Digital Omnibus on AI: the amendments to the AI Act and what they leave in place
Category Regulation
Published AIAssuranceLabs
This post reads the amendments that Regulation (EU) 2026/1744, the Digital Omnibus on AI, made to Regulation (EU) 2024/1689, article by article, from the consolidated text as it stands after the Omnibus entry into force In force. The Omnibus moved application dates and reworded the scope, literacy, data, registration and transparency provisions; it removed no high-risk requirement. A provider or deployer uses the list to re-date its obligation register and to re-run classification where the scope wording changed.
What the source says
The scope amendments sit in Art. 2, Art. 6 and Annex I. The new Art. 2(2) reads that for high-risk systems related to products under Annex I Section B "only Article 6(1), Article 60a and Articles 102 to 112 shall apply"; the previous text named Art. 102 to 109 and Art. 112. The regulation entry for the machinery change records that the Omnibus "deleted Annex I Section A point 1 (Directive 2006/42/EC on machinery) and added Regulation (EU) 2023/1230 as Annex I Section B point 21". Inserted Art. 6(1a) excludes from safety components the systems used solely for non-safety aspects such as user assistance, performance optimisation or quality control, and Art. 6(1b) keeps in the systems "the failure or malfunctioning of which would endanger health and safety". Art. 4(1) now requires providers and deployers to "take measures to support the development of AI literacy" and states that no specific level of any individual is owed.
The data amendments move the legal basis for special-category data. Art. 10(5) is deleted, and Art. 10(1) and 10(6) now point to the quality criteria in Art. 10(2) to (4) "and in Article 4a(1)". Inserted Art. 4a(1) opens with "To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g)" and lists conditions (a) to (f), the first being that the purpose "cannot be effectively fulfilled by processing other data, including synthetic or anonymised data". Art. 4a(2) extends the basis to other providers and deployers on the same safeguards and closes with "This paragraph does not create any obligation to conduct such bias detection and correction." The Art. 10 record shows the necessity threshold as a decided point with both readings. For an Annex III system assessed as not high-risk, the regulation entry records that the Omnibus "kept Art. 6(4) documentation duty and Art. 49(2) registration" and deleted Annex VIII Section B points 7 and 9.
The deployer and transparency amendments are narrower. Art. 27(4) now lets a deployer "include cross-references to the relevant sections" of a data protection impact assessment under Art. 35 of Regulation (EU) 2016/679, where the previous text only required the two assessments to complement each other; Art. 27(5) requires the AI Office template to allow this. The wording of Art. 50(1) to (4) is unchanged. New Art. 111(4) grants providers of systems "generating synthetic audio, image, video or text content" that were on the market before the Art. 50 date a grace period to "comply with Article 50(2)". Art. 50(7) names the Commission, in place of the AI Office, as the body that "shall assess whether adherence to those codes of practice is adequate" for Art. 50(2) and (4). Art. 5(1) gains points (ba) and (bb) with paragraphs (1a) and (1b), which Art. 113(a) carves out of the Chapter II date.
| Provision | Amendment | Applies from |
|---|---|---|
| Art. 2(2) and Annex I Section B | Only Art. 6(1), Art. 60a and Art. 102 to 112 apply to Section B systems; Regulation (EU) 2023/1230 is Section B point 21. | In force |
| Art. 4(1) to (3) | The duty is to support the development of AI literacy; no level of any individual is owed. | Amended wording from In force; the duty from In force |
| Art. 4a and Art. 10(5) | Art. 10(5) is deleted; the legal basis for special-category data in bias detection is Art. 4a(1)(a) to (f), extended by Art. 4a(2). | In force |
| Art. 5(1)(ba), (bb), (1a) and (1b) | Two prohibitions are inserted, with technical safety measures for systems that can generate the prohibited content. | Deferred |
| Art. 6(4), Art. 49(2) and Annex VIII Section B | The Art. 6(3) documentation and registration duties are kept; Section B points 7 and 9 are deleted. | Amendment from In force; the date the registration duty bites for an Art. 6(3) system is an unsettled point on the regulation page |
| Art. 27(4) and (5) | Data protection impact assessment sections may be cross-referenced or included; the AI Office template must allow it. | With Chapter III Section 3 under Art. 113(c); the FRIA date is a decided point with an alternative reading on the Art. 27 page |
| Art. 50(7) and Art. 111(4) | The Commission assesses code-of-practice adequacy for Art. 50(2) and (4); systems already on the market get a grace period for Art. 50(2). | Deferred for the grace period; In force for the Art. 50 duties |
| Art. 57(1) | The national sandbox operational date is moved; the AI Office may establish a Union-level sandbox. | Deferred |
| Art. 75 and Art. 75a to 75d | The AI Office is exclusively competent for systems built on a general-purpose AI model by the same provider, with listed exceptions; supervisory powers are added. | General application date, unchanged: In force |
| Art. 113(c) and (d) | Chapter III Sections 1, 2 and 3 apply from two dates set by classification route; Art. 102 to 110 apply from the Omnibus entry into force. | Deferred for Annex III; Deferred for Annex I |
The content of the high-risk requirements is what the Omnibus left in place. In Chapter III Sections 2 and 3, the consolidated text shows no amendment to Art. 9, Art. 12 to 16, Art. 18 to 24 or Art. 26; Art. 11(1) and Art. 17(2) extend the simplified documentation form and the proportionality clause to small mid-cap enterprises, and Art. 25(2) and (4) spell out the information, technical access and assistance an initial provider or an upstream supplier owes a provider. The regulation entry for the Annex III date states that the obligations "are unchanged in content". Art. 50(1) to (4) and their date are unchanged, and Art. 53 to 55 carry no amendment. The fine tiers in Art. 99(3) to (5) are unchanged in amount and percentage; the Omnibus inserted point (da) in Art. 99(4) for the duties under Art. 25(2) and (4) and Art. 99(6a), which caps a small mid-cap enterprise's fine at the lower of the percentage or the amount. Each amendment and its source are logged in the regulation changelog.
What changes for a provider or deployer
The obligation register is the first record to re-date: a register built before the Omnibus holds rows for Art. 9 to 26 whose dates now depend on the classification route, and a row for Art. 4 whose wording changed. PR-CLS v1.0 step 7 records the entry id per date and step 39 compiles the register; the register specification requires the changelog entry the register was built against. The provider vs deployer guide gives the role determination that decides which article set each row belongs to.
Classification is the second. Three amendments change a classification result: Annex I Section B for machinery, Art. 6(1a) and (1b) on safety components, and Annex VIII Section B on the Art. 6(3) registration entry. PR-CLS v1.0 step 12 records the Annex I route, step 17 checks the Art. 6(4) documentation and step 18 compares the registration entry with Annex VIII Section B points 1 to 6 and 8. The classification and readiness assessment service runs the protocol and delivers the classification memo and the register within the limits stated at what we cannot do; the memo is a reasoned technical assessment for discussion with counsel.
Three evidence records change with the wording. The Art. 10 record names a bias detection legal-basis record under Art. 4a(1)(f) and a safeguards and deletion record under Art. 4a(1)(b) to (e); both cite Art. 4a rather than the deleted Art. 10(5). For a generating system on the market before the Art. 50 date, PR-CLS v1.0 step 37 records the Art. 111(4) legacy status, which sets the date the marking test report under Art. 50(2) is due against. The Art. 27 record adds a testable element: each cross-reference to a data protection impact assessment under Art. 27(4) resolves to a section that meets the Art. 27(1) element it is cited for.
What to do now
- Rebuild the obligation register with a regulation entry id on every row and the Omnibus changelog entry in its version line (PR-CLS v1.0 steps 7 and 39).
- Re-run the Annex I route for any AI component in machinery against the new Art. 2(2) and Art. 6(1a) and (1b) (step 12).
- For each Annex III system assessed as not high-risk, check the Art. 6(4) record and the registration entry against Annex VIII Section B points 1 to 6 and 8 (steps 17 and 18).
- Where bias testing uses special-category data, re-cite the legal-basis and safeguards records to Art. 4a(1)(a) to (f) (Art. 10).
- For a generating system on the market before the Art. 50 date, record the Art. 111(4) status and date the Art. 50(2) marking test report against the grace period (step 37).
- Where a deployer's FRIA cross-references a data protection impact assessment under Art. 27(4), test each cross-reference against the Art. 27(1) element it stands for (Art. 27).
Related pages
The obligation records, the protocol, the guide, the service and the ICP hubs this post draws on are listed below from its frontmatter.
- Protocols
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.