The Digital Omnibus Is Law: What Regulation (EU) 2026/1744 Changes for High-Risk AI

On 24 July 2026, Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal of the European Union. It entered into force three days later, on 27 July 2026, six days before the EU AI Act’s original 2 August 2026 deadline for High-Risk AI systems. It is the first substantive amendment to the EU AI Act (Regulation (EU) 2024/1689), and it rewrites the compliance calendar that most organisations had been planning against.

This explainer sets out what changed, what did not change, and what providers and deployers of High-Risk AI systems should do with the time the deferral has bought them.

What changed

• High-Risk AI systems under Annex III (stand-alone systems used in areas such as biometrics, critical infrastructure, education, employment, credit scoring and insurance, law enforcement, migration, and the administration of justice): the obligations in Chapter III, Sections 1 to 3 now apply from 2 December 2027, instead of 2 August 2026.
• High-Risk AI systems under Annex I (AI embedded in products already covered by EU product safety legislation, such as medical devices, machinery, and toys): the deadline moves from 2 August 2027 to 2 August 2028.
• Two new prohibited AI practices target systems designed to generate or manipulate realistic non-consensual intimate imagery or child sexual abuse material. These prohibitions apply from 2 December 2026.
• Generative AI systems placed on the market before 2 August 2026 receive a transitional period for the machine-readable marking obligations of Article 50(2): they must comply by 2 December 2026.
• The Commission must publish guidance, including a voluntary template, on the Article 72 post-market monitoring plan by 2 September 2027, and several empowerments to adopt implementing acts (Articles 50(7), 56(6), 72(3)) were removed to simplify implementation.

What did not change

The Omnibus is a deferral of specific high-risk obligations, not a pause on the EU AI Act. Everything else stands:

• The prohibitions on unacceptable-risk AI practices have applied since February 2025.
• The general-purpose AI (GPAI) obligations, including transparency, reporting, and systemic risk obligations for the largest models, have applied since August 2025 and continue as planned.
• The bulk of the Article 50 transparency obligations for AI systems that interact with people or generate synthetic content have applied since 2 August 2026.
• The enforcement architecture is live: penalties of up to €35 million or 7% of global annual turnover, and the governance provisions empowering the AI Office and national authorities, took effect on schedule in August 2026.

Why the deadline moved

The recitals of Regulation (EU) 2026/1744 are explicit about the reason for the deferral: the harmonised standards, common specifications, and guidance that High-Risk AI providers were meant to rely on were not ready, and many national competent authorities had not been established. Maintaining the original date would have forced organisations to comply without the support instruments the EU AI Act assumes, at significantly increased cost.

That reasoning matters for how the extra time should be read. The deferral exists so that the compliance ecosystem can mature, not because the obligations became lighter. The requirements of Articles 9 to 18, from risk management through data governance, technical documentation, logging, transparency, human oversight, accuracy, and quality management, are unchanged in substance.

The updated EU AI Act timeline

What to do with the runway

Sixteen months sounds generous. For most organisations it is not. A conformity assessment for a High-Risk AI system is evidence work: risk management records, dataset documentation, technical documentation, logging architecture, oversight procedures, and a quality management system that all have to exist, cohere, and be provable. Documentation of how a system was designed, trained, and validated cannot be reconstructed retrospectively; if it is not being generated now, it will not exist when it is needed.

A realistic sequence for the time available:

• Classify now. Map every AI system in the portfolio against Annex III and Annex I. The classification determines which deadline applies and whether the system is in scope at all.
• Baseline the evidence. Assess existing documentation clause-by-clause against Articles 9 to 18. The most dangerous finding is not a known gap; it is false confidence, an area believed to be covered where the evidence is incomplete, inconsistent, or missing.
• Close the gaps that take the longest. Data governance records, logging infrastructure, and quality management systems have the longest lead times and the least tolerance for retrofitting.
• Keep the baseline current. Systems, models, and documentation change continuously between now and December 2027. A one-off gap analysis performed in 2026 will be stale by the deadline; reassessment has to be continuous.

This is the work Progressio.AI automates: clause-by-clause, evidence-based conformity assessment of High-Risk AI systems against the EU AI Act, producing a defensible baseline and tracking how it changes over time.