Digital Omnibus AI: what Is changing in the AI Act?

Does 2 August 2026 still apply?

The European Commission presented its proposal on 19 November 2025 in order to simplify implementation of the AI Act and reorganise deadlines. During the legislative process, the draft was significantly expanded. However, the changes do not affect the date as a whole, but apply selectively: to individual obligations and to clearly defined groups of systems.

For practical purposes, this means a case-by-case assessment rather than a blanket postponement. For each system, you should clarify:

• which role you have, provider or deployer
• which provision the system falls under
• which specific obligation is affected
• which date of application applies to that obligation

Anyone who assumes a blanket extension of deadlines risks overlooking obligations that continue to apply.

What new deadlines apply to high-risk AI under the Digital Omnibus?

For high-risk AI, two different dates of application will apply in future, depending on the classification of the system. The relevant requirements are those set out in Sections 1 to 3 of Chapter III.

Which date applies is determined by the classification under Article 6:

Classification	Legal basis	Date	Existing systems
High-risk based on use case	Article 6(2) in conjunction with Annex III	2 December 2027	Date adjusted to the new deadline
High-risk based on product safety	Article 6(1) in conjunction with Annex I	2 August 2028	Date adjusted to the new deadline

For systems already placed on the market, the relevant date is also no longer uniformly 2 August 2026, but the respective new date of application. Systems that were placed on the market or put into service before the applicable date are generally subject to the high-risk obligations only if they undergo significant changes to their design from that date onwards.

Classification under Article 6 is therefore the first review step, as it determines both the relevant date and the obligations for existing systems.

What changes for the transparency obligations under Article 50?

For generative AI, the technical obligation regarding machine-readable marking and detectability is subject to a separate transition period until 2 December 2026. By contrast, the Omnibus does not postpone the other transparency obligations under Article 50.

Specifically, the transition rule concerns providers of AI systems that generate synthetic audio, image, video or text content and that were placed on the market before 2 August 2026. These providers must take the measures required to comply with the obligation under Article 50(2) by 2 December 2026. AI systems for general-purpose use are expressly included.

This must be distinguished from the deployer’s obligation to disclose deepfakes and certain AI-generated or manipulated texts under Article 50(4). That obligation generally remains applicable from 2 August 2026.

Providers of existing systems therefore gain time until December 2026, while the deployers’ disclosure obligation remains unaffected and applies from August 2026.

Newsletter

For your Inbox

Current updates and important information on topics such as data law, information security, technology, artificial intelligence, and much more. (only in German)

Please add 2 and 8.

Do not fill in this field

Mit Klick auf den Button stimmen Sie dem Versand unseres Newsletters und der aggregierten Nutzungsanalyse (Öffnungsrate und Linkklicks) zu. Sie können Ihre Einwilligung jederzeit widerrufen, z.B. über den Abmeldelink im Newsletter. Mehr Informationen: Datenschutzerklärung.

How does the new sector-specific relief mechanism work?

The Digital Omnibus introduces a mechanism allowing certain obligations under the AI Act to be limited in favour of sector-specific product legislation. This does not mean that the AI Act is automatically displaced.

A limitation requires that the sector-specific harmonisation legislation listed in Annex I, Section A ensures an equivalent or higher level of protection for health, safety or fundamental rights. The overall level of protection under the AI Act must not be reduced.

The relief mechanism only applies once the Commission has fleshed it out. By 2 August 2027, the Commission must adopt delegated acts specifying the systems, obligations, conditions and scope of the respective limitation.

Special case: machinery

A separate approach applies to AI systems in the machinery sector. The Machinery Regulation is moved from Annex I, Section A to Section B of the AI Act. For AI systems in connection with products from Section B, only certain provisions of the AI Act apply directly.

In future, the legislature will implement the high-risk requirements more strongly through the Machinery Regulation. Here too, the Commission must adopt delegated acts transferring the relevant AI Act requirements into the Machinery Regulation. The delegated acts must be adopted in time to apply from 2 August 2028. For the machinery sector, AI and product safety requirements will therefore be bundled more strongly within machinery law.

Sector-specific product legislation provides relief only where a delegated act of the Commission expressly provides for it.

What further substantive changes does the Digital Omnibus introduce?

Beyond deadlines and sector-specific rules, the Digital Omnibus also makes substantive changes to the AI Act in several areas. The most important for practice are:

• New prohibited practices: Article 5 is expanded to include prohibitions on AI systems that generate or manipulate non-consensual intimate material or depictions of child sexual abuse. The prohibitions apply from 2 December 2026. On the provider side, the rule also covers systems where it is reasonably foreseeable and reproducible that the system can generate such content and where appropriate technical safeguards are lacking.
• Special categories of data, Article 4a: The new Article 4a primarily expands the data protection permission for bias detection. In addition to providers of high-risk AI, deployers of high-risk systems as well as providers and deployers of other AI systems and models will also be permitted to process special categories of personal data for this purpose.
• Clarification of the safety component concept: AI systems that serve exclusively non-safety-related purposes, such as user support, efficiency or ease of use, generally do not qualify as safety components. However, if the failure or malfunction of the AI system endangers the health and safety of persons or property, classification as a safety component remains possible. A third-party conformity assessment required solely because of other risks, such as electromagnetic interference without any health or safety relevance, is not sufficient for Article 6(1).
• Relief for small mid-caps: Relief measures previously intended primarily for SMEs are extended to small mid-cap companies. These include simplified technical documentation, proportionate requirements for quality management, priority access to the AI Office regulatory sandbox and more favourable calculation of certain fines.

Conclusion: Digital Omnibus AI, check the applicable date instead of assuming a blanket postponement

The Digital Omnibus reorganises the AI Act without postponing it across the board. It creates new dates of application, transition periods and sector-specific relief mechanisms, along with several substantive changes.

For practice, the decisive point remains the case-by-case assessment. For high-risk AI, either 2 December 2027 or 2 August 2028 applies depending on the classification. For the marking obligation for existing generative systems, the relevant date is 2 December 2026. The general start of application and the deployers’ deepfake disclosure obligation remain set for 2 August 2026. Organisations that classify their systems now according to role, provision and obligation will know which date actually applies to each system.

Frequently asked questions:

#1 Is the Digital Omnibus AI already in force?

The content of the amending regulation has been finalised, but it is not yet in force. Signature and publication in the Official Journal are still outstanding.

#2 Do we need to retrofit existing high-risk AI systems?

Existing high-risk systems generally only need to meet the requirements if they are significantly changed in their design after the applicable date. The relevant date is no longer uniformly 2 August 2026, but either 2 December 2027 or 2 August 2028.

#3 How can we determine whether 2 December 2027 or 2 August 2028 applies to our system?

The relevant date is determined by the classification under Article 6: Annex III means 2 December 2027; Annex I means 2 August 2028.

Article 6(2) in conjunction with Annex III covers the high-risk use cases listed there. Article 6(1) in conjunction with Annex I concerns AI systems that are safety components of covered products or are themselves such products.

#4 Does anything change regarding the labelling obligation for deepfakes?

The deployer’s obligation to disclose deepfakes under Article 50(4) remains applicable from 2 August 2026. Only the provider’s technical obligation under Article 50(2) to ensure machine-readable marking and detectability of outputs is postponed for systems that were already placed on the market before 2 August 2026. For these systems, the applicable date is 2 December 2026.