Brussels: The AI Act omnibus is now in force, and it rewrites the timetable for the world’s first comprehensive AI law just weeks before the original August 2026 deadlines would have bitten. Published in the Official Journal as Regulation (EU) 2026/1744 in July 2026, it amends Regulation (EU) 2024/1689 and gives companies more time on high-risk systems while adding new bans. Two of its dates fall on 2 December 2026, so compliance teams have little breathing space.

What the AI Act omnibus changes on deadlines

The biggest shift concerns high-risk systems listed in Annex III. Their obligations move from 2 August 2026 to 2 December 2027. Under the AI Act omnibus, systems placed on the market before that date are caught only if they are substantially modified afterwards, which gives existing products a long grace period.

Systems covered by Article 6(1) and Annex I, which are AI components of regulated products, now face 2 August 2028 under the AI Act omnibus. Providers and deployers of AI for public authorities have until 2 August 2030. The spread of dates in the AI Act omnibus shows how unevenly ready the standards, the supervisors and the industry were.

New bans on nudifier apps and abuse imagery

Not everything is delayed. The AI Act omnibus adds new Article 5 prohibitions on AI that generates or manipulates realistic non-consensual intimate imagery, including so-called nudifier apps, and on child sexual abuse material. These bans apply from 2 December 2026, well ahead of the high-risk rules. The child abuse ban is subject to a “without right” defence under national law.

The transparency duty in Article 50(2) follows the same date for older products. Providers of systems placed on the market before 2 August 2026 that generate synthetic audio, image, video or text must comply by 2 December 2026. Anyone shipping generative tools in Europe should treat that as the real near-term deadline.

Small mid-caps, bias detection and enforcement

The text creates a new category of small mid-cap companies. These are firms that are not SMEs, employ fewer than 750 people, and report turnover of €150 million or less or a balance sheet total of €129 million or less. They receive SME-style relief, including simplified documentation, sandbox access and tailored penalty caps.

Article 10(5) now extends the GDPR legal basis for processing special category data to bias detection and correction, under a strict necessity test. Crucially, it creates no duty to run bias detection. That balance reflects a long-running tension between data protection and fairness testing.

On enforcement, Article 75 gives the AI Office exclusive supervision of systems built on a general-purpose AI model from the same provider or group. It also covers AI integrated into very large online platforms and search engines under the Digital Services Act. The Office can recover costs for established non-conformities, which signals a more active Brussels role.

Narrower scope and unified standards

The definition of a safety component in Article 3(14) is narrowed to systems whose intended purpose is preventing or mitigating risks to health and safety. Systems used only for optimisation or convenience fall outside Article 6. The Machinery Regulation moves from Section A to Section B of Annex I, which reduces overlapping duties, and a delegated act is due by 2 August 2028.

Article 40(2) asks the Commission to request unified standards from European standards bodies that serve both the AI Act and existing product law. If those standards arrive late, the extra time bought by the omnibus will be spent waiting rather than preparing.

What happens next

My assessment is that the AI Act omnibus buys time without removing the work. Three markers matter: the first conformity guidance from the AI Office, the standardisation requests under Article 40(2), and the enforcement posture after 2 December 2026. Companies that treat the delay as a pause risk meeting the new bans and transparency duties unprepared, while those that use it to build documentation will find the AI Act omnibus a genuine opportunity.