Stephenson Harwood | The “Digital Omnibus” on AI: Ten Key Takeaways

On 27 July 2026, the agreed final text of the Digital Omnibus on AI (the “Digital Omnibus on AI”) entered into force, following its publication in the Official Journal of the European Union.

Originally proposed by the European Commission (“Commission”) in November 2025 (the “Proposal”), and subject to multiple rounds of trilogue negotiations in April and May 2026, the European Parliament (“Parliament”) and Council of the European Union (“Council”) reached a provisional political agreement to amend and streamline the EU AI Act (as part of its Digital Omnibus Package) on Thursday 7 May 2026, with final formal approval granted by the Council on 29 June 2026.

The Digital Omnibus on AI amends the EU Artificial Intelligence Act (“EU AI Act”) with targeted simplification measures to ensure its effective implementation and boost innovation, as well as to address certain challenges encountered since the EU AI Act was adopted in June 2024.

The EU AI Act, which has a phased implementation timeline, was designed with the aim of balancing innovation and flexibility for businesses with robust safeguards for citizens and the protection of fundamental rights. However, there have been challenges with implementation including a lack of harmonised standards for high-risk AI systems, and concerns about disproportionate compliance costs, particularly for smaller companies.

With the Digital Omnibus on AI Regulation, the Commission aimed to create a more innovationfriendly AI regulatory framework in Europe by:

+ postponing certain compliance deadlines to allow businesses more time to prepare for changes;
+ extending certain simplifications that are granted to small and medium-sized enterprises (SMEs) to small mid cap companies (SMCs);
+ broadening compliance measures so more innovators can use regulatory sandboxes; and
+ reinforcing the AI Office’s powers and centralising oversight of AI systems built on general-purpose AI models, reducing governance fragmentation.

Despite certain deferrals to its implementation timeline, core transparency obligations under Article 50 of the EU AI Act will still apply from 2 August 2026. These include:
+ informing individuals when they interact with an AI system such as a chatbot; + marking AI-generated or manipulated outputs in a machine-readable format;
+ labelling artificially generated or manipulated deepfakes; and
+ transparency rules for deployers of emotional recognition systems and biometric categorisation systems.

The sole exception applies to providers of generative AI systems placed on the market before 2 August 2026, who will have an extended grace period of four months (reduced from 6 months under the Proposal) until 2 December 2026 to implement machine-readable detectability or watermarking for AI outputs.

DIGITAL OMNIBUS ON AI: TEN KEY TAKEAWAYS

1.Delay to the EU AI Act’s rules on high-risk AI under Annex I and III.

The application of rules for high-risk AI systems, originally due to take effect from 2 August 2026, has been postponed. While the Commission’s Proposal applied backstop compliance dates, fixed deadline dates for compliance now apply. For high-risk AI systems categorised under Annex III, the new compliance deadline is 2 December 2027, and for high-risk AI systems categories under Annex I, this is 2 August 2028.

There is an exemption available for high-risk systems that are already on the market before these dates, provided they have not been subject to significant design changes. A significant design change goes beyond what was predetermined by the provider at its initial conformity assessment and which may affect the system’s compliance with applicable requirements.

For high-risk AI systems used by public authorities, providers and deployers still have until 2 August 2030.

2. Target prohibition on non-consensual “nudifier” deepfakes and CSAM.

A new prohibited practice covering AI systems used to generate non-consensual sexual or intimate content or child sexual abuse material is now established. This prohibition, designed to specifically target “nudifier” tools and other harmful deepfakes, will apply from 2 December 2026. Not part of the Commission’s original Proposal, it was introduced during the legislative process to address online harms to women and children posed by AI tools.

3. Centralised supervision for AI systems by the AI Office.

The AI Office will be exclusively competent for AI systems based on a general-purpose AI (GPAI) model, subject to limited exceptions. It will also become exclusively competent for AI systems that constitute or are part of very large online platforms (VLOPs) or very large search engines (VLOSEs), as defined under the Digital Services Act (DSA). The AI Office will have market surveillance powers and coordinate closely with national authorities and DSA enforcement.

4. Conformity assessment streamlining.

Conformity assessment bodies will be able to submit a single application and undergo a single assessment procedure when seeking designation under both the EU AI Act and other relevant EU harmonisation legislation. This ultimately aims to reduce duplication and speed up the designation process.

5. Increased post-market monitoring flexibility.

The obligation to follow a harmonised Commission template for post-market monitoring plans is removed, bringing increased flexibility. Providers will instead maintain a plan in their technical documentation, guided by Commission guidance rather than an implementing act.

6. Additional time to establish AI sandboxes.

Member States will now have until 2 August 2027 to establish EU AI Act sandboxes (i.e. creating a risk-free environment to beta-test AI products). The AI Office may establish an EU level AI regulatory sandbox with integrated real-world testing plans where applicable. Real-world testing outside sandboxes is extended to (i) high-risk AI systems in Annex I, Section A; and (ii) systems in Annex I, Section B, enabled through frameworks individually or jointly adopted by Member States and notified to the Commission.

7. More proportionate AI literacy responsibilities.

The requirement on providers and deployers to “ensure a sufficient level” of staff AI literacy has been refined to be more proportionate and less outcome-based, now with an obligation to “take measures to support the development of” literacy. The Commission and Member States must take responsibility for supporting these efforts; fostering AI literacy through targeted, non-binding support measures and guidance.

8. SME and SMC relief extended and clarified.

Regulatory privileges that were previously solely for SMEs have now been extended to SMCs, including simplified technical documentation, lower fines, and tailored guidance. Micro enterprise simplifications for quality management systems will be broadened to all SMEs and start-ups.

9. Data protection exception for bias established.

Providers and deployers are now permitted to exceptionally process special categories of personal data in order to detect and correct bias across AI systems and models, with appropriate safeguards in place, on a “strict necessity” basis.

10. Sectorial regime for Machinery Regulation introduced.

One contested issue in the Proposal negotiations was how the EU AI Act should interact with existing EU product safety law, given the overlap between the two regimes. Following intense lobbying from the machinery sector, products covered by the Machinery Regulation are now subject to a sectoral approach: channelling compliance through that existing framework, with direct EU AI Act applicability limited to only certain provisions, to avoid “double regulation”. The Commission must, in turn, ensure that the Machinery Regulation imposes essential health and safety requirements on in-scope high-risk AI systems. It is empowered to adopt delegated acts under the Machinery Regulation to ensure a level of protection consistent with the EU AI Act. Click here for our Latest News & Insights on AI & Disruptive Technology NEXT STEPS The Digital Omnibus on AI entered into force on 27 July 2026. Despite the deferral of several key deadlines under the Digital Omnibus on AI, stakeholders must not overlook key transparency obligations that still come into effect on 2 August 2026 applicable to all in-scope AI systems, irrespective of when they were first placed on the market or put into service. Organisations should consider the Commission guidelines on the implementation of transparency obligations and the voluntary Code of Practice on Transparency of AI Generated Content which sets out practical steps to demonstrate compliance with transparency obligations under the EU AI Act.

NEXT STEPS

The Digital Omnibus on AI entered into force on 27 July 2026. Despite the deferral of several key deadlines under the Digital Omnibus on AI, stakeholders must not overlook key transparency obligations that still come into effect on 2 August 2026 applicable to all in-scope AI systems, irrespective of when they were first placed on the market or put into service. Organisations should consider the Commission guidelines on the implementation of transparency obligations and the voluntary Code of Practice on Transparency of AI Generated Content which sets out practical steps to demonstrate compliance with transparency obligations under the EU AI Act.

Compliments of Stephenson Harwood – a member of the EACCNY