ARTICLE TEXT

The European Union’s Artificial Intelligence Act, Regulation (EU) 2024/1689, was meant to reach its most important milestone on 2 August 2026, when the obligations for “high-risk” AI systems were due to apply. Six days before that date, the EU changed the timetable. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026. It amends the AI Act before most of its core obligations have applied, and it is already one of the most debated pieces of EU technology legislation this year.

How It Was Made

The European Commission published its proposal on 19 November 2025 as part of a wider drive for “simplification” of EU digital rules. The co-legislators reached political agreement on 7 May 2026. The European Parliament adopted the text on 16 June and the Council approved it on 29 June. It was signed on 8 July, published in the Official Journal on 24 July and entered into force on the third day after publication.

The Key Changes

The headline change is delay. Under the amended Article 113, obligations for standalone high-risk systems listed in Annex III, such as AI used in recruitment, credit scoring, education and law enforcement, now apply from 2 December 2027. Obligations for AI embedded in products covered by the EU harmonisation legislation in Annex I apply from 2 August 2028. Recital 40 explains that harmonised technical standards have been delayed, and that national supervisory authorities are not yet fully in place.

The transparency rules in Article 50, such as the duty to tell people they are interacting with an AI system, still apply from 2 August 2026. However, providers of generative AI systems already on the market have until 2 December 2026 to comply with the Article 50(2) duty to mark AI-generated output in a machine-readable way.

The Omnibus also adds to the list of prohibited practices in Article 5. New points (ba) and (bb) ban AI systems that generate non-consensual intimate imagery, the so-called “nudification” tools, and systems that generate child sexual abuse material. This is the one respect in which the Omnibus clearly strengthens the Act.

Other amendments move in the opposite direction. The AI literacy duty in Article 4 is softened: instead of having to “ensure” a sufficient level of AI literacy among their staff, providers and deployers must now “take measures to support” it. A new Article 4a permits processing of special categories of personal data to detect and correct bias, subject to safeguards. New definitions of small and medium-sized enterprise and “small mid-cap” in Article 3(14a) and (14b) extend lighter compliance measures to small mid-caps, which are larger than SMEs. Article 111 clarifies the treatment of AI models already on the market.

Supporters and Critics

The Commission presents the Omnibus as technical simplification that reduces burdens on business without lowering protection. Critics disagree. European Digital Rights (EDRi) called it a “rollback” of safeguards before they had even applied. It objected to the delays, to reduced transparency in the public database of high-risk systems, to the special-category data exception, and to a rushed process with a thin evidence base. EDRi warned that reopening laws before they apply lets “powerful actors” treat implementation as “a second chance to weaken rules”.

Why It Matters Beyond Europe

The AI Act applies to providers outside the EU whose systems are placed on the EU market or whose output is used in the Union. Bangladeshi software houses, outsourcing firms and start-ups that build or deploy AI for European clients therefore face the Act’s obligations. They now have more time to prepare for the high-risk rules, but the transparency duties and prohibited practices apply already. For students of IT law, EU law and comparative regulation, the Omnibus shows EU law-making responding to industry pressure in real time. It also invites comparison with Bangladesh’s own developing approach to digital regulation.

What Comes Next

The Commission is expected to publish guidelines and to secure harmonised standards before December 2027. The ban on nudification and CSAM-generating systems, and the Article 50(2) marking duty for existing systems, take effect on 2 December 2026. Compliance teams should treat that date, not 2027, as the next real deadline.

Sources

1. Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32026R1744
2. Freshfields, EU AI Act unpacked #34: the final Digital Omnibus on AI: https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/eu-ai-act-unpacked-34-the-final-digital-omnibus-on-ai-key-amendments-to-the-a-102nber
3. EDRi, AI Omnibus deal: EU lawmakers should reject a rollback of AI safeguards: https://edri.org/our-work/ai-omnibus-deal-eu-lawmakers-should-reject-a-rollback-of-ai-safeguards/
4. Cyber Center, What August 2 actually means: the EU AI Act after the Digital Omnibus (10 August 2026): https://cybercenter.space/2026/08/10/what-august-2-actually-means-the-eu-ai-act-after-the-digital-omnibus/