What the Digital Omnibus actually changed

The EU AI Act was amended for the first time this summer. Regulation (EU) 2026/1744, known as the Digital Omnibus, entered into force on 27 July 2026.

Most of the coverage I have read falls into one of two camps. Either the Act has been gutted and nobody needs to worry any more, or nothing has really changed and everyone should carry on panicking. Neither is accurate, and the real picture is more useful than either.

The high-risk deadlines moved

This is the part that got the headlines, and it is real.

Stand-alone high-risk systems listed in Annex III, which covers things like recruitment, credit scoring, and access to education, were due to apply from 2 August 2026. They now apply from 2 December 2027.

AI built into regulated products under Annex I, such as medical devices, machinery, and vehicles, was due from 2 August 2027. It now applies from 2 August 2028.

That is a serious amount of extra runway for the organizations building or deploying those systems. It is also the part of the Act that requires the most engineering work, so the extra time will get used.

Article 4 did not move

The AI literacy obligation has applied since February 2025 and was not deferred. What changed was the wording.

The earlier text asked providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy. The current text asks them to take measures to support the development of AI literacy, taking account of people’s technical knowledge, experience, education, and the context the systems are used in.

Lawyers describe this as a shift from an obligation of result to an obligation of effort. In plain terms, the Act no longer implies that every person has to clear a fixed bar. It asks whether the organization has done sensible things, matched to the actual roles and the actual risks.

Two paragraphs were also added. The Commission and Member States are now expected to support providers and deployers, particularly smaller companies, and the AI Board will issue recommendations on promoting AI literacy.

Supervision started on 2 August 2026

This is the part I find most organizations have missed.

Article 4 had been in application for eighteen months without anyone holding formal supervisory powers over it. On 2 August 2026 national market surveillance authorities gained those powers. Germany’s BNetzA and Ireland’s newly established AI Office are among the bodies now able to ask questions.

So the obligation got softer in its wording and harder in its supervision, in the same summer. Reading only the first half of that is how a company ends up unprepared.

Transparency also went live

Article 50 was not delayed either. Since 2 August 2026, people have to be told when they are interacting with an AI system, and AI-generated content published on matters of public interest has to be disclosed as such. There are carve-outs, including for content that has gone through genuine human editorial review.

The only concession was a short grace period for marking and detection requirements on systems already on the market before that date, running to 2 December 2026.

In most companies this lands on marketing, communications, and customer service. Those are usually the groups furthest from the compliance conversation.

What this means in practice

The softer wording of Article 4 has been read in some quarters as permission to do less. I would read it the other way. A contextual obligation is one you have to reason about, and reasoning leaves a trail.

The organizations in reasonable shape have three plain things. An inventory of the AI systems actually in use, including the ones that arrived inside tools nobody thinks of as AI. A view of which roles touch which systems, and how deeply. A record of what training each group received and when.

None of that is exotic. It is the kind of thing a company already does for safety training or data protection. The work is mostly in doing it once, properly, and keeping it current as the tools change.

The deadline that got pushed was never the one most organizations needed to worry about.