Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, updates existing European Union regulations to ease compliance burdens while maintaining safety standards. It adjusts implementation timelines, narrows high-risk AI classifications, and provides targeted support and simplified requirements for small and mid-cap enterprises.
The legislation prohibits AI systems that generate non-consensual intimate material or child sexual abuse content. Additionally, it streamlines conformity assessment procedures, establishes enhanced regulatory sandboxes, and grants centralized supervisory and enforcement powers to the AI Office for general-purpose AI models and large online platforms.
Regulation (EU) 2026/1744
Digital Omnibus on AI – Executive Summary Analysis
Overview
Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI,” amends three key regulations to address implementation challenges identified during the early rollout of the AI Act. The focus is on reducing compliance burden while maintaining protection levels.
Amended Regulations
- Regulation (EU) 2024/1689 (AI Act)
- Regulation (EU) 2018/1139 (Civil Aviation)
- Regulation (EU) 2023/1230 (Machinery Regulation)
Key Objectives
- Reduce compliance burden
- Clarify implementation requirements
- Extend timelines for key provisions
- Strengthen SME/SMC support
Key Amendments
1. SME and Small Mid-Cap Enterprise (SMC) Support
New Definitions Introduced:
- SME: Micro, small and medium-sized enterprises (per Recommendation 2003/361/EC)
- SMC: Small mid-cap enterprises (per Recommendation (EU) 2025/1099)
Changes: Extended SME measures to SMCs, simplified technical documentation, proportionality in quality management, priority sandbox access, reduced fine caps for SMCs.
Impact: Recognizes that SMCs face similar administrative burdens to SMEs despite faster growth and higher innovation/digitisation levels.
2. Safety Component Definition Clarification
Amended Definition (Article 3, point 14): A “safety component” now requires intended purpose determined by the provider to prevent or mitigate risks to health and safety.
Excludes: AI systems for user assistance, performance optimisation, service efficiency, automation, convenience, or non-safety quality control.
Impact: Narrows high-risk classification to prevent over-extension beyond risk-based approach justification.
3. AI Literacy Requirements Relaxed
Article 4 Amendment: Changed from obligation to “ensure” AI literacy to “take measures to support the development” of AI literacy. No requirement to guarantee any specific level.
Impact: Reduces compliance burden while maintaining AI literacy as strategic priority.
4. Bias Detection and Correction Expanded
New Article 4a: Extended legal basis for processing special categories of personal data for bias detection/correction to providers and deployers of other AI systems and models.
Conditions: Strictly necessary, cannot be fulfilled by other data, biases likely to affect health/safety/fundamental rights.
5. Prohibited AI Practices – Non-Consensual Intimate Material and CSAM
New Article 5(1)(ba) and (bb): Prohibits placing on market, putting into service, or use of AI systems generating/manipulating non-consensual intimate material or child sexual abuse material.
Timeline: Applies from 2 December 2026
Provider Obligations: Prohibition applies where intended purpose OR reasonably foreseeable outcome without adequate safeguards.
Adequate Safeguards Include: Data cleaning, refusal training, safe prompt design, output controls, content classification, abuse detection.
6. Conformity Assessment Streamlining
Article 28(8): Single application and unified assessment procedure for bodies seeking designation under AI Act AND other Union harmonisation legislation.
Article 42(3): High-risk AI systems complying with Cyber Resilience Act deemed compliant with AI Act Article 15 cybersecurity requirements.
7. AI Regulatory Sandboxes Enhanced
New Union-Level Sandbox: AI Office may establish Union-level sandbox for Article 75(1) AI systems with priority access for SMEs, start-ups, and SMCs.
Real-World Testing Expanded: Extended to high-risk AI systems covered by Union harmonisation legislation.
Timeline: National sandboxes operational by 2 August 2027
8. AI Office Supervisory Powers Strengthened
New Articles 75a, 75b, 75c, 75d: AI Office exclusively supervises AI systems based on GPAI models and AI systems in VLOPs/VLOSEs.
Powers Include: Information requests, on-site inspections, commitment decisions, non-compliance findings, fines, periodic penalty payments (up to 5% average daily income/turnover).
9. Timeline Adjustments
| Provision | Original Date | New Date |
|---|---|---|
| Article 5(1)(ba), (bb) (prohibitions) | 2 August 2026 | 2 December 2026 |
| Chapter III, Sections 1-3 (Annex III) | 2 August 2026 | 2 December 2027 |
| Chapter III, Sections 1-3 (Annex I) | 2 August 2026 | 2 August 2028 |
| Generative AI marking (Article 50(2)) | 2 August 2026 | 2 December 2026 |
| Public authority compliance | – | 2 August 2030 |
10. Machinery Regulation Sectoral Approach
Article 42: Machinery Regulation moved from Section A to Section B of Annex I. AI Act applies only to specific articles for machinery AI systems.
Impact: Machinery sector gets tailored AI requirements integrated into sectoral legislation.
11. Notified Body Designation Codes
AIP Codes (Product Legislation)
AIP 0102-0112: AI systems subject to Annex I, Section A points 2-12
AIB Codes (Biometric AI)
AIB 0201: Remote biometric identification
AIB 0202: Biometric categorisation
AIB 0203: Emotion recognition
AIH Codes (Technologies)
AIH 0101: Symbolic AI, expert systems
AIH 0201-0205: Machine learning variants
AIH 0301: Generative AI / GPAI
AIH 0401: Emerging AI (Agentic AI)
Critical Compliance Dates
Strategic Implications
For Providers
- Reduced near-term burden but extended timeline
- Safety component clarification narrows high-risk scope
- Single application reduces certification costs
- SME/SMC measures provide meaningful relief
- Prohibition compliance requires technical safeguards by Dec 2026
For Deployers
- AI literacy remains strategic priority
- Bias detection obligations extended beyond high-risk
- Fundamental rights assessments can reference DPIAs
For Notified Bodies
- 18-month window to assess under existing designations
- Unified assessment enables single designation
- Code system requires precise scope definition
For AI Office
- Exclusive competence over GPAI and VLOP/VLOSE AI
- Full market surveillance powers including fines
- Resource allocation requirement
Risk Assessment
High-Risk Areas
- Non-consensual intimate material – Technical safeguards by Dec 2026
- GPAI model providers – Direct AI Office supervision
- VLOPs/VLOSEs – Dual DSA/AI Act compliance
Moderate-Risk Areas
- Annex III biometric systems – Dec 2027 deadline
- Annex I product AI – Aug 2028 deadline
- Bias detection – Extended obligations
Lower-Risk Areas
- SME/SMC providers – Simplified requirements
- Non-safety AI components – Excluded from high-risk
- Sectoral machinery AI – Tailored requirements
Conclusion
Regulation (EU) 2026/1744 represents a pragmatic recalibration of the AI Act implementation. Key themes include:
- Proportionality: SME/SMC measures, simplified documentation, reduced fines
- Clarity: Safety component definition, AI literacy obligations, prohibited practices scope
- Efficiency: Single application for notified bodies, integrated QMS, removed duplicative requirements
- Innovation: Enhanced sandboxes, expanded real-world testing, Union-level sandbox option
- Enforcement: Centralized AI Office powers for GPAI/VLOPs, cooperation mechanisms
The extended timelines (2027-2028) acknowledge implementation challenges while maintaining the AI Act’s core protections. Organizations should use this additional time to build robust compliance programs rather than delay preparation.
Source: EUR-Lex, Regulation (EU) 2026/1744, OJ L, 2026/1744, 24.7.2026
ELI: http://data.europa.eu/eli/reg/2026/1744/oj
Report Created: November 2 2026