EU AI Act Digital Omnibus: What Changed for SMEs in 2026

Hephaestus Technology13 November 20269 min read

The EU AI Act Digital Omnibus is now law, but it delays only part of the AI Act. Stand-alone high-risk duties under Annex III move from 2 August 2026 to 2 December 2027. High-risk AI embedded in regulated products moves from 2 August 2027 to 2 August 2028. The prohibited practices, AI literacy, general-purpose AI (GPAI) duties and Article 50 transparency rules were not postponed. A new prohibition on AI-generated child sexual abuse material and non-consensual intimate imagery starts on 2 December 2026.

Key takeaways

The Digital Omnibus on AI is adopted law. It amends the AI Act and keeps its risk-based structure.
Annex III high-risk duties move to 2 December 2027. High-risk AI in regulated products moves to 2 August 2028.
Prohibitions, AI literacy, GPAI duties and Article 50 transparency were not postponed.
A new prohibition, added as two new points in Article 5, applies from 2 December 2026.
Start now on what is live, and plan high-risk work backwards from December 2027.

What did the EU AI Act Digital Omnibus change?

The Digital Omnibus on AI is an amending regulation. It moves some dates and adjusts some rules, but it leaves the AI Act's structure in place. Beresol's annotated text puts it plainly: "Regulation (EU) 2026/1744 amends the AI Act, it does not replace it." ai-resources.eu adds that "the risk categories and the structure of obligations remain unchanged."

The route to adoption:

The Commission proposed it on 19 November 2025 as COM(2025) 836 (Praxikon).
Council and Parliament reached a provisional agreement at talks on 6 and 7 May 2026 (Praxikon).
Parliament adopted it on 16 June 2026 and the Council on 29 June 2026 (Future of Privacy Forum).
It was signed on 8 July 2026 (Beresol).
It was published in the Official Journal on 24 July 2026 (FPF). It entered into force on 27 July 2026, the third day after publication (Beresol).

It is cited as Regulation (EU) 2026/1744 (Beresol).

FPF lists the headline changes:

postponed high-risk dates
a new prohibited practice, added to Article 5 as two new points
a reworded AI literacy duty
wider permission to use special-category data for bias detection
expanded AI Office powers
revised post-market monitoring
SME reliefs, such as simplified technical documentation, extended to small mid-caps

Two narrower changes matter for some product companies (Beresol).

Machinery. Machinery products move to Annex I Section B, and the Machinery Regulation itself is amended, with delegated acts due by 2 August 2028. Section B products do not leave the AI Act entirely. Article 6(1), Article 60a on real-world testing and Articles 102 to 112 still apply to them.
Registration. Two items are deleted from Annex VIII Section B, which lightens EU-database registration.

Is the EU AI Act delayed, and which deadlines moved?

Partly. Only specific obligations moved, and the new dates are written into the law. In Article 113, "the dates for the high-risk rules are moved and fixed" (Beresol). Your planning can work from calendar dates in the Regulation itself.

Obligation	Old date	New date
Annex III stand-alone high-risk systems (e.g. employment, education, essential services)	2 Aug 2026	2 Dec 2027
Annex I high-risk AI embedded in regulated products	2 Aug 2027	2 Aug 2028
Article 50(2) machine-readable marking, only for AI systems placed on the market before 2 Aug 2026	2 Aug 2026	2 Dec 2026
National AI regulatory sandboxes operational	2 Aug 2026	2 Aug 2027
New Article 5 prohibition (points 5(1)(ba) and (bb))	n/a	2 Dec 2026

That is a 16-month deferral for stand-alone high-risk systems and a 12-month deferral for embedded ones. For the full sequence of dates, see our EU AI Act timeline.

What was not delayed and still applies to my business today?

Most of what already applied still applies. The Omnibus did not pause any obligation that was already live.

Prohibited practices and AI literacy have applied since 2 February 2025 (FPF).
- The Article 4 literacy duty was reworded. Providers and deployers must now "take measures to support the development of AI literacy". They are not required to guarantee any specific level of literacy for any individual (FPF; Beresol).
- A new Article 4(2) also gives the Commission and Member States a role in supporting AI literacy.
- The duty is softer, but it still applies directly to you. See our guide to AI literacy under Article 4.
GPAI model duties have applied since 2 August 2025. Models placed on the market before that date have until 2 August 2027 to comply (FPF).
Article 50 transparency applies from 2 August 2026 (FPF).
- The only relief concerns machine-readable marking of AI-generated content under Article 50(2). AI systems placed on the market before 2 August 2026 have until 2 December 2026 (Beresol).
- The Commission published guidelines on Article 50 on 20 July 2026 (FPF). Read them against each product rather than relying on summaries.
- A Code of Practice on transparency of AI-generated content also exists (FPF).
Fines and SMEs. Under Article 99(6a), fines for SMEs are capped at whichever of the two maximums is lower. The Omnibus extends this proportionality to small mid-caps (Beresol).

Which new prohibited AI practices did the Omnibus add?

The Omnibus added one new prohibition, written as two new points in Article 5 (Beresol; ai-resources.eu):

Article 5(1)(ba) covers non-consensual intimate imagery.
Article 5(1)(bb) covers child sexual abuse material (CSAM).

It applies from 2 December 2026. The Commission's first Article 112 review, on 22 May 2026, had flagged this area as a "potential regulatory gap" (FPF).

The final text sets out the scope in a new Article 5(1a) (Beresol):

Which systems are caught. A system is caught if producing this content is its intended purpose. It is also caught if the content is a reasonably foreseeable and reproducible outcome and the system lacks adequate technical safeguards to prevent it.
Deployers. Deployers are caught only when they use a system for that purpose. Accidental generation is not covered.
Intimate imagery. This is caught only if it is realistic, depicts an identifiable person and lacks that person's explicit consent.
CSAM. The CSAM point has a "without right" exception defined under national law.

If your product does not generate images or other realistic depictions of people, the new points are unlikely to affect it. If it does, the key question is whether your technical safeguards are adequate. A foreseeable, reproducible output from an unguarded system falls inside the ban.

Does the Omnibus change anything for UK companies selling into the EU?

It does not appear to change who is in scope, but it does change what applies to firms that are. The new high-risk dates, the reworded Article 4 and the new prohibition apply to every organisation the AI Act covers, wherever it is based.

The amendment summaries we reviewed do not list any change to the Act's territorial scope in Article 2. We have not seen a source that confirms this in so many words, so treat it as our reading rather than settled fact. Whether a UK business is covered is the same question it was before the Omnibus. If you are unsure, start with does the EU AI Act apply to my business, and take legal advice for borderline cases.

What should SMEs and startups do in the next 90 days?

Focus on what is live now and on the 2 December 2026 dates. Start the high-risk work early rather than waiting for 2027. This checklist is our synthesis of the dated obligations above.

Inventory every AI feature you build or buy. Note whether you act as provider or deployer for each one.
Map each feature against Article 50. Use the Commission's 20 July 2026 guidelines to decide which transparency duties apply.
Mark generative output in machine-readable form. AI systems placed on the market before 2 August 2026 must do this by 2 December 2026. Newer systems must already comply.
Audit image and other generation features against the new prohibition before 2 December 2026. Record each feature's intended purpose, what outputs are reasonably foreseeable and reproducible, and which technical safeguards prevent prohibited content.
Keep AI literacy training going, and keep a record of it.
Classify against Annex III and record any decision that a system is not high-risk. The Commission published draft high-risk classification guidelines on 19 May 2026, with consultation open to 23 July 2026 (FPF). Our high-risk AI checklist walks through the test.
Update vendor contracts. Ask AI suppliers how they support Article 50(2) marking and whether they have signed the Code of Practice.
Plan any high-risk work backwards from 2 December 2027, or from 2 August 2028 for AI embedded in regulated products.

If you are building AI features or agents now, that work sits in the product development stage of how Hephaestus works.

What is still uncertain, and what should you watch for next?

The main open items are guidance and enforcement capacity, not the dates.

High-risk classification guidelines. Consultation on the May 2026 draft closed on 23 July 2026. The Commission must publish the Article 6 guidelines by 2 August 2027 (FPF). Check whether a final version has been adopted.
Harmonised standards. Delays to these standards shaped the decision to postpone (FPF). Their progress is worth tracking as your high-risk dates approach.
Updated Article 5 guidelines. FPF expects the Commission's prohibition guidelines to be updated to cover the new points (FPF).
National authorities. As of late July 2026, several Member States had yet to appoint national competent authorities (FPF). Check the Commission's current list for your market before relying on any national guidance.
The data and cyber side of the package. The data and cyber part of the Digital Omnibus package is a different instrument from the AI changes (Beresol). That includes a separate GDPR omnibus proposal (Praxikon). Do not confuse it with the AI Act amendments.

Frequently asked questions

Is the EU AI Act Digital Omnibus final?

Yes. It was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. It amends the AI Act rather than replacing it.

Has the EU AI Act been delayed?

Only partly. Annex III high-risk duties move to 2 December 2027, and high-risk AI embedded in regulated products moves to 2 August 2028. Prohibitions, AI literacy, GPAI duties and Article 50 transparency were not postponed.

Is Article 50 transparency postponed?

No. Article 50 applies from 2 August 2026. The only relief is for the Article 50(2) machine-readable marking duty: AI systems placed on the market before that date have until 2 December 2026.

Do I still need an AI literacy programme?

Yes. Article 4 now requires providers and deployers to take measures to support AI literacy, rather than guarantee a specific level. The duty was reworded, not removed, so keep training going and document it.

Does the new prohibition cover accidental outputs?

Not for deployers. They are caught only when they use a system for a prohibited purpose, and accidental generation is not covered. A system itself is caught if prohibited content is a reasonably foreseeable and reproducible outcome and it lacks adequate technical safeguards.

Does the Omnibus change anything for UK companies?

It does not appear to change who is in scope, though we have not seen a source confirm this in so many words. UK firms already covered by the AI Act face the same new dates, reworded literacy duty and new prohibition as EU firms. If you are unsure whether you are covered, check the scope rules first and take legal advice for borderline cases.

If you want to talk through how these dates fit your AI product roadmap, book a free 30-minute call with Hephaestus. For legal advice on your obligations, speak to a qualified lawyer.

Cover photo by cottonbro studio on Pexels.