Digital Omnibus: what changes in the EU AI Act, what doesn't

On Monday 27 July 2026, Regulation (EU) 2026/1744, better known as the Digital Omnibus, entered into force. It amends more than 40 articles of the EU AI Act, and the headlines are correspondingly loud: some are celebrating the end of AI regulation, others decry it as a sell-out. Both are wrong. The Omnibus postpones and fine-tunes, but it doesn't dismantle. Here is a sober assessment for freelancers and small businesses.

What is the Digital Omnibus anyway?

The Digital Omnibus is the European Commission's package for cutting red tape in its digital laws, presented in November 2025. What matters for context: it consists of two separate strands that are often lumped together. Only one of them is law in force.

The AI strand went through so quickly because of hard deadline pressure: under the old timetable, the high-risk obligations would have kicked in on 2 August 2026. So the postponement had to be in force before then. The data strand with the GDPR and cookie changes is under no such pressure and is accordingly still stuck in the legislative process.

The bottom line: postponed, softened, unchanged

The left column is the more important one: everything that affects small companies in their day-to-day business continues to apply or started as planned. The prohibitions and the AI literacy obligation have been in force since February 2025, and the transparency obligations under Article 50 have applied since 2 August 2026. The Federal Network Agency (Bundesnetzagentur) has started work as the market surveillance authority. What was postponed is mainly what only affects high-risk applications anyway.

Change 1: The high-risk deadlines move back

The obligations for high-risk AI under Annex III (such as scoring job applicants, credit checks or AI in critical infrastructure) now apply from 2 December 2027 instead of 2 August 2026, i.e. 16 months later. For high-risk AI built into regulated products such as machinery or medical devices (Annex I), the deadline was moved from 2 August 2027 to 2 August 2028. If you deploy or develop high-risk systems, this gives you real breathing space, but you should use it, because the package of obligations covering risk management, documentation, logging and human oversight is still extensive.

Change 2: Article 4 now requires promoting instead of ensuring

The wording of the AI literacy obligation under Article 4 has been softened: instead of having to "ensure" a sufficient level of AI literacy in your team, you now have to take measures to promote AI literacy. You no longer owe a guaranteed level of knowledge for each person. What remains: doing nothing at all also violates the new version, and from August 2026 the supervisory authority can ask for proof. Our article on the AI literacy obligation explains what sensible training includes and how to document it.

Change 3: High-risk is defined more narrowly

Besides the deadlines, the Omnibus has also made the classification itself more precise. AI components that only provide support, make processes more efficient or serve quality control will in future only count as high-risk if their failure can actually cause risks to health or safety. In addition, the Commission may reduce double regulation where sectoral rules (for example in machinery or medical devices law) already ensure an equivalent level of protection. For many borderline cases, this means the likelihood of accidentally ending up in the high-risk category goes down.

Change 4: Relief for smaller companies

The Omnibus introduces a new company category, small mid-caps, extending to them relief that was previously reserved for small and medium-sized enterprises (SMEs): simplified technical documentation, leaner quality management requirements, priority access to regulatory sandboxes and the principle that penalties must be proportionate to company size. For the cap on fines for SMEs, which already applied, this means the framework becomes even more predictable for smaller companies.

By the way: new prohibitions were added too

Anyone who reads the Omnibus as a pure rollback overlooks the other direction: the list of prohibited practices has been extended. Newly prohibited are AI systems for generating intimate deepfakes without the consent of the person depicted (applicable from 2 December 2026) and systems for generating child sexual abuse material. At the same time, the European AI Office has been expanded into a genuine supervisory authority with its own investigative and enforcement powers. So regulation is not getting weaker, it is getting more targeted.

And the data protection part? Not adopted yet

The second Omnibus strand aims to simplify the GDPR and the ePrivacy rules: uniform cookie rules directly in the GDPR (a new Article 88a is meant to curb the flood of banners), merged reporting obligations, easier access to data for AI training and a possible redefinition of personal data in the case of pseudonymisation. None of this is law yet. The negotiations are considered difficult, the European Data Protection Board has raised serious concerns, and it is unclear whether an agreement will still be reached in 2026. In concrete terms: your cookie banner remains mandatory, and your GDPR processes stay as they are.

What you should do now

• Don't drop anything that already applies: The prohibitions, Article 4 and the GPAI obligations continue to apply unchanged.
• Take 2 August 2026 seriously: Label chatbots in customer contact, implement deepfake labelling and be prepared for the Federal Network Agency to request information.
• Use the extra high-risk time: The end of 2027 sounds far away, but risk management and documentation need lead time. Classify now, then plan.
• Don't bet on the Data Omnibus: Cookie banners and GDPR obligations apply until something is actually adopted.

How Klaus handles legal changes like this one

The Digital Omnibus shows the basic problem with doing AI compliance on your own: no sooner have you worked out the legal position than it changes, this time in 40 articles at once. That is exactly what Klaus is built for. Behind Klaus is a legal team that analyses legislative changes like the Omnibus and works them straight into the assessment logic: into the risk classification, the deadlines for each topic and the tasks Klaus derives for you from them. The Omnibus changes are currently being incorporated in full into all Klaus assessments.

For you, this means you don't have to read EUR-Lex or rework your to-do list yourself. If you have an assessment project running, just carry on. The changed deadlines and the narrower high-risk definition will in future be built into the assessments themselves. And because the Omnibus has also shifted the content of the AI literacy obligation, the Klaus training courses reflect the new Article 4 as well.

Conclusion

The Digital Omnibus is neither the end of the EU AI Act nor a reason to sound the all-clear. It pushes back the most expensive area of work (high-risk), makes classification more precise and eases the burden on smaller companies. It changes nothing about the obligations that already affect you today. If you use the time gained for your inventory, labelling and training instead of wasting it, you'll come out of this reform a winner.