The AI Act after the Digital Omnibus: application dates, prohibitions and fundamental rights impact assessment

Starting point

The AI Act (Regulation (EU) 2024/1689, "Artificial Intelligence Act") regulates AI systems according to their risk: prohibited practices, high-risk systems, transparency obligations and general-purpose AI models. With the Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026), the EU has amended the Regulation. The amending Regulation was published in the Official Journal on 24 July 2026 and entered into force on the third day following its publication (Art. 4).

Application dates after the amendment

Under Art. 113 of the AI Act as amended:

• since 2 February 2025: general provisions and prohibitions under Art. 5 (Chapters I and II),
• since 2 August 2025: among other things, rules on general-purpose AI models, governance and penalties,
• since 2 August 2026: general date of application,
• from 2 December 2026: new prohibitions under Art. 5(1), first subparagraph, points (ba) and (bb) (see below); by that date, providers of systems generating synthetic content that were placed on the market before 2 August 2026 must comply with the marking obligation under Art. 50(2),
• from 2 December 2027: obligations for high-risk systems under Annex III (previously 2 August 2026),
• from 2 August 2028: obligations for high-risk systems that form part of products under Annex I (previously 2 August 2027).

The postponement is justified, among other things, by the delayed availability of harmonised standards and guidance (recitals of Regulation 2026/1744).

Prohibited practices (Art. 5)

Prohibited since February 2025 are, in particular, manipulative or deceptive techniques, the exploitation of vulnerabilities, social scoring, risk assessments of criminal offences based solely on profiling, and the untargeted scraping of facial images for facial recognition databases. In addition, there are prohibitions on emotion recognition in the workplace and in education institutions, biometric categorisation based on sensitive characteristics, and real-time remote biometric identification in publicly accessible spaces for the purposes of law enforcement, the latter subject to narrowly defined exceptions. The Commission published guidelines on these practices on 4 February 2025.

The Omnibus adds two prohibitions. From 2 December 2026, AI systems that generate or manipulate realistic intimate or sexually explicit depictions of an identifiable person without that person’s explicit consent are prohibited (point (ba)). Systems that generate child sexual abuse material are likewise prohibited (point (bb)). For providers, the prohibitions apply under Art. 5(1a) where such generation is the intended purpose of the system, or where it is a reasonably foreseeable and reproducible outcome without effective safeguards. Infringements of Art. 5 may be subject to fines of up to EUR 35 million or 7 % of total worldwide annual turnover (Art. 99(3)).

Fundamental rights impact assessment (Art. 27)

Art. 27 requires certain deployers of high-risk systems under Annex III to assess, before putting the system into use, the impact its use may have on fundamental rights. This applies to bodies governed by public law, private entities providing public services, and deployers of systems for creditworthiness assessment and for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). The assessment covers, among other things, the categories of persons affected, the specific risks of harm and the human oversight measures.

Following the amendment, deployers may refer to a data protection impact assessment already carried out (Art. 27(4)). The AI Office is developing a template for a questionnaire (Art. 27(5)). As Art. 27 forms part of the high-risk provisions, it applies from 2 December 2027 following the postponement.

Link to human rights

The AI Act is product safety legislation, but it also expressly protects fundamental rights. For companies with human rights due diligence processes, there are points of contact. This applies, for example, to AI in HR processes, in supplier assessment or in lending: risks of discrimination, surveillance or lack of transparency can be included in existing risk analyses. The obligation to promote AI literacy among staff (Art. 4) has also been reworded by the Omnibus. Providers and deployers must now take measures to support the development of this literacy.

What companies typically examine

1. Inventory: Which AI systems are developed or used, and which risk category do they fall into?
2. Prohibitions: Can it be ruled out that systems in use fall under Art. 5, including the new points (ba) and (bb)?
3. Role: Is the company a provider or a deployer, and does its role change as a result of modifications to the system?
4. Deadlines: Which obligations apply from December 2027 or August 2028?
5. Integration: Can fundamental rights, data protection and human rights risk analyses be aligned with one another?

This post provides a general overview of the legal position and does not replace legal advice on individual cases.

← All posts