By Rafael Luque Ocaña

The Digital Omnibus is now in force: what changes in the AI Act and what stays the same

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July and has been in force since the 27th. It defers the high-risk obligation dates against the 2024 calendar — December 2027 and August 2028 — and leaves the Article 50 transparency ones untouched, still due on 2 August 2026.

For months, every conversation about the AI Act came with the same caveat: "unless the Omnibus changes it". That caveat is no longer a hypothesis. The European Parliament backed the text on 16 June 2026, the Council gave its final green light on 29 June, and Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026.

That step has already been taken. The Regulation entered into force on 27 July 2026, three days after its publication. From that date, the amendments this article describes are applicable law, and the resulting calendar is the one now in force. ELI: http://data.europa.eu/eli/reg/2026/1744/oj.

With that caveat in mind, let's look at what changes — and, above all, what doesn't.

The dates it defers

At the heart of the Omnibus is the high-risk calendar. Article 113, as it now stands, sets two dates, by the classification route of each system; against the original 2024 calendar, Regulation (EU) 2026/1744 defers both (point 40(b)):

  • High-risk systems under Annex III (those defined by their use: staff selection, credit scoring of natural persons, education, biometrics, critical infrastructure, among others). Their obligations apply from 2 December 2027 (the 2024 text set 2 August 2026).
  • High-risk systems under Annex I (those embedded as a safety component in products already regulated: medical devices, machinery, lifts, toys). Their obligations apply from 2 August 2028 (the 2024 text set 2 August 2027, in the original point (c) of Article 113).

Final adoption changed nothing against what Parliament and Council agreed in May: the dates that reached the Official Journal are the ones already known.

The Fundamental Rights Impact Assessment (FRIA, Article 27) only reaches Annex III systems, so its only date is 2 December 2027; 2 August 2028 does not operate on it.

It's worth understanding why the new dates exist. It isn't simply a political concession: it's an acknowledgement that the infrastructure needed to make high risk operable — harmonised standards, designated competent authorities, conformity assessment bodies — hasn't arrived on time; recital 40 of Regulation (EU) 2026/1744 says so itself. It's a deferred calendar, not a dismantling. The Regulation's architecture — the risk-based approach, prohibited practices, rules for general-purpose models — remains intact.

What doesn't change

Here's the point that gets lost in the headlines. The Article 50 transparency obligations keep their date. They apply from 2 August 2026 for systems placed on the market from that date onward. We're talking about telling a person when they're interacting with a chatbot, labelling AI-generated content, and disclosing deepfakes.

Marking of synthetic content (Article 50(2)) has a timing nuance, and the Omnibus adds it rather than trimming it: the new Article 111(4) gives providers of systems that generate synthetic content already on the market before 2 August 2026 until 2 December 2026 to comply. Those placed on the market from 2 August onward have no transitional period: they must comply from that date.

And the Omnibus adds two prohibited practices to Article 5(1), points (ba) and (bb): generating or manipulating non-consensual intimate material of an identifiable person, and child sexual abuse material. They apply from 2 December 2026. For whoever places the system on the market, the prohibition operates when that generation is the system's intended purpose or a reasonably foreseeable outcome without adequate safeguards; for whoever uses it, only when they use it for that purpose.

The calendar, at a glance

ObligationDateStatus
Article 4 (AI literacy) and Article 5 (prohibitions)2 February 2025In force
Chapter V — obligations of providers of GPAI models (Articles 53–55) · Chapter VII governance (authorities, AI Office) · penalties regime (Chapter XII, in part)2 August 2025In force
Entry into force of Regulation (EU) 2026/174427 July 2026In force
Article 50 transparency — paragraphs 1, 3 and 4, and paragraph 2 for new systems2 August 2026Set by Regulation (EU) 2024/1689
Article 50(2) marking — end of the transitional period for systems placed on the market before 2 August 2026 (Article 111(4)) · Article 5(1), points (ba) and (bb)2 December 2026Set by Regulation (EU) 2026/1744
Transitional period for GPAI models placed on the market before 2 August 2025 (Article 111(3)) · regulatory sandboxes (Article 57(1))2 August 2027Set
Chapter III, Sections 1-3, for Annex III high-risk systems — including Article 26 and Article 27 (FRIA)2 December 2027Deferred by Regulation (EU) 2026/1744 (previously 2 August 2026)
Chapter III, Sections 1-3, for Annex I high-risk systems — Article 26 included; Article 27 does not reach them2 August 2028Deferred by Regulation (EU) 2026/1744 (previously 2 August 2027)
High-risk systems of public authorities deployed before 2 December 2027 (Article 111(2))2 August 2030Set

The dates of Regulation (EU) 2026/1744 have been binding since its entry into force on 27 July 2026 (Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744).

What this means for an SME

The message is reassuring, but clear. The new high-risk dates give real breathing room for the most demanding systems. But they don't change two things: Article 50 transparency lands on 2 August 2026, and market surveillance authorities and the penalties regime have applied since 2 August 2025 — what 2 August 2026 adds is the first concrete obligation that reaches most companies.

The priority hasn't changed in months: take inventory of the AI systems the organisation already uses, work out which classification and which date applies to each one, and sequence the work accordingly. The room is an opportunity to get ahead, not an excuse to pause.

At Alethexis, here's how we frame it: use the extra room to build a documented, traceable governance posture before the date catches up with you — not to wait for it to arrive.

This article is for informational purposes only and does not constitute legal advice. It reflects Regulation (EU) 2026/1744, in force since 27 July 2026.

Get analysis like this in your inbox

Alethexis regulatory and product news. No noise.

I agree to receive communications from Alethexis: content about AI and regulation, and product news. I can unsubscribe at any time.

Controller: ALETHEXIS, S.L. (CIF B88758057). Purpose: to send you the Alethexis newsletter (content about AI and regulation, and product news). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Retention: until you unsubscribe or after 24 months of inactivity. Rights of access, rectification, erasure, objection, restriction and portability: [email protected]. You may lodge a complaint with the Spanish Data Protection Authority (AEPD, www.aepd.es). More information in the privacy policy.