The AI Act's high-risk dates moved. Its transparency duties did not.

What changed

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on July 8, 2026, published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. It amends the AI Act, Regulation (EU) 2024/1689, rather than replacing it. Primary source: Regulation (EU) 2026/1744 on EUR-Lex.

Two dates moved.

For high-risk systems classified under Article 6(2), the Annex III standalone cases, Sections 1, 2 and 3 of Chapter III now apply from December 2, 2027 instead of August 2, 2026.

For high-risk systems classified under Article 6(1), the Annex I cases where the AI is a safety component of, or is itself, a product already covered by EU harmonization legislation, the date is now August 2, 2028, a year later than the AI Act originally set. That is the branch an AI function inside an MDR or IVDR device falls into.

Recital 40 gives the reason: standards, common specifications and guidance were not available in time, and national competent authorities had not yet been established.

One date did not move. The Article 50 transparency obligations have applied since August 2, 2026. The Omnibus touches Article 50 only to replace its paragraph 7, on codes of practice for the detection, marking and labeling of artificially generated content, and to grant a four-month transitional period. Recital 38 sets that out: providers of generative systems already placed on the market before August 2, 2026 have until December 2, 2026 to bring marking into line with Article 50(2).

What it actually requires

Read plainly, and kept separate from what anyone makes of it:

No high-risk obligation was removed. Article 9 risk management, Article 10 data and data governance, Article 11 technical documentation, Article 12 record-keeping, Article 14 human oversight, Article 15 accuracy, robustness and cybersecurity, and the Article 17 quality management system are all intact. What changed is the date on which a conformity assessment can hold you to them.

Article 50 is live now. A system that interacts directly with a natural person has to make that person aware they are dealing with an AI system, unless it is obvious from the context. Synthetic audio, image, video and text output has to be marked in a machine-readable format and be detectable as artificially generated or manipulated.

The simplification is real, and it is narrow. Article 11 already let SMEs, including start-ups, supply technical documentation on a simplified form; the Omnibus extends that form to small mid-cap enterprises (SMCs) and requires notified bodies to accept it. Article 17 already required the quality management system to be proportionate to the size of the provider's organization; the Omnibus adds "in particular, if the provider is an SME, including a start-up, or an SMC." Proportionate is not the same as optional.

What it means for an engineering team

Marking is a build task whose date is already in the past. Machine-readable provenance on generated output has to be produced at the moment of generation. It is not a label that can be applied afterwards to content already sitting in a record.

Disclosure needs a rendered artifact, not a design statement. "Unless it is obvious" cannot be assessed from a specification. Someone has to look at the screen.

The extra two years buy standards, not slack. Everything Chapter III asks for is evidence produced during development: a risk management file, a data governance record, logs designed to be read, a documented and testable human-oversight measure. A team that starts collecting it in 2028 is reconstructing it from memory.

Logging has the longest lead time in the set. Article 12 requires automatic recording of events across the lifetime of the system. Retention, tamper-evidence, and the ability to reconstruct why a given output was produced are schema decisions, and schema decisions are the expensive kind to retrofit.

What is still unsettled

Whether the standards arrive. The deferral was granted because the harmonized standards were not ready. Nothing in the regulation makes them ready by December 2027 either, and a second deferral would be the same date moving for the same reason twice.

How Article 6(1) actually runs through a notified body. The AI Act's conformity assessment is meant to be carried out inside the device's existing assessment. How that divides between a notified body's software reviewer and its AI competence is not settled at most bodies, and a manufacturer cannot plan a submission around an unassigned reviewer.

What "detectable as artificially generated" means for text. Marking an image is largely a solved problem. Marking text so that a downstream system can detect it, without the marking surviving into a clinical record as noise, is not.

How far a post-market model update can go before conformity reopens. The AI Act does provide for it: under Article 43(4), changes the provider pre-determined at the initial conformity assessment, and documented in the technical documentation, are not a substantial modification. What it does not settle is how specific that pre-determination has to be for a model retrained on a cadence, or how it lines up with the MDR's own rules on significant change. The Omnibus left both questions where they were.

Sources

• European Union. Regulation (EU) 2026/1744 (Digital Omnibus on AI). Adopted July 8, 2026, published in the Official Journal July 24, 2026, in force July 27, 2026.
• European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act). Published in the Official Journal July 12, 2024.