Simplification of the implementation of harmonised rules on artificial intelligence – Digital Omnibus on AI (Omnibus VII)

Regulation (EU) 2026/1744 amends the Artificial Intelligence Act, Regulation (EU) 2024/1689, together with the civil aviation Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230. It aims to simplify and clarify the implementation of harmonised rules on artificial intelligence (AI), reduce unnecessary duplication and compliance burdens, and maintain protection of health, safety and fundamental rights. The Regulation was adopted following Parliament’s position of 16 June 2026 and the Council decision of 29 June 2026.

Simplified requirements and support for businesses

The Regulation introduces definitions for small and medium-sized enterprises (SMEs) and small mid-cap enterprises (SMCs) and extends several simplified compliance measures to SMCs. SMEs, start-ups and SMCs may use simplified technical documentation for high-risk AI systems. SMEs without partner or linked enterprises may also comply with certain quality-management requirements in a simplified way.

Providers and deployers must take measures to support AI literacy among staff and persons operating AI systems on their behalf. They are no longer required to guarantee a particular level of AI literacy for each individual. The Commission and Member States must support these efforts, particularly for SMEs, while the European Artificial Intelligence Board must issue recommendations on common objectives.

The definition of a safety component is clarified. AI systems used only for user assistance, performance optimisation, service efficiency, automation, convenience, or quality control are not safety components, unless their failure or malfunction could endanger health and safety. This narrows the circumstances in which product-related AI systems are classified as high-risk.

For high-risk AI systems covered by specified Union product legislation, the Commission may limit certain Artificial Intelligence Act requirements where sectoral legislation provides an equivalent or higher level of protection and the overall level of protection is not reduced. The Commission must adopt delegated acts specifying such cases by 2 August 2027.

Data, prohibited practices and compliance arrangements

Providers of high-risk AI systems may exceptionally process special categories of personal data where strictly necessary to detect and correct bias and subject to strict conditions. These include the absence of an effective alternative, technical limits on reuse, security and privacy measures, restricted access, no disclosure to third parties, deletion when no longer needed, and documented necessity. This possibility is also extended to providers and deployers of other AI systems and models, and to deployers of high-risk systems, where bias may harm health, safety or fundamental rights or result in prohibited discrimination.

The Regulation prohibits placing on the market, putting into service, or using AI systems that generate or manipulate realistic non-consensual intimate material involving identifiable persons, as well as child sexual abuse material or performances, subject to the applicable national law “without right” defence. For providers, the prohibition applies where this is the intended purpose or a reasonably foreseeable and reproducible outcome without reasonable and adequate safeguards. For deployers, it applies where the system is used for that purpose. The rules exclude, among other cases, consensual content, certain lawful medical uses, accidental generation, and manipulations that do not increase exposure of intimate parts or alter sexually explicit activity.

The Regulation facilitates combined conformity assessments and a single application procedure for notified bodies operating under the Artificial Intelligence Act and relevant Union product legislation. It requires the Commission to seek common standardisation deliverables and recognises, under specified conditions, compliance with cybersecurity requirements under the Cyber Resilience Act. It also streamlines registration requirements for certain systems that are not considered high-risk.

Innovation, testing and supervision

Member States must ensure that at least one national AI regulatory sandbox is operational by 2 August 2027. The European Artificial Intelligence Office may establish a Union-level sandbox for systems under its supervisory remit, with priority access for SMEs, start-ups and SMCs. Sandbox plans may include real-world testing plans.

Real-world testing outside sandboxes is extended to high-risk systems covered by product legislation in Annex I, Section A, of the Artificial Intelligence Act. Member States may also authorise such testing for AI-enabled products under Annex I, Section B, if they establish and notify a testing framework that includes mandatory testing plans, effective governance and safeguards for health, safety, and fundamental rights.

The Artificial Intelligence Office receives expanded exclusive supervisory and enforcement competence for certain AI systems based on general-purpose AI models developed within the same undertaking, and for systems constituting or integrated into very large online platforms or very large online search engines. Exceptions apply, notably to certain product-related, law-enforcement, border-management, financial and justice systems.

The Office may investigate, request information and system access, conduct remote and on-site inspections, accept binding commitments, order corrective action, impose fines and periodic penalty payments, and recover enforcement costs. Periodic penalty payments may not exceed 5% of average daily income or worldwide annual turnover in the preceding financial year per day. Operators benefit from procedural safeguards, including rights of defence and access to the file. National market-surveillance authorities and authorities protecting fundamental rights must cooperate with the Office and each other.

Sectoral alignment and application dates

For machinery, the Regulation moves the Machinery Regulation from Section A to Section B of Annex I to the Artificial Intelligence Act. The Commission must integrate relevant AI health and safety requirements into the Machinery Regulation by delegated acts applying by 2 August 2028. Civil aviation rules are amended to ensure that relevant delegated and implementing acts take account of high-risk AI requirements.

The application of the main high-risk AI requirements is postponed to 2 December 2027 for systems listed in Annex III and to 2 August 2028 for product-related systems under Article 6(1) and Annex I. The new prohibitions concerning non-consensual intimate material and child sexual abuse material apply from 2 December 2026. Providers of synthetic-content systems already on the market before 2 August 2026 must comply with content-marking obligations by 2 December 2026.

The Regulation entered into force on 27 July 2026, three days after its publication in the Official Journal on 24 July 2026. It is binding in its entirety and directly applicable in all Member States.

This summary was AI-generated and human-reviewed.