EU AI Act Digital Omnibus: Regulation (EU) 2026/1744 in Force

1. What has happened?

Short answer: the proposal of the European Commission of 19 November 2025 has become applicable law — Regulation (EU) 2026/1744 (Digital Omnibus AI) of 8 July 2026 has been in force since 27 July 2026. The legal act forms part of the European Commission's 'competitiveness package' and amends, alongside the AI Act (EU) 2024/1689, also Regulations (EU) 2018/1139 and (EU) 2023/1230 (Machinery Regulation).

The AI Act-related part postpones the high-risk dates of application. What is affected is the point in time from which the obligations apply, not their content.

Status of the procedure: the ordinary legislative procedure is completed: Commission proposal of 19 November 2025, approval by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, signature on 8 July 2026, publication in the Official Journal on 24 July 2026, in force since 27 July 2026. What therefore governs in practice is the timetable of Art. 113 AI Act as amended by Regulation (EU) 2026/1744: Regulation (EU) 2024/1689 applies in principle from 2 August 2026 — that date has now passed —, the obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028.

2. What has been postponed (Regulation (EU) 2026/1744)

Short answer: what has been postponed are the dates of application for high-risk AI — Annex III from 2 August 2026 to 2 December 2027, Annex I from 2 August 2027 to 2 August 2028. The column 'Originally' reflects the position under Art. 113 AI Act before the amendment; the column 'Applies now' states the calendar dates applicable since 27 July 2026. These are fixed dates: the adopted version contains no trigger mechanism based on Commission findings on harmonised standards of the kind envisaged by the proposal of 19 November 2025.

3. What is not covered by the postponement

Short answer: the postponement concerns only the dates of application of Chapter III Sections 1 to 3 — AI literacy and the prohibitions (since 2 February 2025), the GPAI obligations (since 2 August 2025) and the transparency obligations of Art. 50 (since 2 August 2026) keep their dates. That does not mean they are untouched in substance throughout: Art. 4 has been recast with effect from 27 July 2026, and Art. 5 has been supplemented by a further prohibited practice. Art. 27 (FRIA), by contrast, belongs to Chapter III Section 3 and applies to Annex III systems only from 2 December 2027.

• Art. 4 (AI literacy): has applied since 2 February 2025 and is not covered by the postponement — Regulation (EU) 2026/1744 has, however, recast the article (version in force since 27 July 2026). Providers and deployers are to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf; no particular level of AI literacy is owed by any individual. What to do (practical recommendation, not a statutory requirement): train the persons who come into contact with AI; content, for example, the AI definition, risk classes, prohibited practices, transparency obligations, human oversight. According to the Commission's questions and answers (as at 27 July 2026, non-binding), no certificate is required; internal evidence of the training is sufficient.
• Art. 5 (prohibited practices): has applied since 2 February 2025 — fines up to EUR 35 million Art. 99(3) AI Act. What to do: screen the AI inventory against the list of prohibitions, including manipulation, exploitation of vulnerabilities, social scoring, emotion recognition in the workplace and in education institutions, and biometric categorisation on the basis of sensitive attributes. New: Regulation (EU) 2026/1744 adds a further prohibition to the list — non-consensual sexualised deepfakes and depictions of child sexual abuse Art. 5(1)(ba) and (bb) AI Act — which applies from 2 December 2026.
• Art. 27 (FRIA for public bodies, private providers of public services as well as creditworthiness assessment and life/health insurance scoring): belongs to Chapter III Section 3 and therefore applies to Annex III systems only from 2 December 2027 (Regulation (EU) 2026/1744). Content: description of the AI use, affected persons, risks to fundamental rights, safeguards Annex III no. 5(b) and (c) AI Act.
• GPAI obligations (Art. 53–55): have applied since 2 August 2025 — not covered by the postponement. On 2 August 2026 only Art. 101 was added, that is, the Commission's power to impose fines on GPAI providers. For Chapter V, supervision and enforcement lie with the Commission and the EU AI Office Art. 88(1) AI Act, not with the national market surveillance authorities.
• GPAI Code of Practice (final 10 July 2025): unchanged. It serves to demonstrate compliance Art. 53(4) AI Act, and for models with systemic risk Art. 55(2) AI Act. Only a harmonised European standard gives rise to a presumption of conformity, and only in so far as it covers the obligations.
• Art. 50 (transparency, watermarking, deepfake disclosure): has applied since 2 August 2026 — not postponed by Regulation (EU) 2026/1744. What to do: identify chatbots as AI (paragraph 1), mark synthetic audio, image, video and text content in a machine-readable format (paragraph 2), inform people in cases of emotion recognition and biometric categorisation (paragraph 3), disclose deepfakes (paragraph 4). For generative systems placed on the market before 2 August 2026, Art. 50(2) is to be complied with by 2 December 2026 Art. 111(4) AI Act. Practical guidance is provided by the Commission guidelines of 20 July 2026; the Code of Practice on Transparency of AI-generated Content (final since 10 June 2026) is voluntary — on 8 July 2026 the Commission stated that signing it does not conclusively demonstrate compliance.

4. Obligations by role — for Annex III systems from 2 December 2027

Short answer: for high-risk AI under Annex III, the obligations of Chapter III Sections 1 to 3 are applicable from 2 December 2027 (Regulation (EU) 2026/1744, in force since 27 July 2026) — which of them apply depends on the role: provider (Art. 3 no. 3) or deployer (Art. 3 no. 4). Providers bear the main burden of the product obligations, deployers the obligations of ongoing use. In the case of a substantial modification, a deployer moves into the provider role Art. 25 AI Act.

From 2 December 2027, the catalogue of obligations for high-risk AI under Annex III also includes data governance (Art. 10), record-keeping (Art. 12), transparency towards deployers (Art. 13), human oversight (Art. 14) and accuracy/robustness/cybersecurity (Art. 15); post-market monitoring and the reporting of serious incidents (Art. 72, 73) are not covered by the postponement and have applied since the general date of application of 2 August 2026. For systems under Annex III nos. 1, 6 and 7, registration takes place only in a secure, non-public section of the EU database Art. 49(4) AI Act.

5. Practical implications

Short answer: the same logic applies to Annex III stakeholders — these obligations are applicable from 2 December 2027; for AI in regulated products under Annex I, the date of application is 2 August 2028 (Art. 6(1) AI Act, periods under Art. 113(3)(c) AI Act as amended by Regulation (EU) 2026/1744). The column 'Effect' states in each case the legal position under the calendar dates that have been fixed since 27 July 2026.

6. What to do now

Short answer: classify, clarify the role, work through the obligations attached to that role — and keep track of the legal status separately. The following steps are practical recommendations; the obligations themselves follow from the AI Act.

1. Maintain an AI inventory. For each system: name and provider, use case, role (provider/deployer/both), risk class, categories of data processed including special categories, persons responsible for oversight and escalation.
2. Determine the Annex III area. Eight areas are to be examined: biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration/asylum/border control, and administration of justice and democratic processes.
3. Apply the exception narrowly. Art. 6(3) applies only where the system performs exclusively a narrowly limited preparatory or supporting task — not where it produces assessments or recommendations capable of materially influencing human decisions; where profiling of natural persons is involved, the high-risk classification remains. Practical recommendation: in case of doubt, classify as high-risk.
4. Assess any change of role. Anyone who substantially modifies the purpose or functionality, or places the system on the market under their own name, becomes a provider Art. 25 AI Act.
5. Implement the obligations by role — see section 4.
6. Keep track of the legal status. Practical recommendation, not a statutory deadline: secondary legal acts and guidelines are still outstanding — as at 17 August 2026, the guidelines on high-risk classification under Art. 6(5) were available only as a draft of 19 May 2026 (consultation until 23 July 2026; the final version has been announced by the Commission for the end of 2026). Record the review date and the source in the compliance file, and adjust planning only once an amendment has been officially published.

7. Germany and Austria

Short answer: the AI Act applies directly and in identical wording in Germany and Austria — articles, annexes and deadlines are the same; nationally, only the authority structure, the sanctions regime within the framework of Art. 99(1) and discrimination liability in HR use differ.

Both countries: each Member State designates at least one notifying authority and at least one market surveillance authority, the latter also acting as the single point of contact Art. 70(1) and (2) AI Act.

Germany: since 29 July 2026, the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), unless that Act provides otherwise — for individual areas, sectoral authorities are competent, for example BaFin; the single point of contact under Art. 70(2) AI Act is likewise the Federal Network Agency (Bundesnetzagentur) (§ 6(1) KI-MIG). Where assessing AI is used in the employment context, § 22 of the German General Equal Treatment Act (AGG) applies — anyone who proves indications giving rise to a presumption of disadvantage on a ground under § 1 AGG shifts the burden of proof to the other side. Claims under § 15(1) and (2) AGG must be asserted in writing within two months § 15(4) AGG; compensation in the case of non-recruitment is capped at three months' salary where the person would not have been recruited even under a selection free of discrimination. The point of contact is the Federal Anti-Discrimination Agency (Antidiskriminierungsstelle des Bundes) §§ 25, 27 AGG.

Austria: as at the date of this article (17 August 2026), no market surveillance authority under Art. 70 AI Act had been designated; the RTR AI service centre is an information and advisory body without supervisory powers (§ 20c KOG, § 194a of the Austrian Telecommunications Act 2021 (TKG 2021)). In place of § 22 AGG, the prima facie evidence standard under § 12(12) of the Austrian Equal Treatment Act (GlBG) (gender) or § 26(12) GlBG (ethnic origin, religion or belief, age, sexual orientation) applies: the person concerned establishes the discrimination on a prima facie basis, and it is then for the defendant to prove that, weighing all the circumstances, it is more likely that another motive was decisive or that a ground of justification exists. Claims for compensation follow from § 12 and § 26 GlBG respectively, with statutory minimum amounts; claims relating to the non-establishment of an employment relationship or a failure to promote must be brought before the courts within six months of the rejection § 15 GlBG § 29 GlBG. Competent are the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission (Gleichbehandlungskommission) as well as the labour and social courts.

8. Criticism & political assessment

Short answer: the postponement that has been adopted is contested — supporters argue that the implementation infrastructure is lacking, critics point to a protection gap in fundamental rights.

• In favour: EU competitiveness vis-à-vis the USA/China; preparation time for industry; maturity of standards
• Against: erosion of civil rights (the postponement moves application back by 16 months — from 2 August 2026 to 2 December 2027); signalling effect for other EU regulations; unequal treatment of early adopters versus those who wait

The explanatory memorandum to the proposal gives the following reasons: too few designated notified bodies for conformity assessment, harmonised technical standards not completed in time and market surveillance authorities in the Member States not set up in time.

EDRi and the European Digital Rights movement have published statements against the proposal. The legislative procedure is completed: the European Parliament gave its approval on 16 June 2026, the Council on 29 June 2026; the Regulation was published in the Official Journal on 24 July 2026. This must be distinguished from the Data Omnibus (COM(2025) 837 on the GDPR, ePrivacy, the NIS2 Directive (Directive (EU) 2022/2555) and CER) — as at the reviewed source date of 27 July 2026, it was still only a proposal.