The AI Act has already been amended before many of its provisions have even become applicable. We explain what the reform of the AI Act entails and which businesses stand to benefit from the changes.
What does the Digital Omnibus mean for the AI Act?
The AI Act is still relatively new, yet the EU has already undertaken a substantial revision. On 24 July 2026, Regulation (EU) 2026/1744, the Digital Omnibus Regulation on AI, was published in the Official Journal of the European Union and entered into force on 27 July 2026.
Contrary to what might have been expected, the requirements have not been tightened. Instead, they have been significantly relaxed in several important areas. At the same time, however, European-level supervision of AI has been considerably strengthened.
The key changes to the AI Act are set out below.
High-risk AI
The concept of high-risk AI will be narrower in future, while the obligations associated with such classification have been postponed.
A number of systems that would previously have fallen within the high-risk category will, as a general rule, no longer be classified as such. AI components used to support users, improve efficiency, automate processes or perform quality control will only be classified accordingly where their failure or malfunction could actually create risks to health or safety.
Correctly assessing the relevant risks will therefore become significantly more important for organisations.
Affected organisations have also been given considerably more time to comply. The original deadline of August 2026 has been postponed until at least 2 December 2027. Where the products concerned are regulated under Annex I to the Regulation, the deadline is later still: 2 August 2028.
Overlapping regulation
In future, there should be less duplication between product-safety legislation and the AI Act.
The European Commission will be able to limit the application of certain AI Act requirements where sector-specific legislation already provides an equivalent or higher level of protection. Conformity assessment procedures are also intended to be more closely integrated with existing product legislation.
These changes are likely to be particularly relevant in highly regulated sectors, notably medical devices, mechanical engineering, the automotive industry and aviation.
The aim is to reduce duplicate assessments and redundant documentation requirements without lowering the applicable level of protection.
AI literacy
Until now, there has been uncertainty as to what level of AI literacy businesses must ensure among their staff.
In future, providers and deployers of AI systems will only be required to take measures to promote AI literacy. It is expressly clarified that they do not have to guarantee a particular level of knowledge on the part of individual employees.
In practice, training, awareness measures and internal policies on the use of AI will remain important. However, the risk of breaching the AI Act merely because an individual employee is considered to have an insufficient level of knowledge will be reduced.
The resulting possibility of adopting a risk-based approach to training is both an opportunity and a risk.
- Organisations have greater freedom to decide who should receive training and what that training should cover.
- At the same time, they also bear the risk of getting that assessment significantly wrong.
Whether the level of protection originally intended by the legislation can still be achieved under this approach is open to question. In practice, greater flexibility does not necessarily lead to more careful engagement with a subject. Other considerations, such as corporate objectives, costs and convenience, can quickly become decisive factors.
Data protection: legal bases
In connection with the detection and prevention of discrimination risks, it will become easier in general to process special categories of personal data for the purpose of identifying and correcting bias, provided that such processing is strictly necessary.
Naturally, a broader permission to process such data does not reduce other obligations under data protection law. Where processing is permitted, all associated data protection requirements must still be complied with.
Small mid-cap companies
A new category of undertaking is being introduced: SMCs, or small mid-cap companies.
This category covers businesses that have exceeded the traditional SME thresholds but are not yet considered large enterprises.
In future, some of the obligations applicable to SMCs will be aligned with those applicable to SMEs. The reforms provide for simplified technical documentation and simplifications concerning quality-management systems.
Affected businesses are also intended to receive preferential access to regulatory sandboxes and enhanced support from public authorities.
Their classification is also to be taken into account when determining penalties and fines, with greater emphasis being placed on the economic impact of enforcement measures.
Prohibited AI practices
AI systems designed to generate intimate deepfakes may no longer be offered or used without the explicit consent of the persons concerned. Systems designed to depict child sexual abuse are prohibited altogether.
Both prohibitions are subject to the qualification that generative AI services are only covered where they are either intended for such purposes or where the relevant use is reasonably foreseeable and no safeguards are in place.
These prohibitions will apply from 2 December 2026.
AI Office
The simplifications introduced by the reform are accompanied by significantly stronger supervision and more effective enforcement powers in relation to the obligations that remain.
The AI Office will receive additional resources, new responsibilities and extensive new investigative powers. These powers must, of course, be exercised proportionately and remain subject to judicial review.
The AI Office will, for example, be able to request extensive information and, ultimately, carry out enforceable on-site inspections.
Conclusion
With the reform of the AI Act, the EU is clearly seeking to reduce regulatory burdens on businesses and make compliance with the remaining obligations more practicable.
At the same time, however, a significantly stronger central supervisory structure is being established at EU level.
Overall, the reform should therefore not be understood as less regulation, but rather as more targeted and more effective regulation.
