Contents6
On 24 July 2026, the Official Journal of the European Union published Regulation (EU) 2026/1744, signed on 8 July, which amends the AI Act. This text, part of the simplification package known as the “Digital Omnibus”, has been in force since 27 July 2026. It does not rewrite the regulation: it moves some dates, relaxes a few obligations and adds others.
This article from our Business AI section compares the text before and after, based on the consolidated version published by the Commission’s service desk. It is not legal advice: for a sensitive use, your DPO or a lawyer has the final say. What all of this concretely asks of a business that uses AI is gathered in our guide to the AI Act and the GDPR for SMEs.
In short
The rules for high-risk systems are postponed: 2 December 2027 for recruitment, staff management or credit, 2 August 2028 for AI built into regulated products.
The AI literacy obligation becomes a best-efforts obligation, with no individual level to guarantee.
Two prohibitions are added from 2 December 2026, and generative tools already on the market have until that date to mark their content.
Mid-sized companies, up to 750 people, now benefit from relief that used to be reserved for SMEs.
The GDPR and cookies part of the same package is a separate text, still under negotiation.
When does Regulation 2026/1744 apply?
The procedural dates are those of the text’s official data on EUR-Lex: signed on 8 July 2026, published in the Official Journal on 24 July, in force on 27 July. The Commission’s service desk updated its official timetable straight away:
The Commission’s timetable states that it “takes into account the AI Act amendments introduced by Digital Omnibus on AI”. Captured on 19 October 2026.
What changed, article by article?
Six changes matter for a business that uses AI or has it developed. For each, the text before and after the revision:
- High-risk, Annex III (Article 113): before, 2 August 2026; after, 2 December 2027. This covers recruitment, staff management, credit scoring and the pricing of certain insurance.
- High-risk, Annex I (Article 113): before, 2 August 2027; after, 2 August 2028, for AI built into products that are already regulated (medical devices, toys or lifts, for example).
- AI literacy (Article 4): before, ensure “to their best extent” a sufficient level of AI literacy; after, take “measures to foster” that literacy, with no obligation to guarantee an individual level. The Commission must publish practical examples.
- Prohibited practices (Article 5): two prohibitions are added from 2 December 2026, on intimate images of an identifiable person generated without consent and on child sexual abuse material.
- Marking of generated content (Article 111): tools placed on the market before 2 August 2026 have until 2 December 2026 to apply the marking required by Article 50.
- Mid-sized companies (Articles 3 and 99): a new category, the “small mid-cap”, receives relief that used to be reserved for SMEs, including fines capped at the lower of the two amounts provided for.
According to the analysis by law firm Orrick, this category covers companies that are not SMEs, have fewer than 750 employees and a turnover of up to 150 million euros or a balance sheet of up to 129 million euros. Many companies of 250 to 500 people fall into it. The same text gives the AI Office oversight of systems built on a general-purpose model by the same provider, opens a legal basis for processing sensitive data to detect bias, and narrows the definition of a safety component.
Key takeaway
What does not change
The prohibitions of February 2025, the rules for general-purpose models and the transparency obligations of 2 August 2026 stay in place: a chatbot must still present itself as one, unless that is obvious, and a deepfake must be disclosed.
The AI Act timetable after the revision
- 2 February 2025
Prohibited practices and AI literacy.
- 2 August 2025
Rules for general-purpose AI models and penalties.
- 2 August 2026
General application, including Article 50 transparency and enforcement powers over general-purpose models.
- 2 December 2026
Two new prohibitions; end of the marking grace period for generative tools already on the market.
- 2 August 2027
At least one regulatory sandbox per Member State; compliance deadline for general-purpose models released before 2 August 2025.
- 2 December 2027
High-risk rules of Annex III.
- 2 August 2028
High-risk rules of Annex I.
These dates come from the Commission’s timetable and the consolidated Article 113. The nearest deadline, 2 December 2026, has its own article: marking AI-generated content.
Have the GDPR and cookie rules changed too?
Not yet. The Digital Omnibus proposed by the Commission also contained a GDPR and cookies part (definition of personal data, legitimate interest for AI, consent banners). It was split from the AI part. On 24 September 2026, it was still at first reading, with more than 1,750 amendments tabled in the European Parliament and no Council negotiating mandate, according to Acompli. The Council had still not announced a mandate by mid-October, notes the NicFab newsletter of 13 October. Until then, the GDPR and national cookie rules apply as they stand.
What it changes for a team of 20 to 500 people
Postponing the high-risk rules buys time, not an exemption. Article 22 of the GDPR already governs fully automated decisions, and a recruitment or scoring tool is often chosen more than a year before it goes live: now is the time to ask the vendor how it plans to comply. The stakes are detailed in automated decisions by AI on dismissals or credit and the human role in the face of AI judgement.
Relaxing AI literacy does not remove training: it turns it into an approach you can show rather than a level to certify. A policy and a record of who was trained are enough to start, as our guide to enterprise AI governance suggests; the overall approach is in our guide to integrating AI in a business.
From the field
Our AI Act guide for SMEs, published on 11 October 2026, was written on the consolidated text after the revision, and the same source, the Commission’s service desk, is the reference for every regulatory article on this blog. Each one starts as a draft and is only published after a human review that rechecks the dates against the official text.
The rest of the month’s regulatory and technical news is in our October AI news for leaders, from Meta’s terms on crawling websites to the postponed NIS2 law in France. To find out which of your uses come close to high risk and which can stay with a provider, see our AI at the right cost offer.
Frequently asked questions
What did the Digital Omnibus change in the AI Act?
Regulation (EU) 2026/1744 postpones the high-risk rules to 2 December 2027 for Annex III and 2 August 2028 for Annex I, turns AI literacy into a best-efforts obligation, adds two prohibitions from 2 December 2026, gives existing generative tools until that date to mark their content and extends relief to mid-sized companies.
Are the transparency obligations of 2 August 2026 postponed?
No. Article 50 has applied since 2 August 2026: a chatbot must present itself as one unless that is obvious, and a deepfake must be disclosed. Only the technical marking of content by tools already on the market before that date benefits from a grace period, until 2 December 2026. The penalties of Article 99 remain applicable.
Is my 400-person company a “small mid-cap”?
It is likely: with 400 people it is no longer an SME in the European sense, and it falls into the category if its turnover is up to 150 million euros or its balance sheet up to 129 million euros. It then benefits from simplified documentation and fines capped at the lower of the two amounts. Check the exact criteria of Recommendation (EU) 2025/1099 with your accountant.
Do teams still need AI training?
Yes. The revised Article 4 still asks providers and deployers to take measures to foster AI literacy among their staff, but without guaranteeing an individual level. A written approach, a policy and a record of who was trained and when remain the best evidence. The Commission is due to publish practical examples to help businesses.
Sources
- The text’s official data on EUR-Lex (new tab)eur-lex.europa.eu
- Take “measures to foster” (new tab)ai-act-service-desk.ec.europa.eu
- The analysis by law firm Orrick (new tab)orrick.com
- The Commission’s timetable (new tab)ai-act-service-desk.ec.europa.eu
- The consolidated Article 113 (new tab)ai-act-service-desk.ec.europa.eu
- Acompli (new tab)acompli.ie
- The NicFab newsletter of 13 October (new tab)nicfab.eu
Jim · founder of Brain Plus AI
Also in business ai
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.
Practical guide7 min
AI-generated content: mandatory marking by 2 December
Since 2 August 2026, the AI Act requires images, video, audio and text generated by AI to be marked, and tools already on the market have until 2 December 2026 to comply. Who marks, who discloses, what the European code of practice recommends and what a detector really proves.
Stepping back10 min
The human role alongside AI: knowing how to judge
AI excels at some tasks and is confidently wrong on neighbouring ones. The human's value shifts: knowing where the line runs, keeping your judgement, answering for the result.