Regulation (EU) 2026/1744, the Digital Omnibus on AI, landed in the Official Journal today and enters into force on July 27, eight days before the AI Act’s August 2 general application date. Parliament adopted the text on June 16 and the Council followed on June 29, closing a compressed inter-institutional cycle that leaves providers with almost no runway before the first live obligations bite.

The headline concession is a 16-month reprieve for high-risk providers. Standalone Annex III systems (employment, credit scoring, law enforcement, biometrics) now come due on December 2, 2027; Annex I embedded systems (medical devices, machinery, toys) slip to August 2, 2028. The Commission’s November 2025 conditional trigger mechanism, which would’ve tied deadlines to harmonized standards, was scrapped in favor of unconditional calendar dates, per readouts from Freshfields and Gibson Dunn.

What isn’t deferred matters more. Article 50 transparency duties (chatbot disclosure, deepfake labeling, synthetic content marking) activate on August 2, alongside the AI Office’s GPAI enforcement powers. The Commission published final Article 50 guidelines on July 20, giving providers 13 days to operationalize them. Pre-existing generative systems get a four-month grace period on machine-readable marking, expiring December 2, 2026, the same date two new Article 5 prohibitions hit: nudifier apps and AI-generated CSAM.

Article 75a hands the AI Office exclusive competence over systems built on GPAI models within the same business group, consolidating supervision that member states had expected to share. SME simplifications now extend to mid-caps up to 750 employees and €150 million in revenue. Penalties are untouched: €35 million or 7% of global turnover for prohibited practices, €15 million or 3% for high-risk and transparency breaches.

A second Omnibus tranche on data and cybersecurity is expected in H1 2027. The pattern is familiar from GDPR’s early years: the calendar bends, the enforcement architecture doesn’t.

Sources

Sources