Digital Omnibus on AI [What It Changes]

TL;DR

• The Digital Omnibus on AI is Regulation (EU) 2026/1744: the law that moved Annex III high-risk duties to 2 December 2027 and Annex I product-embedded high-risk duties to 2 August 2028.

• It entered into force on 27 July 2026 after Official Journal publication on 24 July. Article 50 transparency and GPAI duties were not postponed.

• It also extends some SME simplifications to small mid-caps, expands sandboxes, and adds new Article 5 bans that apply from 2 December 2026.

• A US-only shop is not off the hook for EU users. High-risk paperwork is later; chatbot disclosure is not.

What the Digital Omnibus on AI is

The Digital Omnibus on AI is the delay-and-simplify amendment to the AI Act, not the chatbot-labelling rule. If someone on your team says "the EU pushed AI compliance," ask which clock: high-risk files, or the notice on the bot.

A two-truck HVAC shop, a ten-person marketing agency, and a solo clinic should care because vendor emails will blur those clocks. The shop with an EU after-hours bot still needs a "this is AI" line. The agency still needs labels on generated ads. The clinic still needs a named editor on public health text. What moved is the heavy Annex III file for systems that score people in hiring, credit, or similar high-risk uses — and most small shops were not going to finish that file by 2 August 2026 anyway.

This hub is current as of 27 July 2026, the in-force date on the Commission's Omnibus notice.

What the law is, on paper

According to lawandtechnology.eu, Regulation (EU) 2026/1744 is dated 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on the third day after publication, 27 July 2026. The EUR-Lex HTML lists CELEX 32026R1744, ELI reg/2026/1744, and amendments to the AI Act plus aviation Regulation (EU) 2018/1139 and Machinery Regulation (EU) 2023/1230.

The original Act remains Regulation (EU) 2024/1689. The Commission's proposal library page and digital rulebook sit next to the in-force text. FAQ category 99 is the Service Desk's Omnibus bucket. The Service Desk still shows a disclaimer that some article pages have not been updated to the Omnibus text.

Do not confuse this with the parallel data-protection Digital Omnibus (COM(2025) 837), which lawandtechnology.eu says remains a proposal.

What moved

According to the European Commission, Annex III high-risk rules apply from 2 December 2027 and Annex I product-embedded high-risk rules from 2 August 2028.

According to Forkast, that Annex III move is a 16-month deferral from 2 August 2026, and Annex I embedded products get a 12-month delay from 2 August 2027 to 2 August 2028.

According to Goodwin, 2 August 2026 was the original high-risk date, and the Omnibus did not move Article 50, GPAI duties, or the existing Article 5 prohibitions (except the new intimate/CSAM bans, which apply from 2 December 2026).

Sources: Commission; timeline; lawandtechnology.eu; Goodwin.

The implementation timeline now runs through 2 August 2028 for the main high-risk product track.

What else the Omnibus does

The Commission lists: SME-style measures extended to small mid-caps (SMCs); more sandboxes plus an EU-level sandbox; simplified AI literacy (support measures, not a harsh "ensure literacy" duty); simplified EU-database registration for certain exempted systems; a ban on AI systems that generate non-consensual intimate content or CSAM; a wider legal basis for processing special-category data to detect bias; AI Office oversight of certain GPAI-built systems and of AI in designated very large platforms and search engines.

Goodwin details the literacy softening, the optional post-market monitoring template by 2 September 2027, machinery treated via delegated act by 2 August 2028, and the €35 million / 7% band for the new Article 5 bans. Cooley's Article 50 alert is the companion piece for the duty that did not move.

Forkast's secondary surveys (Deloitte Legal Germany September 2024: 53.8% of 500 decision-makers with zero measures; CSA February 2026: over 50% without an AI inventory; 12% confident on NHI-attack prevention; 8% confident in legacy IAM) explain why Brussels bought time. They are not Commission statistics.

According to Forkast, only 9 of 27 Member States had fully designated national competent authorities as of June 2026.

USTA analysis

USTA analysis. Inputs: Annex III from 2 August 2026 to 2 December 2027 (Forkast: 16 months); Annex I from 2 August 2027 to 2 August 2028 (12 months); Article 50 still 2 August 2026; marking grace 2 December 2026; 9/27 Member States fully designated as of June 2026 (Forkast).

• 9 / 27 = 33% of Member States fully designated in that June snapshot.

• 16 months of Annex III delay versus 0 months of Article 50 delay.

• 2 August 2026 → 2 December 2026 = 122 days of remaining generative-marking grace after transparency already applied.

• 2 August 2026 → 2 December 2027 = 487 days of Annex III delay from the old high-risk date.

A vendor who says "you have 16 extra months on AI" is collapsing 0, 122, 487, and 12-month Annex I into one number. The analysis only divides and subtracts published dates and Forkast's 9/27 count.

What a small shop should do with the extra calendar

Do not pause chatbot notices. Do use the Annex III extra time to write down which systems you have — Forkast's CSA line is that more than half of organisations still lacked an inventory.

If you already route intake through form-to-CRM automation, add an "AI-facing?" flag on that path. Executive-assistant automation still needs a disclosure if the assistant talks to a person in the EU. Law practices on Clio alternatives, Smokeball versus Clio, or MyCase versus Clio should not read the high-risk delay as a free pass on client-facing bots. The state of small-business automation is still "which step is software."

Teams already routing documents through US Tech Automations can put the inventory and the disclosure stamp on the same workflow, then leave Annex III templates on a later calendar reminder. The homepage is for the path you run every day, not for a 2027 file.

How to keep two calendars on one wall

Print four dates and tape them above the dispatcher screen: 2 August 2026 (Article 50 live), 2 December 2026 (legacy marking grace and new Article 5 bans), 2 December 2027 (Annex III), 2 August 2028 (Annex I). The Article 50 Service Desk page and the Article 99 penalties page belong on the same wall as the Omnibus notice.

If a vendor says "AI Act delayed," ask them to point at one of those four. If they cannot, ignore the email.

Use the extra Annex III time to list systems, not to invent a high-risk file you do not need. Most small shops will find they are deployers of a chatbot, not providers of an Annex III employment-scoring engine.

The Code of Practice and the transparency guidelines are how you operationalise the clock that did not move. The 2 August enforcement notice is the press version of that clock.

Goodwin's earlier explainer Cutting Through Complexity is the pre-publication companion; the August 2026 Goodwin alert is the in-force companion. Read the later one first.

Machinery and aviation amendments in 2026/1744 matter if you embed AI in a lift or an aircraft component. They do not rewrite a clinic chatbot.

Keep the GDPR file (COM(2025) 837) in a different folder so nobody "simplifies" consent language on the strength of an AI-Act delay.

Honest limits

This hub is the delay instrument. It does not mean high-risk systems are unregulated forever. It does not move GPAI. It does not move Article 50. US-only shops with EU users still sit in the Act's territorial reach as described in the original regulation.

Council press on 29 June 2026 was linked from lawandtechnology.eu but the Consilium URL returned a browser check; it is not cited.

Signal vs Speculation

Signal (sourced). 2026/1744 in force 27 July 2026. Annex III 2 December 2027. Annex I 2 August 2028. Article 50 and GPAI not postponed. SMC extension, sandboxes, new 2 December 2026 bans. Forkast 9/27 designations. Marking grace 2 December 2026.

Speculation (our read). If designation stays thin, high-risk enforcement in 2027 will still be uneven, which is not a reason to skip the bot label in 2026. Our read: 12–36 months of SMB behaviour will split between shops that inventory systems now and shops that treat 2027 as "never." Our read is not a prediction of a fine.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• Digital Omnibus on AI = high-risk delay plus simplification, not an Article 50 pause.

• 2 December 2027 and 2 August 2028 are the new high-risk dates.

• Chatbot disclosure stayed 2 August 2026.

• 9/27 Member States fully designated as of June 2026, per Forkast.

• Inventory systems now; file high-risk paperwork on the new calendar.

FAQ

Did the Omnibus delay chatbot labels?

Direct-answer first sentence: no. The Commission, Goodwin, and the timeline all keep Article 50 on 2 August 2026.

When do Annex III high-risk duties apply now?

Direct-answer first sentence: 2 December 2027. That is 16 months after the old 2 August 2026 date, per Forkast and the Commission.

Is this the same as the GDPR Digital Omnibus?

Direct-answer first sentence: no; lawandtechnology.eu treats COM(2025) 837 as a separate, still-proposed data-protection file.

Do small mid-caps get SME simplifications?

Direct-answer first sentence: yes, the Commission says some measures previously reserved for SMEs extend to small mid-cap companies. Check whether your headcount matches the SMC definition in the recitals before assuming you qualify.

What happens on 2 December 2026?

Direct-answer first sentence: two different clocks: the end of the Article 50(2) marking transition for legacy generative systems, and the start of new Article 5 bans on certain intimate and CSAM-generating systems. Neither is the Annex III high-risk start.

What to do next

Write a one-page inventory of bots and generators that can reach EU users. Put the Article 50 notice on those bots this week. Put Annex III work on a 2027 reminder. If the inventory should live next to intake, keep it on agentic workflows so US Tech Automations stores the system list when counsel asks who talks to customers.