News & Press

The Digital Omnibus on AI is in force: what moved, and what did not

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It defers the full high-risk regime. It does not defer the parts of the AI Act that are already being enforced.

The high-risk obligations — risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness — now apply from 2 December 2027 for standalone systems in the Annex III areas, and from 2 August 2028 where the high-risk AI is embedded in a product already covered by EU product legislation. Two tracks, two dates, and which one applies turns on how the system reaches the market rather than on what it does.

The deferral is narrow. The prohibited practices and the AI literacy duty have applied since 2 February 2025. The obligations for general-purpose AI models have applied since 2 August 2025. The transparency duties in Article 50 have applied since 2 August 2026, and the marking and machine-readable labelling of synthetic content under Article 50(2) follows on 2 December 2026. None of those dates moved.

The Omnibus also adds to the list of prohibited practices, with two further prohibitions applying from 2 December 2026. So the same instrument that pushed one set of duties back brought another set forward.

The penalties are unchanged: up to €35 million or 7% of total worldwide annual turnover for the prohibited practices, and up to €15 million or 3% for most other infringements, whichever is higher.

The practical reading is that the calendar changed and the work did not. Technical documentation, data governance records and oversight logs are evidence that has to be produced while a system is being built and run; it is not reconstructable afterwards from an empty file. A later deadline moves when the evidence is inspected, not when it has to start existing.

Germany names its AI supervisors — and it is not one authority

The German AI Act Implementation Act (KI-MIG) came into force on 29 July 2026. Market surveillance is split, and which authority is on the other side of the table depends on the sector.

The Bundesnetzagentur is the central market surveillance authority for AI outside the regulated sectors, and hosts the coordination centre KoKIVO. For most sectors — energy, health, technology, real estate — that is the authority in question.

BaFin holds a sector-specific mandate, limited to AI used in direct connection with a regulated financial activity. That limit matters in both directions. A bank deploying AI in a lending decision is dealing with BaFin. The same bank running an AI tool that has nothing to do with a regulated activity is not automatically in that perimeter, and a manufacturer outside financial services is not in it at all.

This is worth stating plainly because the shorthand "BaFin is now the AI supervisor" has been circulating, and for four of the five sectors we cover it names the wrong authority.

Separately, BaFin published guidance on 18 December 2025 on ICT risks in the use of AI at financial entities. It is addressed to entities subject to Articles 5 to 15 of DORA, and its approach is that AI is an ordinary ICT asset rather than a separate regime: ICT risk is examined across the whole AI lifecycle — data acquisition, model development and provision, ongoing operation, and retirement — with particular weight on third-party ICT risk, since most AI capability arrives through a provider.

For a financial entity already running DORA ICT risk management, that framing is good news about structure and neutral news about workload. The register, the third-party assessments and the incident path already exist; what changes is that models and their suppliers belong inside them.

Obligations now mapped across five industries

Financial services, energy, healthcare and life sciences, technology and software, and real estate each get their own view of which instruments apply, on what dates, and what evidence a regulator asks to see.

The same instrument lands differently depending on the sector reading it. A hospital and a housing company are both looking at the EU AI Act and the GDPR, and almost nothing about their obligations looks alike once the sector-specific layer — MDR, DORA, NIS2, the GEG — is put next to it. Presenting one generic compliance picture and leaving the reader to work out which parts are theirs is where most of the value leaks out.

Each industry view sets out four things: what the instruments say about systems in that sector and how classification is approached, the dates that bind, the evidence regulators ask for, and which parts of the platform produce that evidence.

Energy is the newest of the five and is deliberately the thinnest. Its regulatory scope and dates are mapped, and its authored control coverage is smaller than the four sectors that came first. Saying so is more useful than implying parity — a plan that looks complete when it is not is the failure mode this product exists to remove.

Nothing in those views classifies a particular system. Whether a given system falls inside a high-risk category depends on facts we do not hold, and Article 6(3) means that being listed in Annex III is the start of that assessment rather than the end of it.