The EU AI Act reached its main date of application on 2 August 2026. Days before that milestone, the EU published an amendment that deferred the compliance deadlines for high-risk AI systems, added new prohibitions against emerging AI-generated harms, and expanded the enforcement powers of the AI office. It is the first substantive amendment to the Act since its adoption in 2024.
The challenge
When the EU AI Act was adopted in 2024, its implementation was planned in phases to give businesses, regulators, and standards bodies time to prepare. The prohibitions on certain AI practices would take effect in February 2025, obligations for general-purpose AI model in August 2025, rules for high-risk AI systems in August 2026, and those concerning AI embedded in regulated products in August 2027. The design allowed each layer of the framework to activate as the supporting infrastructure came into place.
As implementation progressed through 2025, it became clear that some elements of the supporting infrastructure, particularly the harmonised technical standards being developed by the European Committee for Standardization (CEN) and European Committee for Electrotechnical Standardization (CENELEC), would arrive later than the timeline anticipated. In response, the Commission proposed a targeted adjustment intended to align the high-risk deadlines with the availability of those standards. As proposed, the revised deadline would have been triggered only once the Commission confirmed that the necessary standards and supporting tools were in place.
The regulatory gap
The question facing the institutions was how to adjust the AI Act's compliance deadlines to reflect the availability of harmonised standards without reopening the substance of the law. That pointed to a targeted amendment rather than a wholesale revision. The file also became a vehicle for other changes, including prohibitions covering AI-generated child sexual abuse material and non-consensual intimate imagery, which the European Parliament pressed for during trilogue negotiations.
The approach
On 19 November 2025, the European Commission proposed the Digital Omnibus on AI as part of a broader simplification package also covering the General Data Protection Regulation (GDPR), the ePrivacy Directive, NIS2 and the Data Act. The AI strand was separated from the rest of the package and fast-tracked so that revised deadlines would take effect before 2 August 2026; the remaining strands remained under negotiation as of September 2026. Council and Parliament negotiators reached a provisional agreement on 7 May 2026, and the European Parliament formally endorsed the agreed text on 16 June 2026. The Council gave its final approval on 29 June. The regulation was signed on 8 July, published in the Official Journal on 24 July, and entered into force on 27 July 2026, ahead of the 2 August 2026 milestone in the original timeline.
The Omnibus makes several targeted changes. The most significant is timeline alignment. The application of rules for stand-alone high-risk AI systems, those listed in Annex III of the AI Act and covering areas such as recruitment, worker management, education, credit scoring, risk assessment and pricing in life and health insurance, and access to essential services, is set to apply from 2 December 2027, sixteen months later than originally scheduled. Rules for high-risk AI embedded in regulated products, such as medical devices and machinery, apply from 2 August 2028, twelve months later than originally scheduled. Both deadlines are fixed calendar dates. The conditional trigger in the Commission's proposal, under which application would have depended on confirmation that standards were available, was removed during negotiations.
The Omnibus also strengthens the Act's substantive protections. Two new prohibitions are introduced under Article 5, covering AI-generated child sexual abuse material and AI-generated non-consensual intimate imagery, both to be complied with by 2 December 2026. Watermarking obligations for AI-generated content under Article 50 apply from the same date.
Several obligations are retained on their original timeline. The AI literacy duty under Article 4, which has applied since February 2025, remains in force. The transparency obligations that apply to deployers under Article 50 continue to apply from 2 August 2026. General-purpose AI model rules, which took effect in August 2025, are unchanged. And 2 August 2026 remains the date national market surveillance authorities activate, and when the AI Office's enforcement powers over general-purpose AI models begin.
One obligation was recast rather than retained. Article 4 on AI literacy, which had applied since February 2025, was replaced in full. Providers and deployers no longer have to ensure a sufficient level of AI literacy but must take measures to support its development, and the amended text states expressly that they are not required to guarantee any specific level of literacy for any individual. The revised wording applies from 27 July 2026, with no deferral.
The Omnibus also changes more than the timetable. New Articles 75a to 75d give the AI Office the powers of a market surveillance authority, including own-initiative investigations, remote and on-site inspections, the power to seal premises and records, binding commitments, and periodic penalty payments of up to 5% of average daily worldwide turnover. The AI Office gains exclusive supervisory competence over AI systems built on general-purpose AI models where the model and the system come from the same undertaking, and over systems integrated into very large online platforms and search engines designated under the Digital Services Act, subject to defined exceptions. A new Article 4a provides a legal basis for processing special categories of personal data for bias detection and correction, extended beyond providers of high-risk systems. Documentation and quality-management requirements are simplified for SMEs and small mid-caps, the deadline for national regulatory sandboxes moves to 2 August 2027, and a new Annex XIV establishes a nomenclature for the designation of notified bodies whose residual category for emerging technologies names agentic AI.
Intended outcomes
The Omnibus entered into force on 27 July 2026. The provisions that took effect on 2 August 2026, notably the Article 50 transparency obligations, the penalty regime and enforcement of the general-purpose AI rules, are now operative. The deferred high-risk regime does not apply until December 2027 and August 2028, so the outcomes below remain what the EU institutions expect the amendment to deliver rather than results already observed.
The Commission proposed the sixteen-month adjustment to align compliance obligations with the availability of harmonised standards. The co-legislators retained the additional time but replaced the standards-based trigger with fixed dates, which favours planning certainty over responsiveness to standards readiness. In agreeing its negotiating position in March 2026, the Council described the proposal as bringing greater legal certainty, more proportionate rules and more harmonised implementation across member states; on final adoption in June 2026 it restated the legal certainty and harmonised implementation objectives. The new prohibitions under Article 5, targeting AI-generated child sexual abuse material and non-consensual intimate imagery, respond to specific harms that had emerged since the Act was drafted.
The Omnibus is a precise refinement rather than a rewriting. The substance of the AI Act, its risk-based approach, its focus on high-risk systems, its safeguards for fundamental rights, and its governance architecture, remains intact. What has changed is the sequencing, and the Act has gained new protections against emerging harms.
The transferable lesson
Every jurisdiction writing rules for fast-moving technology faces the same balance. The rules need to be strict enough to matter and predictable enough to plan against, while remaining responsive to how the world changes between drafting and implementation. The EU designed the AI Act with a phased schedule to manage exactly this balance, and the Digital Omnibus shows that schedule being adjusted in light of implementation experience.
There are two lessons here for regulators elsewhere. First, big new laws work best when the supporting systems are built alongside them, not after. When technical standards, the bodies that check compliance, and the people trained to run them are all ready in step with the law itself, implementation is smoother for everyone. Second, updating a law openly and in a targeted way is a sign of a mature regulator, not a weak one. The EU's willingness to refine the AI Act openly, less than two years after adoption, shows a legislative framework adaptive and designed to learn. Other countries building similar frameworks may find themselves doing the same.