Regulation (EU) 2026/1744: Digital Omnibus on AI (EU AI Act Amendment)
Issued by
European Parliament and Council of the European Union
- September 7, 2026 · Substantive update — Entry created for Regulation (EU) 2026/1744, the AI Act Omnibus amendment deferring high-risk deadlines. Facts verified against CSA Research, artificialintelligenceact.eu, and Gibson Dunn. (Cody Maxwell)
- September 30, 2026 · Correction — Corrected the prohibitions and AI literacy date to February 2025, added the two new bans and the softened literacy duty, and merged the duplicate omnibus entry. (Cody Maxwell)
- September 30, 2026 · Correction — Corrected the date to entry into force (27 July 2026), noted that Annex I was originally due in 2027, and linked the Official Journal text (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
Regulation (EU) 2026/1744 defers the AI Act’s high-risk compliance deadlines. Stand-alone Annex III systems move from August 2, 2026 to December 2, 2027. Product-embedded high-risk systems have until August 2, 2028. General-purpose AI (GPAI) duties remain applicable from August 2025. Prohibited practices and AI literacy requirements have applied since February 2025. The amendment adds two bans from December 2026 and softens the literacy duty.
Applies To
Overview
Regulation (EU) 2026/1744, part of the European Commission's Digital Omnibus package, changes when the EU AI Act's high-risk obligations start to apply. It was published on 24 July 2026 and entered into force on 27 July 2026. Annex III deadlines move from 2 August 2026, and Annex I deadlines from 2 August 2027. Stand-alone Annex III systems have until 2 December 2027. These are high-risk systems that are not safety components of products already covered by EU product law. The deferral reaches all eight Annex III areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services, including credit scoring and insurance pricing; law enforcement; migration, asylum, and border control; and the administration of justice and democratic processes. AI that is a safety component of a product regulated under existing EU harmonisation legislation, the Annex I category, is deferred further, to 2 August 2028. That aligns the AI Act obligations with the product certification cycles those sectors already run. Most of what was already in force stays as it was. General-purpose AI (GPAI) model obligations have applied since 2 August 2025. The prohibitions on unacceptable-risk practices have applied since 2 February 2025. The amendment adds two more from 2 December 2026: AI that generates child sexual abuse material, and AI that creates non-consensual intimate images of real people. The AI literacy duty has also applied since 2 February 2025. The amendment softens it from ensuring a sufficient level of staff literacy to taking measures that support it. Governance provisions and penalty rules keep their existing schedule. The amendment also gives the European AI Office exclusive supervision of general-purpose AI models and of AI systems built into very large online platforms and search engines, with wider inspection powers.
Key Requirements
- •Stand-alone Annex III high-risk systems: meet the full obligation set (risk management, data governance, technical documentation, record-keeping, human oversight, accuracy, robustness and cybersecurity, conformity assessment, and EU database registration) by 2 December 2027.
- •Annex I product-embedded high-risk systems: the same obligation set by 2 August 2028.
- •GPAI providers: no change. Obligations continue on their existing timeline.
- •Prohibited practices: the original bans still apply, and two new bans on AI-generated child sexual abuse material and non-consensual intimate images apply from 2 December 2026.
- •AI literacy: the duty has applied since 2 February 2025. It now requires measures that support staff AI literacy rather than ensuring a sufficient level.
- •Read the deferral as lead time, not a stand-down. Notified-body and conformity-assessment capacity is limited, and regulators can still act on prohibited-practice and transparency breaches today.
What Your Organization Must Do
- →Reset your AI Act project plan to 2 December 2027 for stand-alone Annex III high-risk systems.
- →Set a separate 2 August 2028 track for high-risk AI embedded as a product safety component.
- →Book conformity assessment and notified body capacity early, since availability is limited.
- →Screen product roadmaps now against the two new bans applying from 2 December 2026.
- →Document the measures you take to support staff AI literacy, a duty applicable since February 2025.
- →Confirm general-purpose AI model obligations remain on their existing timeline from August 2025.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- Did Regulation (EU) 2026/1744 delay the whole EU AI Act?
- No, it defers the high-risk obligations only. General-purpose AI model duties still apply from August 2025, and the prohibitions still apply from February 2025. The amendment also adds two bans from December 2026 and softens the AI literacy duty, which has applied since February 2025.
- What are the new high-risk deadlines?
- Stand-alone Annex III high-risk systems: 2 December 2027, moved from 2 August 2026. High-risk AI embedded as a safety component in products regulated under existing EU law (Annex I): 2 August 2028.
- Which high-risk categories does the deferral cover?
- All eight Annex III areas: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, and administration of justice.