EU AI Act omnibus delays high-risk rules to 2027 and 2028

What the omnibus changes

The Digital Omnibus on AI was published in the Official Journal and applies from 27 July 2026. It amends the AI Act, Regulation (EU) 2024/1689 of 13 June 2024, which entered into force on 1 August 2024. Mayer Brown said the changes aim to simplify implementation and reduce overlap with existing regulation.

Obligations for high-risk use case AI systems listed in Annex III now apply from 2 December 2027. Those uses include biometrics, critical infrastructure, education, employment, law enforcement and border management. High-risk systems used as safety components in products covered by EU sectoral legislation apply from 2 August 2028. The delay is meant to give the EU standardisation committee time to publish AI Act standards, which set out how providers can comply and create a presumption of conformity when published in the Official Journal, the Data Protection Report said.

The Omnibus also moves the EU Machinery Regulation, 2023/1230, into Annex I Section B, so AI requirements for AI-enabled machinery are handled through that regulation rather than the AI Act directly. The Commission must adopt delegated acts integrating those obligations by 2 August 2028, Mayer Brown said.

For high-risk systems already in service before the new dates, the Act applies to operators only if those systems undergo significant changes in design from that date. For operators that are public authorities, it is unclear whether the dates of application will be delayed, Mayer Brown said.

New ban on nudifier apps

The Omnibus adds a prohibition on AI systems that create child sexual abuse material, or that depict an identifiable person's intimate parts or sexual activity without consent. It covers placing such systems on the EU market, placing them on the market without reasonable safety measures, and deployers using them to create that content. Providers have until 2 December 2026 to comply, Mayer Brown said.

Transparency rules keep their date

The Omnibus did not delay other transparency requirements. Article 50 duties, such as telling individuals they are interacting with AI and disclosing deepfakes, apply from 2 August 2026 for AI systems placed on the market after that date. For providers generating synthetic audio, image, video or text, the machine-readable marking obligation has a limited grace period to 2 December 2026 for systems placed on the market before 2 August 2026, for that obligation only.

The Commission published final guidelines on Article 50 transparency on 20 July 2026, and a first list of more than 180 organisations that signed the Code of Practice on transparency of AI-generated content.

Enforcement starts

The AI Office's enforcement powers apply from 2 August 2026, the Commission's enforcement page says. They cover providers of general-purpose AI models, AI systems developed by the same provider or a provider in the same business group, and AI systems integrated into very large online platforms or search engines designated under the Digital Services Act. National authorities enforce the rules for other AI systems. Breaches involving prohibited practices can reach the higher of €35 million or 7% of worldwide annual turnover. Other breaches, including general-purpose AI obligations, can reach €15 million or 3%. Mishandling an information request can be fined at up to €7.5 million or 1% for AI systems.

What happens next

The new ban is the nearest deadline: providers and deployers of the covered systems have until 2 December 2026 to comply, after which it joins the Act's existing prohibitions, applicable since 2 February 2025. Enforcement of those prohibitions rests with national market surveillance authorities, and some member states were still passing implementing legislation after the 2 August 2025 designation deadline, the Data Protection Report said.