The AI Act after the Omnibus: the dates to plan for

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, moved the AI Act's high-risk rules to 2 December 2027 for the use cases in Annex III and to 2 August 2028 for AI in regulated products. It also adds new bans that apply from 2 December 2026, and gives older generative systems until that date to mark their output. The original bans, the rules for general-purpose AI models and the 2 August 2026 date for the Article 50 transparency duties did not move.

What did the Omnibus change, and when did it take effect?

The act is Regulation (EU) 2026/1744 of 8 July 2026. It amends the AI Act (Regulation (EU) 2024/1689) and also Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230. The Official Journal published it on 24 July 2026. Its last article says it enters into force on the third day after publication, which is 27 July 2026, and the European Commission's news item agrees: "On 27 July 2026, the AI Omnibus enters into force across the EU".

The regulation gives its reason in its recitals. Standards, common specifications and guidance for high-risk systems arrived late, and national authorities were set up late, so the original date of 2 August 2026 for the high-risk rules no longer worked. The regulation also says the Commission should make sure support measures are in place in due time. For a team planning a product, this explains why the postponement is a response to missing infrastructure and why the obligations themselves stay in place.

Which dates apply from 2 December 2026?

Two provisions share this date, and they affect different kinds of product.

The first is a pair of new bans, added to Article 5 as points (ba) and (bb). Point (ba) covers AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts or sexually explicit activity, without that person's explicit consent. Point (bb) covers systems that generate or manipulate material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, which the Commission describes as child sexual abuse material, except where a "without right" defence applies under national law. Article 113 puts these points, and the new paragraphs 1a and 1b of Article 5, at 2 December 2026. The Commission's AI Act page says the ban "comes into effect in December 2026", and the European Parliament's release of 7 May 2026 gives the full date, "2 December 2026".

Paragraph 1a narrows the ban for the people who supply a system. Placing it on the market is prohibited only where producing such material is its intended purpose, or where its design makes that a reasonably foreseeable and reproducible outcome and it lacks adequate technical safeguards. For deployers, the ban applies only where they use the system to produce that material. Paragraph 1b says that manipulation which does not increase the exposure of depicted intimate parts, or change the nature of the depicted activity, is not manipulation under point (ba). Our reading is that a business tool that does not generate images of people is unlikely to fall under these bans, while an image feature that accepts free prompts needs a check against paragraph 1a.

The second provision is a new Article 111(4). Providers of AI systems that generate synthetic audio, image, video or text, placed on the market before 2 August 2026, have until 2 December 2026 to comply with Article 50(2). That paragraph requires outputs to be marked in a machine-readable format and detectable as artificially generated or manipulated. The Parliament's release says the law delays watermarking obligations until 2 December 2026, and that the Commission's proposal had set 2 February 2027. A team with a generative feature already live therefore has a fixed date to meet, and it is earlier than the one first proposed.

The fines for breaking a ban are in Article 99(3): up to EUR 35,000,000 or, for a company, up to 7% of total worldwide annual turnover in the preceding financial year, whichever is higher. The Omnibus left that paragraph as it was. Our reading is that it covers the new points too, since they sit in Article 5. A lawyer should confirm that for a specific case.

When do the high-risk rules apply now?

Article 113 now says that Sections 1, 2 and 3 of Chapter III, with the exception of Article 6(5), apply from two dates. Systems classified as high-risk under Article 6(2) and Annex III follow from 2 December 2027, and systems classified as high-risk under Article 6(1) and Annex I follow from 2 August 2028. Before the Omnibus, Article 113 set Article 6(1) and its obligations at 2 August 2027, and the general date of 2 August 2026 covered Annex III. The Commission's news item gives the new dates as "Rules apply starting 2 December 2027" and "Rules apply starting 2 August 2028".

Annex III lists eight areas: biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration and border control, and the administration of justice. Recruitment and the evaluation of creditworthiness are among the listed uses. The Omnibus did not change Annex III itself. A provider that decides an Annex III system is not high-risk under Article 6(3) must still document that assessment before placing the system on the market and is still subject to registration under Article 49(2). The Omnibus only deletes points 7 and 9 of Section B of Annex VIII, which simplifies what the registration contains.

The rule for systems already on the market moved with the date. Article 111(2) used to refer to systems placed on the market before 2 August 2026. It now refers to the date of application of Chapter III. Operators of such systems are covered only if the systems undergo significant design changes from that date. Providers and deployers of high-risk systems intended for public authorities must comply by 2 August 2030, which is unchanged. Our reading is that an Annex III system on the market before 2 December 2027 is therefore outside the high-risk rules until it is significantly changed, unless a public authority is the intended user.

What did not change?

The Omnibus amends Article 113 only in its third paragraph, so most of the earlier timetable stands. The general date of application, 2 August 2026, still brings in the transparency duties of Article 50. The Commission's page says "The transparency rules of the AI Act will come into effect in August 2026". Article 50 asks providers to tell people when they interact with an AI system and asks deployers to disclose deep fakes. Only paragraph 7, on codes of practice, was changed.

Chapters I and II, which hold the original bans, have applied since 2 February 2025, although the AI literacy article in Chapter I was rewritten, as described below. The rules for general-purpose AI models, governance and penalties have applied since 2 August 2025, apart from Article 101, which the original text kept outside that date. Article 111(3) also stands: providers of general-purpose AI models placed on the market before 2 August 2025 must comply by 2 August 2027. The Commission's page lists the original prohibitions as applying from February 2025 and the general-purpose AI obligations from August 2025, and says nothing about moving them.

What else changed that a product team may notice?

AI literacy in Article 4 was rewritten. Providers and deployers now "shall take measures to support the development of AI literacy" of their staff, and the text adds that this does not require them to guarantee any specific level for any individual. The Commission describes it as "simplified". The Omnibus gives no separate date for the new wording. Our reading is that it applies from 27 July 2026.

The Omnibus also extends to small mid-caps some measures that only SMEs had. Recommendation (EU) 2025/1099 defines that group. The Commission's news item says "Some measures previously reserved for SMEs are extended to small mid-cap companies (SMCs)". For small mid-caps, each fine under Article 99(4) and (5) tops out at the lower of the percentage or the amount.

What should a team do with these dates?

This section is our addition. It turns the legal text into a dated list for a team that is building or buying an AI feature. It is a planning aid, and we are not giving legal advice.

1. Now: check the Article 50 duties that already apply, which means telling people they are dealing with an AI unless that is obvious, marking the output of any feature that generates audio, image, video or text in a machine-readable way, and disclosing deep fakes if you are a deployer.

2. Before 2 December 2026: if a generative feature went live before 2 August 2026, confirm that its output marking meets Article 50(2) by then, and check any image or video feature against Article 5(1)(ba), (bb) and paragraph 1a.

3. During 2027: classify each feature against Annex III and write down the result, because if you decide a feature is not high-risk, Article 6(4) requires the provider to document that assessment before the feature is placed on the market.

4. By 2 December 2027: for features that are high-risk under Annex III, have the Chapter III requirements ready, and remember that systems for products under Annex I follow on 2 August 2028.

5. Name an owner for the AI literacy measures in Article 4, which cover staff and others who operate or use your AI systems on your behalf, so that the duty does not sit with nobody.

If you are scoping a new AI tool, our page on AI app development describes what we build, and our security page explains how we handle data. Whether a specific feature is high-risk or banned is a legal question for your counsel.

What we could not confirm

We could not open the EUR-Lex pages in a browser view, because automated requests to eur-lex.europa.eu returned an empty page. We read the English text of both regulations as published by the Publications Office, and the links above point to the EUR-Lex addresses of the same texts. The Council's own press release of 7 May 2026 refused automated access, so we did not use it.

A Council document of 22 September 2026 lists a correction to the German version of Article 1(8) of the Omnibus, a change of wording in the new Article 6(1b). We did not find a correction to the English text or to any date.

We did not confirm whether the Commission has published the guidelines on high-risk classification that Article 6(5) of the original text required by 2 February 2026. We also found no official guidance on how authorities will read the "reasonably foreseeable and reproducible" test in Article 5(1a).