The European Union has delayed the main rules of its AI Act for high-risk AI systems, such as AI used in hiring, credit scoring and education, from 2 August 2026 to 2 December 2027. The change comes from the "Digital Omnibus on AI", Regulation (EU) 2026/1744, which has been in force since 27 July 2026. The same law adds new bans on AI that creates non-consensual intimate images or child sexual abuse material, which apply from 2 December 2026, less than a month from now.
The AI Act is the world's first broad law on AI regulation. It sorts AI systems by risk and sets rules for each level. This article explains what the Omnibus changed, the new timeline and what it means for people who use AI tools and the companies that make them.
What happened
In November 2025, the European Commission proposed a package of changes to simplify EU digital rules, including the AI Act. The main reason for the delay was practical: most of the technical standards that companies need to meet the high-risk rules weren't finished in time.
The Parliament and the Council reached a political agreement in May 2026, both formally adopted the text in June, and it was signed on 8 July 2026 as Regulation (EU) 2026/1744. It was published in the EU's Official Journal in July and entered into force on 27 July 2026, just before the original 2 August 2026 deadline.
The new AI Act timeline
| Date | What applies |
|---|---|
| 2 February 2025 | Bans on unacceptable-risk AI (such as social scoring and manipulative AI) and the AI literacy duty. Unchanged |
| 2 August 2025 | Rules for general-purpose AI models, such as the models behind chatbots. Unchanged |
| 2 August 2026 | Transparency rules (Article 50): people must be told when they talk to an AI, and deepfakes must be disclosed. Still applies on this date |
| 2 December 2026 | New bans on AI that creates non-consensual intimate images or child sexual abuse material. AI-generated content from generative AI systems already on the market before 2 August 2026 must be marked as AI-made |
| 2 August 2027 | Each EU country must have at least one AI regulatory sandbox running |
| 2 December 2027 | High-risk rules for "Annex III" systems, such as AI in hiring, education, credit scoring and access to public services. Moved from 2 August 2026 |
| 2 August 2028 | High-risk rules for AI inside regulated products, such as medical devices and machinery ("Annex I"). Moved from 2 August 2027 |
| 2 August 2030 | High-risk systems used by public authorities must comply |
The main changes in the Digital Omnibus
More time for high-risk AI
High-risk AI is AI that can affect people's lives, jobs, money or safety. Companies building or using it must manage risks, use good-quality data to limit bias, keep records, explain how the system works and keep a person in charge. Those duties now start on 2 December 2027 for most systems and 2 August 2028 for AI in regulated products.
New bans on "nudifier" apps and abuse material
The Omnibus adds two new prohibitions to the AI Act. It bans AI systems that generate or manipulate intimate images of an identifiable person without their explicit consent, and AI systems that generate child sexual abuse material. The bans also cover systems where such output is a reasonably foreseeable result and there are no adequate safeguards. They apply from 2 December 2026.
A short grace period for AI watermarks
From 2 August 2026, providers of generative AI systems must mark the images, audio, video and text they create in a machine-readable way, so that it can be detected as AI-made. Read more about AI watermarking. Systems that were already on the market before that date have until 2 December 2026 to comply.
A softer AI literacy duty
Since February 2025, companies that make or use AI have had to make sure their staff understand it. The Omnibus softens this: companies must take measures to support AI literacy among their staff, rather than guarantee a specific level for every person. The Commission will publish practical examples, with extra support for small businesses.
Relief for small and mid-sized companies
Simplified paperwork, scaled-down quality management and lower fine caps now extend beyond small businesses to "small mid-caps", which Orrick describes as companies with fewer than 750 employees and up to €150 million in turnover.
Other changes
- Testing for bias: companies get a clearer legal basis to process sensitive personal data, under strict conditions, to detect and fix bias in AI systems.
- Central enforcement: the EU's AI Office gets exclusive power to supervise AI systems built on a general-purpose model by the same provider, and AI built into very large online platforms and search engines.
- Less overlap: AI in machinery is largely handled under product safety law, and the definition of a "safety component" is narrower.
What it means for you
If you use AI tools in the EU, little changes day to day. Chatbots must already tell you that you're talking to an AI, and deepfakes must be labelled. From 2 December 2026, you should see more AI-made content carrying watermarks or Content Credentials, and nudifier apps become illegal to offer or use in the EU. Our guide on how to spot AI-generated images explains how to check those labels.
If you make AI tools, check two near-term dates. Generative tools must mark their output (2 August 2026 for new systems, 2 December 2026 for older ones), and any feature that could create non-consensual intimate images needs safeguards by 2 December 2026. The rules for general-purpose AI models still apply.
If your business uses AI for hiring, lending, education or other high-risk uses, you have more time, but not a pass. Use the extra 16 months to map where you use AI, ask your vendors how they will comply and put human review in place. The obligations themselves haven't been removed.
The bottom line
The Digital Omnibus gives companies until December 2027 (and August 2028 for regulated products) to meet the AI Act's high-risk rules, because the technical standards weren't ready. At the same time, it adds new bans on AI-made intimate images and abuse material from 2 December 2026, and keeps the transparency rules that tell people when content or a chatbot is AI. For everyday users, the AI Act is already shaping the tools you use: clearer labels, fewer harmful apps and more responsible AI.
Frequently asked questions
Has the EU AI Act been delayed?
Partly. The high-risk rules were delayed to 2 December 2027 for most systems and 2 August 2028 for AI in regulated products. The bans, general-purpose AI rules and transparency rules were not delayed.
When does the EU AI Act fully apply?
Most of the AI Act applies from 2 August 2026. After the Digital Omnibus, the high-risk rules follow on 2 December 2027 and 2 August 2028, and high-risk systems used by public authorities have until 2 August 2030.
What is the Digital Omnibus on AI?
It is an EU law, Regulation (EU) 2026/1744, that amends the AI Act. It delays the high-risk rules, adds new bans on AI-generated intimate images and abuse material, softens the AI literacy duty and simplifies rules for smaller companies. It entered into force on 27 July 2026.
Does the EU AI Act apply to companies outside Europe?
Yes. It applies to any company that offers AI systems in the EU or whose AI output is used in the EU, wherever the company is based.
Sources
- EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- EUR-Lex, Regulation (EU) 2024/1689 (the AI Act)
- European Commission, AI Act: regulatory framework for AI
- ArtificialIntelligenceAct.eu, Digital Omnibus on AI
- Gibson Dunn, EU AI Act Omnibus agreement: postponed high-risk deadlines and other key changes (May 2026)
- Orrick, EU AI Act update: Digital Omnibus finalizes 8 compliance changes (July 2026)
