EU AI Act after the Digital Omnibus: what was delayed and what applies now

What is the Digital Omnibus on AI?

The Digital Omnibus on AI is Regulation (EU) 2026/1744, adopted on 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026. It amends the AI Act (Regulation 2024/1689), the EASA Regulation and the Machinery Regulation, mainly to delay high-risk deadlines and simplify compliance for smaller firms.

Beyond the postponements, the Omnibus makes several substantive changes. According to the EUR-Lex text and summary:

• A new Article 5 prohibition covers AI systems that generate realistic non-consensual intimate imagery of identifiable people or child sexual abuse material.
• AI literacy is softened. Article 4 becomes a duty to “take measures to support the development of AI literacy” of staff, rather than ensuring a specific level.
• SMEs and small mid-caps (SMCs) are defined as categories with simplified paths, such as simplified technical documentation, and quality-management flexibility extended to all SMEs.
• The AI Office gains exclusive supervisory competence over AI systems built on general-purpose AI models from the same provider and over very large online platforms, and runs a Union-level regulatory sandbox.

Obligations for general-purpose AI model providers, which applied from 2 August 2025, are unchanged, according to Gibson Dunn’s analysis.

What is the new EU AI Act timeline?

After the Omnibus, the key dates are: general-purpose AI model duties since 2 August 2025; Article 50 transparency since 2 August 2026; 2 December 2026 for legacy generative systems to add machine-readable marking; 2 December 2027 for Annex III high-risk systems; and 2 August 2028 for high-risk systems embedded in Annex I products.

One date is less settled. Gibson Dunn’s analysis of the political agreement (27 May 2026, before formal adoption) describes a transitional period to 2 December 2026 for the new Article 5 prohibition; secondary sources disagree on the details. If your product generates images or video of people, confirm this against the Official Journal text rather than relying on a summary, including ours.

What does Article 50 require right now?

Article 50 has applied since 2 August 2026. Providers must tell people they are interacting with AI unless that is obvious, and must mark synthetic audio, image, video and text in a machine-readable way where technically feasible. Deployers must disclose deepfakes, emotion recognition and AI-generated text on matters of public interest.

Jones Walker’s summary (16 July 2026) breaks the duties down as follows:

Breaches can attract fines of up to €15 million or 3% of annual worldwide turnover, whichever is higher, with a lower ceiling for qualifying SMEs. On 8 July 2026 the Commission confirmed that its facilitated Code of Practice adequately covers Articles 50(2), (4) and (5). Following the Code helps demonstrate compliance, but Jones Walker notes it is not conclusive.

Who does it affect, including Indian companies with EU users?

The AI Act applies to providers placing AI systems on the EU market or putting them into service there, regardless of where the provider is established. An Indian, US or other non-EU company whose chatbot, content generator or AI feature reaches EU users should assume Article 50 may apply and check its role.

Two roles matter most for transparency. The provider builds the AI system or puts it on the market under its name, and owns AI-interaction disclosure and machine-readable marking. The deployer uses the system in its own product or service, and owns deepfake, emotion-recognition and public-interest text disclosure. Many software companies are both.

Common situations for Indian product and services companies

• SaaS with EU customers. A support chatbot or writing assistant inside your product, sold to EU users, likely makes you a provider for Article 50 purposes. Add the AI-interaction notice and check that generated media is marked.
• Building for an EU client. If you build an AI feature that your client launches under its brand, map who is provider and who is deployer in the contract, and agree who implements disclosure and marking.
• Using a model API. Calling a foundation model does not remove your obligations for the system you ship. Check what the model provider already marks, and make sure your pipeline does not strip it.
• Smaller firms. The new SME and SMC categories bring simplified paths, but they relax documentation, not the core transparency duties.

Our view: treat these points as questions to put to counsel, not conclusions. Role allocation depends on facts such as branding, control and how the system is distributed.

What does Article 50 mean in engineering terms?

In practice Article 50 becomes four engineering tasks: a clear AI notice in conversational interfaces, machine-readable marks on generated media and text where feasible, user-facing labels for deepfakes and published AI text, and logging that proves which outputs were generated, by which model, and whether a human reviewed them.

Model providers are already marking outputs

Some upstream providers now do part of the marking for you. Anthropic says it adds a watermark, a numerical way of determining the likelihood that Claude was involved in writing a piece of text, to the outputs of its models released after 2 August 2026. Its detection tool is available to eligible organisations such as regulators, media, fact-checkers and researchers, and to enterprises obliged to verify watermarking for their own compliance; The Next Web describes it as a private preview.

That helps, but it does not cover every case. Check which of your providers mark which output types, avoid post-processing that destroys the marks, and do not assume an upstream watermark discharges your own disclosure duties as a deployer.

How should teams use the high-risk delay?

Use the extra time to inventory, not to wait. Identify which of your AI systems could fall under Annex III areas such as hiring, credit, education or biometrics, then build risk management, documentation and human-oversight practices incrementally. 2 December 2027 is a legal deadline; enterprise buyers and procurement teams will ask for evidence earlier.

1. 01List every AI system and feature in production or on the roadmap, with its purpose, users, markets and model provider.
2. 02Screen against Annex III use cases. Systems used in hiring, credit decisions, education and biometrics deserve a closer legal review.
3. 03Start the documentation habit now: data sources, evaluation results, known limitations and human-oversight design for each candidate system.
4. 04Check SME or SMC eligibility and whether simplified documentation applies to you.
5. 05Watch product-embedded systems separately. If your AI ships inside machinery or other Annex I products, the date is 2 August 2028.

What this means for teams building now: a compliance checklist

If you ship generative or conversational features to EU users, the transparency work is due now, not in 2027. Add AI notices, mark generated content, label deepfakes, log provenance and assign provider and deployer responsibilities in contracts. Then use the high-risk delay for an inventory. Confirm all of it with counsel; this is not legal advice.

This quarter

• Add a clear AI-interaction notice to every chatbot, voice assistant and AI agent that talks to users.
• Audit generated images, audio, video and text for machine-readable marking; fix pipelines that strip metadata.
• If any generative feature was on the market before 2 August 2026, finish marking before 2 December 2026.
• Add visible labels for deepfakes and a documented editorial-review step for AI-written public-interest content.
• Start a provenance log for generated outputs.
• Confirm that no feature could generate non-consensual intimate imagery or CSAM, and add safeguards.
• Put staff AI-literacy measures in place; the revised Article 4 duty already applies (since 2 February 2025, per Gibson Dunn).

Before mid-2027

• Complete the Annex III inventory and get a legal view on borderline systems.
• Update client and vendor contracts to state who is provider and who is deployer.
• Review the Commission’s Code of Practice for Articles 50(2), (4) and (5) and decide whether to align with it.

If you are deciding how much autonomy to give an assistant, our comparison of AI chatbots and AI agents covers the design trade-offs. For help building disclosure, marking and provenance logging into your product, our generative AI team works on exactly this.

Frequently asked questions

Sources

1. Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex, Official Journal of the EU, 2026-07-24
2. Yes, August 2 Still Matters: The EU Approved a High-Risk AI Delay, but Most Transparency Obligations Remain — Jones Walker, 2026-07-16
3. EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes — Gibson Dunn, 2026-05-27
4. Claude Fable 5.1 and Claude Mythos 5.1 — Anthropic, 2026-09-01
5. Anthropic releases Claude Fable 5.1 and Mythos 5.1, cutting cache read prices by 75% — The Next Web, 2026-09-01