Digital Omnibus on AI: what has changed for companies
The Digital Omnibus on AI is Regulation (EU) 2026/1744. It amends the EU AI Act and has applied since 27 July 2026. The AI literacy obligation under Art. 4 remains, but is weakened. The obligations for high-risk AI move to 2 December 2027 and 2 August 2028, and two new prohibitions take effect on 2 December 2026.
As of: 3 November 2026, checked against the text of Regulation (EU) 2026/1744 on EUR-Lex. Not legal advice.
What is the Digital Omnibus on AI?
Regulation (EU) 2026/1744 of 8 July 2026 is titled “Digital Omnibus Regulation on AI”. It was published in the Official Journal on 24 July 2026 and entered into force on the third day after that, i.e. on 27 July 2026. It mainly amends the EU AI Act at a glance (Regulation (EU) 2024/1689) and is meant to simplify its implementation. You can find the amended version of the AI Act as the consolidated text on EUR-Lex.
Two terms recur: providers develop an AI system or place it on the market under their own name. Deployers use an AI system in a professional capacity; a company that only uses AI tools is a deployer. Small mid-cap enterprises are larger than SMEs but smaller than large enterprises.
The changes at a glance
The table compares the previous and the new position, with reference, date and what a company that uses AI should do. The first six rows concern most businesses, the last four mainly providers and high-risk cases.
| Topic | Before | Now | From when | What companies do |
|---|---|---|---|---|
| AI literacy (Art. 4) | Measures to ensure, to their best extent, a sufficient level of AI literacy | Measures to support the development of AI literacy; no particular level has to be guaranteed | 27.07.2026 | Define measures per role and record them voluntarily; check the Commission’s practical examples |
| New prohibitions (Art. 5(1), points (ba) and (bb)) | no separate prohibition | AI for non-consensual intimate depictions of identifiable persons and for depictions of child sexual abuse prohibited | 02.12.2026 | Record image and video generators, set usage rules |
| High-risk AI under Annex III (Art. 113) | Obligations from 02.08.2026 | Obligations from 02.12.2027 | Change in force since 27.07.2026 | Create an AI inventory, check use in employment, education or credit assessment |
| High-risk AI under Annex I (Art. 113) | Obligations from 02.08.2027 | Obligations from 02.08.2028 | Change in force since 27.07.2026 | only relevant for AI in regulated products |
| Marking of AI-generated content (Art. 50(2), Art. 111(4)) | Obligation from 02.08.2026 | Transition until 02.12.2026 for providers of generative AI placed on the market before 02.08.2026 | 02.12.2026 | concerns providers; there is no transition for deployers |
| Fines for small mid-caps (Art. 99(6a)) | lower amount for SMEs only | lower amount also for small mid-cap enterprises, for infringements under paragraphs 4 and 5 | 27.07.2026 | Check your size category; for prohibited practices the mid-cap rule does not apply |
| Special categories of data for bias correction (new Art. 4a) | Legal basis only for providers of high-risk AI (Art. 10(5)) | also for providers and deployers of other AI systems and deployers of high-risk AI, only where strictly necessary and subject to safeguards | 27.07.2026 | no obligation and no free pass: the GDPR remains decisive; involve the data protection officer |
| Fundamental rights impact assessment (Art. 27(4)) | separate assessment | Reference to an existing data protection impact assessment possible | with the high-risk obligations | only for deployers of certain high-risk AI |
| Registration (Art. 6(3), Art. 49(2)) | full details under Annex VIII | simplified registration for systems that the provider classifies as not high-risk | 27.07.2026 | a matter for providers |
| Oversight (Art. 75) | national authorities | AI Office responsible for certain systems based on general-purpose AI models | 27.07.2026 | for pure users usually without consequences |
You can download the table as a CSV file. The basis is the text of Regulation (EU) 2026/1744, read on 3 November 2026.
AI literacy under Art. 4: weakened, not deleted
Providers and deployers of AI systems continue to take measures to support the development of AI literacy among their staff and other persons who work with AI on their behalf (Art. 4(1)). The second sentence is new: the obligation does not require guaranteeing any particular level of AI literacy for any person. Previously, companies were to ensure a sufficient level to their best extent.
Two new paragraphs follow. The Commission and the Member States support companies, especially SMEs, and the Commission publishes practical examples (paragraph 2). The AI Board issues recommendations on common objectives (paragraph 3). The change is justified by the burden that strict obligations place on smaller companies in particular (recital 8). The Commission is already collecting practical examples in its repository of AI literacy practices. According to the Commission, adopting a practice listed there does not automatically meet Art. 4.
In practice this means: Art. 4 prescribes neither a format nor proof. Training is one possible measure, as are an internal policy or a workshop. It is worth recording who did what and when. How to implement the AI literacy obligation under Art. 4 is explained on its own page.
New prohibitions from 2 December 2026
From 2 December 2026, two further AI practices are prohibited (Art. 5(1), points (ba) and (bb), Art. 113(3), point (a)):
- AI systems that generate or manipulate realistic images, videos or audio recordings depicting intimate body parts or sexual acts of an identifiable person without that person’s explicit consent.
- AI systems that generate or manipulate depictions of child sexual abuse within the meaning of Directive 2011/93/EU.
For companies that only use such tools, the following applies: use is prohibited only if the deployer uses the system for that purpose (Art. 5(1a), point (b)). Anyone who uses an image generator for product photos or graphics is not affected. Even so, a clear rule on the use of image and video generators belongs in your AI policy. Infringements of prohibitions fall into the highest fine tier; the new mid-cap rule does not apply there. Details on the page Fines for infringements.
Deadlines: before and now
Mainly the obligations for high-risk AI have been postponed: by 16 months for Annex III (employment, education, credit assessment and other areas) and by 12 months for Annex I (AI in regulated products). In addition, there is a transition until 2 December 2026 for marking under Art. 50(2), only for providers of generative systems placed on the market before 2 August 2026. The other dates remain. The dates from 2024 to 2028 are in the EU AI Act deadline calendar.
What applies to SMEs and small mid-caps?
The AI Act now defines SMEs (Art. 3(14a), based on Recommendation 2003/361/EC) and small mid-cap enterprises (Art. 3(14b), based on Recommendation (EU) 2025/1099). For small mid-caps, the lower of the two amounts applies to fines for infringements under Art. 99(4) and (5), as was already the case for SMEs (paragraph 6a), as was already the case for SMEs (paragraph 6). For prohibited practices (paragraph 3), this rule does not apply to mid-caps. Supervision is the responsibility of the national market surveillance authorities.
What has not changed
- The existing prohibitions under Art. 5 have applied since 2 February 2025.
- The obligations for general-purpose AI models have applied since 2 August 2025.
- The obligations of deployers under Art. 50(3) and (4) have applied since 2 August 2026, without a transitional period. More on the AI labelling page.
- Art. 4 remains an obligation to take measures, for companies of any size.
What companies should do now
- Create an AI inventory: who uses which tool for what?
- Check whether any use falls under high-risk under Annex III, for example in recruitment. If so, note 2 December 2027.
- Set usage rules for image and video generators before the new prohibitions take effect on 2 December 2026.
- Define AI literacy measures and voluntarily record who did what and when; Art. 4 does not require proof. An AI training for teams is one possible measure.
- Keep an eye on the Commission’s practical examples on Art. 4.
Frequently asked questions about the Digital Omnibus on AI
Does the Digital Omnibus on AI already apply?
Yes. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Some changes apply later, for example the new prohibitions from 2 December 2026.
Has the Digital Omnibus abolished the AI training obligation?
No. Art. 4 still obliges providers and deployers to take measures on AI literacy. What is new is that they do not have to guarantee any particular level of competence. Art. 4 still does not prescribe training; it is one possible measure. More on the AI literacy obligation page.
What is the difference between the AI Omnibus and the Data Omnibus?
They are two separate legislative packages. The Omnibus on AI amends the EU AI Act and has applied since 27 July 2026. The Omnibus on data, GDPR and cookies is still in the legislative process (as of 3 November 2026).
Do we not need to do anything until 2027?
You do. Art. 4 has applied since 2 February 2025, as have the existing prohibitions, and two new prohibitions follow on 2 December 2026. Mainly the obligations for high-risk AI have been postponed. For the marking of older generative systems (Art. 50(2)), a transition until 2 December 2026 applies, for providers only.
Does this also apply to small businesses?
Yes. Art. 4 has no minimum size. There are relief measures for fines: for SMEs the lower amount applies, and for small mid-cap enterprises for infringements under Art. 99(4) and (5), not for prohibited practices.
Train your team now All deadlines
Note: this article is for general information only and does not constitute legal advice.