Digital Omnibus on AI: what changed in the EU AI Act

For most companies using AI on websites and in products, the dates that matter did not move. The transparency obligations in Article 50 apply from 2 August 2026. Providers must design systems that interact with people so that users are informed they are dealing with AI, unless this is obvious. Deployers must disclose deep fakes and AI-generated text published to inform the public on matters of public interest, and deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them.

The prohibitions in Article 5 have applied since 2 February 2025, and so has AI literacy under Article 4, now in amended form. The obligations for providers of general-purpose AI models have applied since 2 August 2025, and models placed on the market before that date have until 2 August 2027 (Article 111(3)). Assuming the whole AI Act was pushed back is therefore a mistake: the main postponement concerns high-risk systems.

Chapter III, Sections 1 to 3, now apply from 2 December 2027 for high-risk systems listed in Annex III, such as AI used in recruitment, education, creditworthiness assessment or access to essential services. For high-risk systems under Annex I, which covers AI in regulated products such as toys, lifts or medical devices, they apply from 2 August 2028. These sections contain the classification rules, the requirements for high-risk systems and the obligations of providers and deployers, including Article 26 and the fundamental rights impact assessment in Article 27.

Generative AI received a short transition. Under new Article 111(4), providers of systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2). The grace period only concerns this marking duty. It does not extend the deployer duty to disclose deep fakes under Article 50(4).

Two prohibitions were added to Article 5(1). Point (ba) covers AI systems that generate or manipulate intimate imagery of identifiable persons without their consent, and point (bb) covers child sexual abuse material. Both apply from 2 December 2026 and fall under the highest fine tier for prohibited practices in Article 99(3). New Article 5(1a) also catches systems where that output is the intended purpose, or a reasonably foreseeable and reproducible outcome that needs no significant technical modification, and the system lacks reasonable and adequate safeguards to prevent it. That matters for providers of image and video generators.

Article 4 on AI literacy was reworded. Providers and deployers must now 'take measures to support the development of AI literacy' of their staff and others operating AI on their behalf, and the text states that this 'does not require providers or deployers to guarantee any specific level of AI literacy'. The Commission and Member States must support these efforts, in particular for SMEs. The duty itself remains in force.

The Omnibus introduces small mid-caps (SMCs) as a category, with reference to Commission Recommendation (EU) 2025/1099: companies that are not SMEs, employ fewer than 750 people and have an annual turnover of up to 150 million euro or a balance sheet total of up to 129 million euro. New Article 99(6a) gives SMCs the rule SMEs already had in Article 99(6): fines under Article 99(4) and (5) are capped at the lower of the percentage and the fixed amount.

Providers of high-risk systems also get procedural relief. Article 11(1) lets SMEs and now SMCs provide technical documentation in a simplified form established by the Commission. Article 63(1) extends the option of a simplified quality management system, previously limited to microenterprises, to SMEs. These simplifications matter mainly for companies that build high-risk AI, less for those that only use AI tools.

Treat the transparency rules as current. Check every chatbot, AI feature and content workflow: are users told they are interacting with AI where Article 50(1) requires it, are deep fakes labelled, and is AI-generated public-interest text either disclosed or under human editorial control? If you provide a generative AI system placed on the market before 2 August 2026, plan machine-readable marking by 2 December 2026.

Use the extra time for high-risk systems to prepare rather than to pause. Map where AI is used in recruitment, performance evaluation, credit or insurance decisions, confirm whether you act as provider or deployer, and collect the vendor documentation you will need by 2 December 2027. Keep AI literacy measures and their documentation up to date, since Article 4 continues to apply.