fines
Cooperation between initial and new providers	Article 25(2)	Applies with the amended text from 27 July 2026	Initial providers whose systems a deployer modifies into high-risk systems
AI Office exclusive competence	Article 75(1)	Applies with the amended text from 27 July 2026	Providers building AI systems on their own general-purpose models and very large online platforms
Bias detection data processing rules	Article 4a (replacing Article 10(5))	Applies with the amended text from 27 July 2026	Providers of high-risk systems that process special categories of personal data for bias testing
Grace period for Article 50(2) marking	Article 111(4), with Article 50(2)	2 December 2026 for systems placed on the market before 2 August 2026	Providers of generative systems already on the market

How each change affects an operator's plan

The 2026 amendment moves some dates, narrows some duties and shifts who supervises what. Each card below covers one change that alters a planning decision, with the step to take now and the point to confirm with counsel or the competent authority.

High-risk dates moved back

The high-risk rules in Chapter III Sections 1 to 3 now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems. The recitals tie the delay to late standards, common specifications and guidance, and to late national authorities. Re-baseline your roadmap to the new dates, but keep documentation and logging work moving, because the requirements themselves did not change. Confirm with counsel which dates apply to systems already on the market.

AI literacy duty reworded

Article 4(1) still requires providers and deployers to take measures that support AI literacy for staff and others operating AI on their behalf. The text no longer requires a sufficient level for each individual. Keep a training record for each role that operates AI, along with the measures taken. Ask counsel whether your current training meets the reworded duty, since the measures themselves remain mandatory.

Simplified documentation for smaller firms

Under Article 11(1), SMEs, start-ups and small mid-caps may provide the Annex IV technical documentation in a simplified manner using a Commission form, which notified bodies must accept. Check whether your organization qualifies for SME or small mid-cap treatment, since the same status also lowers the fine cap. Keep the full documentation set internally until the form is published and you confirm that your evidence maps to it.

Upstream cooperation under Article 25(2)

Article 25(2) now requires an initial provider to share technical documentation, known limitations, failure modes and targeted technical access for testing with a new provider. The duty does not apply if the initial provider clearly specified that the system must not be changed into a high-risk system. Add these deliverables to supplier and contract checklists, and decide who will test a system once it is adapted. Confirm the contract wording with counsel before a fine-tuned or rebranded system goes live.

AI Office exclusive competence

Under Article 75(1) as amended, the AI Office is the exclusive authority for AI systems built on a general-purpose model from the same provider or undertaking, with exceptions such as Annex I products. It also covers AI in very large online platforms and search engines. Map each system to its model source and parent undertaking to know whether the AI Office or a national market surveillance authority will supervise it. Confirm the exceptions that apply to your products with the relevant authority.

Article 50 grace period to December

Article 50(2) applies from 2 August 2026, but providers of generative systems placed on the market before that date have until 2 December 2026 to meet the marking duty under Article 111(4). Inventory every generative system released before August 2026 and record its marking status now. Systems placed on the market after that date must comply on the original schedule. Confirm with counsel which of your systems count as placed on the market before the cut-off.

What still applies in 2026 even after the delay

The high-risk delay does not pause the rest of the Act. Chapters I and II have applied since 2 February 2025, covering definitions, the AI literacy duty in Article 4 and the Article 5 prohibitions. The general-purpose AI, governance, notified body and penalty chapters have applied since 2 August 2025, with the exception of Article 101. Any system you run in the EU today should already be checked against those prohibitions, and the AI literacy measures should already exist on paper and in practice. Two dates fall in December 2026: the new prohibition on non-consensual intimate imagery and child sexual abuse material, and the Article 50(2) marking duty for generative systems placed on the market before 2 August 2026, which Article 111(4) gives until 2 December 2026 to meet.

Whether the marking duty reaches your system depends on when it was placed on the market, not when you last updated it. A generative system already on the market before 2 August 2026 has until 2 December 2026. A system placed on the market after that date must meet the marking duty from the start. Placing on the market is a legal event, so a major model swap or a relaunch under a new version can change which side of the line you sit on. Map each generative product to its first placement date and record the reasoning, because that record is the evidence an authority will ask for.

Confirm the transition treatment for your specific product with your national market surveillance authority before you rely on it. The Commission's market surveillance page lists the authorities by Member State, and the rules for legacy systems can depend on how each system is classified and where it is used. Ask the authority which transition rules it expects you to follow, whether it wants evidence of the placement date, and who it treats as the responsible provider if you integrate a third-party model. Put the answers in writing and keep them with your inventory entry, so the team does not assume the delay covers systems it does not cover.

How to update an AI Act plan after the 2026 amendment

This sequence walks an organization from its existing AI Act plan to a version that reflects Regulation (EU) 2026/1744, with each phase closing on a named output the team can hand to an assessor or auditor.

Re-check the risk tier and role for each system
Start from the AI system inventory and reclassify every entry against the prohibited practices, the two high-risk routes and the transparency duties as amended in 2026. For each system, record whether your organization acts as provider, deployer, importer or distributor, because the amendment changes some role-based duties. Legal or compliance staff own the decision, and technical owners confirm the facts about each system. The output is an updated inventory in which every system carries a tier, a role and a short rationale that a reviewer can follow.
Re-date the high-risk milestones
Move every high-risk milestone in the plan to the dates set by the amendment: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems. Remove or reschedule tasks that were pegged to the earlier 2 August 2026 and 2 August 2027 dates, and confirm which work has to finish before each new date. Program owners sign off on the revised sequence. The output is a dated plan that shows each high-risk deliverable against its new application date.
Check the transitional and new provisions
Review which provisions apply to your systems now and which start later. Confirm whether generative systems placed on the market before 2 August 2026 fall under the Article 111(4) grace period for the Article 50(2) marking duty, which ends on 2 December 2026. Check whether any system relies on the special-category data rules that moved to Article 4a, and whether the new prohibition from 2 December 2026 touches any product feature. Legal counsel should record each conclusion. The output is a written transition register that lists each provision, the systems it covers and the applicable date.
Update AI literacy measures and training records
Revise the AI literacy measures under Article 4(1) to match the reworded duty, which asks providers and deployers to take measures that support staff and others operating AI on their behalf without guaranteeing a specific level for any individual. Map each measure to the roles and systems it covers, and align training content with the inventory from the first step. Keep dated attendance and completion records for each group. The Commission's AI literacy questions and answers help teams interpret the duty. The output is an updated training program and a training record that matches the current workforce and systems.
Reconfirm supplier contracts for Article 25(2) cooperation
Review contracts with the suppliers of each high-risk system or component you build on or modify. Under Article 25(2), as amended, an initial provider must share technical documentation, known limitations, failure modes and targeted technical access for testing, unless it clearly stated that the system must not be changed into a high-risk system. Procurement and legal teams check that each contract contains these cooperation terms and that the supplier's restriction statements are on file. Ask suppliers to confirm the terms in writing. The output is a contract register with a cooperation status for every supplier in the inventory.
Update policies and confirm the plan with an independent review
Revise the AI governance policy, the role descriptions and the documentation index so they reflect the new tiers, dates, training model and supplier terms. Ask an internal reviewer or an external advisor to test the revised plan against the inventory and the transition register, and record any gaps. Your organization owns the policies and the decisions in them. An implementation partner can prepare documents and evidence, but only an independent auditor or assessor issues reports or certificates. The output is a dated, approved policy set and a review record that shows which findings were closed.

What the change means for providers, deployers and SMEs

Providers of high-risk AI systems see the largest change in timing. The high-risk rules in Chapter III Sections 1 to 3 now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, instead of 2 August 2026 and 2 August 2027. The recitals tie the delay to late standards, common specifications and guidance, and to late set-up of national competent authorities. The core duties themselves, including quality management, technical documentation and conformity assessment, did not change in substance.

Changed: the application dates for Annex III and Annex I high-risk systems moved as stated above.
Changed: Article 25(2) now requires the initial provider to share technical documentation, known limitations and failure modes, and targeted testing access with a new provider, unless it clearly specified that the system must not be turned into a high-risk system.
Unchanged: the obligation to build conformity evidence before placing a system on the EU market still applies, whatever the date.
Unchanged: the Article 50(2) marking duty applies from 2 August 2026, with providers of systems already on the market given until 2 December 2026.
Check: whether your conformity route is internal control or a notified body, since the first harmonised quality management standard, EN 18286:2026, was cited in the Official Journal on 14 October 2026.

Ask your auditor or supplier which evidence they expect for the 2027 and 2028 dates, and how they will treat systems you placed on the market before the new dates.

Who owns the work, who prepares evidence and who decides

The Digital Omnibus changed dates and duties, but it did not change who may certify. The organization keeps control of its AI systems and decisions, an implementation partner prepares the systems and evidence, and an independent authority or body issues the findings that count.

The organization owns the decisions

The provider or deployer remains responsible for its risk classification, its high-risk determinations, its AI governance policy and its signed declarations. Under the 2026 amendments, the high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems, so the organization must decide early which systems fall in scope. Check that a named owner signs each classification and each date-driven plan.

The implementation partner prepares evidence

An implementation partner such as DeployOpen can configure the self-hosted platforms that generate logs, technical documentation and records, and can prepare the evidence the organization will present. It does not classify systems on the organization's behalf, sign declarations, or issue reports or certificates. Agree in writing which records the partner produces, who holds them, and how long they are retained.

Market surveillance authorities enforce

National market surveillance authorities enforce the Act for most AI systems and can request documentation, test systems and impose fines under Article 99. The Digital Omnibus also changed the rules for the Commission's AI Office, which under Article 75(1) as amended is exclusively competent for AI systems built on a provider's own general-purpose model and for AI in very large online platforms and search engines. Confirm which authority supervises each system in your inventory.

Notified bodies where Article 43 applies

Most Annex III high-risk systems use internal-control conformity assessment under Annex VI, so no outside body signs off. Notified bodies are involved for some biometric systems and for Annex I products under Article 43. Where one is required, the organization selects and contracts the body itself, and the body's certificate is the independent outcome. Ask any body early about its capacity, since the first harmonised standard, EN 18286:2026, was cited on 14 October 2026.

Who signs the final word

Only an independent authority or notified body issues findings, certificates or decisions that bind the organization. A consultant's gap analysis or readiness report is advice, not a conformity result. Before engaging any party, write down which document will be relied on externally, who issues it, and whether that party has any financial link to the team that built the system.

Questions buyers ask about the 2026 changes

Does the high-risk delay mean we can wait before starting AI Act work?

No. The Digital Omnibus moved the high-risk dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems, but the other obligations already apply on their existing dates, and the delay does not change what a high-risk system must eventually show. The recitals of Regulation (EU) 2026/1744 tie the delay to late standards, common specifications and guidance, and to late national authorities. Your work still has to start with an inventory of AI systems, a role and risk classification, and a plan that fits the new dates. Read the amending text on EUR-Lex and map each date to the systems you actually run.

Does the new ninth prohibition apply to our systems?

It applies only if your system generates or manipulates content that falls within the new prohibition on non-consensual intimate imagery and child sexual abuse material. From 2 December 2026 that prohibition applies, and it is one of the nine prohibited practices after the 2026 amendment. Most business AI systems, such as HR screening, scoring or internal assistants, will not fall within it, but generative image, video and voice products should be checked against the exact wording in Article 5 as amended. Confirm the classification with counsel and document the result in your system inventory.

How much work does the AI literacy change remove?

The change narrows the duty but does not remove it. Article 4(1) as replaced now requires providers and deployers to take measures to support the AI literacy of staff and others operating AI on their behalf, and it no longer requires a sufficient level for each individual. Organizations still need a documented training approach, role-based content and records that show measures were taken. The European Commission publishes AI literacy questions and answers that explain how the duty is read. Ask your advisers which records they expect you to keep, since that is where most of the effort sits.

Does SME relief apply to a company of our size?

It depends on whether you qualify as an SME, a start-up or a small mid-cap enterprise, and the answer is set by the legal definitions, not by headcount alone. For SMEs including start-ups, each fine is capped at whichever of the amount or percentage is lower under Article 99(6). Regulation (EU) 2026/1744 extended this lower cap to small mid-caps for the paragraph 4 and 5 fines under Article 99(6a). Article 11(1) also lets these companies provide Annex IV technical documentation in a simplified manner using a Commission form. Check your status against the Commission's definitions and your group structure before relying on any relief.

What does the Article 50 grace period actually cover?

It covers only the marking duty for generative systems placed on the market before 2 August 2026. Article 50(2) applies from 2 August 2026, but under Article 111(4) providers of those earlier systems have until 2 December 2026 to comply. It does not suspend the other transparency duties for chatbots, deepfakes or emotion recognition, and it does not apply to systems placed on the market after 2 August 2026. The Commission has published an opinion on the Code of Practice on Transparency of AI-generated Content, which you should read alongside the Article itself.

Can our own team update the compliance plan in-house?

Often yes for the planning work, if the team has legal, risk and engineering ownership of each AI system. The organization owns its controls and decides who is accountable, so internal staff can rebuild the inventory, reassess roles and move dates in the plan. The harder parts are interpreting the amended articles, deciding which Annex III or Annex I category applies, and producing evidence that an independent body will accept. Only independent auditors, assessors or notified bodies can issue conformity outcomes or certificates. Decide early which steps your team will do and which need outside support.

What should we ask an implementation partner before signing?

Ask for the written scope, deliverables, and timeline before any work starts, since most engagements are fixed-scope. Confirm which systems, roles and articles are covered, and which evidence the partner will prepare, such as the inventory, technical documentation, logs and records. Ask who owns each control and each decision, and confirm the partner does not issue audit reports, attestations or certificates. DeployOpen prepares systems, controls and evidence for assessments but does not issue them, and it offers quotes that follow from a written scope. Ask how post-launch changes and ongoing support are priced and documented.

How DeployOpen helps update an AI Act plan

DeployOpen, a Chainscore Labs company, helps teams work out what the 2026 Digital Omnibus changes for their own AI systems and then prepares the systems, documentation and evidence that follow from those changes. We build inside your infrastructure and do not issue audit reports or certifications, which remain the role of independent assessors and certification bodies.

How we scope

We confirm which AI systems in your environment are in scope and which dates from the 2026 amendment apply to each.
The written scope lists systems, deliverables, owners and timelines before any work starts, since most engagements are fixed-scope.
We agree in writing which Digital Omnibus changes, such as the 2027 and 2028 high-risk dates, drive plan updates.

How we build

We update the AI system inventory and mark which entries move to the later high-risk application dates.
We prepare technical documentation templates, including the simplified route for eligible small and mid-cap organizations, where your role qualifies.
We test that logging, access control and human oversight settings in your self-hosted platforms match what your updated plan states.

How we hand over

You receive the updated plan, inventory, documentation and configuration records in a form your compliance team can maintain.
We document each change to your AI governance evidence, with the reason and the Digital Omnibus provision it relates to.
We walk your staff through the handover so they can answer assessor questions on the changed obligations without us.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
We can revisit the plan when the Commission publishes further guidance or harmonised standards that affect your systems.
Confirm with us in writing how retainer scope, response expectations and review cycles will be defined before you sign.

EU AI Act Digital Omnibus: what changed in 2026