The Digital Omnibus on AI is now a final regulation. Deployers should replace negotiation-stage assumptions with a record of which rules apply to each system. Start with your role and the system's classification. Identify the relevant provision and application date. Keep that legal review separate from the pilot decision. A later deadline does not show readiness for customer data.
EU AI Act after the Digital Omnibus: what changed for deployers?
The final amendment changes the timetable and AI-literacy wording. Update the applicability record, then test the evidence your workflow needs.
What changed in the final text?
Regulation (EU) 2026/1744 was published on 24 July and entered into force on 27 July 2026. The table identifies selected changes, not the full amendment.
| Provision | Final position | Review action |
|---|---|---|
| Chapter III, Sections 1-3, except Article 6(5) | Annex III high-risk systems: 2 December 2027. Annex I high-risk systems: 2 August 2028. | Record the classification and applicable exceptions. |
| Article 4 | Providers and deployers must take measures to support the development of AI literacy. No individual literacy level is guaranteed. | Update the training-policy wording and owner. |
| Article 50(2), via Article 111(4) | Providers of covered systems on the market before 2 August 2026 have until 2 December 2026 for machine-readable marking. | Check provider role and eligibility. This is not a blanket Article 50 delay. |
| Article 26 | Its text is not amended by this regulation. Application timing depends on the high-risk category. | Keep deployer duties in the review of which rules apply. |
What should the deployer put in the review file?
Keep the supplier's intended-use statement beside your actual workflow description. Identify who chooses the purpose, who operates the system and who may change it. Ask legal counsel to resolve uncertain classification or role changes before relying on a date.
For an applicable high-risk system, Article 26 covers use according to instructions, human oversight, monitoring and controlled logs. Confirm the details and exceptions in the legal text.
Then make the procurement file usable: name the evidence owner, identify the source records and state who can retrieve them. These are practical review steps, not a claim that completing a checklist meets the Act.
Which pilot tests remain useful now?
Select one task using test data with no real customer information. Write down the permissions it requires. Test a permitted action and an action that should be refused. Check the receiving system independently. Preserve the record of both outcomes.
For a Vantage evaluation, request evidence for the exact software version and integration under discussion. Include which AI model service receives the data and where it runs. Record missing proof as an open condition. A framework label, presentation or new document date cannot substitute for a measured workflow result.
How should we maintain the decision as guidance changes?
Keep a dated source register with the legal provision, reviewer and next review date. Link the register to the system inventory so that a changed purpose or integration triggers another review.
Avoid copying the same regulatory summary into separate policy packs. Assign one owner to the record of which rules apply. Link other documents to it. Keep earlier versions available so a later reviewer can see what the team relied on at the time.
Which sources inform this review?
Frequently asked questions.
Is this still a proposed change?
No. Use the final regulation cited above and retain the date of your legal review.
Does every workplace AI system have the same deadline?
No. Establish the system's classification, your role and the applicable provision before relying on a date.
Can we stop preparing evidence while a deadline is later?
A procurement team still needs a basis for accepting operational risk. Define the records needed for the planned use and test whether they can be retrieved.
Does a Vantage pilot establish compliance with the Act?
No. A pilot can supply scoped observations. Legal applicability and the organisation's obligations need their own review.
Further reading
CONTINUE THE CONVERSATION
If something here is what you're working on, talk to us.
Articles like this one come out of conversations with practitioners, security leaders, and engineering teams in regulated industries. If the writing reflects your situation, the next conversation is probably worth having.
Continue the conversation →Or write to hello@handvantage.com directly.