🔒 Free Privacy App IT
← Observatory

AI Omnibus, new deadlines and a rewritten duty to train

On 27 July 2026 the AI Omnibus entered into force, that is Regulation (EU) 2026/1744 amending the AI Act. Almost every headline told the same story, namely that Europe is delaying and simplifying. That is only half true. Inside that text there is one change that affects every school, every company and every professional firm using artificial intelligence, and it is not the postponement of the high risk rules.

It is Article 4, the one on AI literacy. It was not repealed, it was rewritten, and it changed nature. In this Retoria Observatory piece we read the regulation for what it actually says, separating carefully what has moved, what stays identical and what has been added. This is informative material, not legal advice.

What the AI Omnibus is and why it arrives now

The AI Omnibus was born as part of the Digital Omnibus package proposed by the European Commission on 19 November 2025. The final text is dated 8 July 2026, it was published in the Official Journal of the European Union of 24 July 2026 and entered into force on the third day after that, so on 27 July. It does not amend only the AI Act, it also touches Regulation (EU) 2018/1139 on civil aviation and the Machinery Regulation (EU) 2023/1230.

The stated reason is practical rather than political. The harmonised technical standards needed to demonstrate the conformity of high risk systems were not ready, national governance frameworks were moving at different speeds and the compliance burden turned out heavier than expected, above all for smaller businesses. In short, the Union acknowledged that it was about to ask organisations to prove a conformity for which it had not yet supplied the measuring tools.

The point to hold on to is that the risk based structure has not been touched. The four classes are still there, namely unacceptable risk, high risk, limited risk and minimal risk. What changes is the when, not the what.

The new calendar, what moves and what does not

The two dates everyone quotes are these. So called standalone high risk systems, the ones in Annex III, will apply from 2 December 2027. High risk systems embedded in already regulated products, such as machinery, toys and lifts, move to 2 August 2028.

Comparative timeline of the AI Act deadlines before and after the AI Omnibus, from 2025 to 2028.

The AI Act calendar before and after the AI Omnibus. Source, European Commission and Regulation (EU) 2026/1744.

Be careful though, because the delay is surgical and not general. The date of 2 August 2026 stands for everything else, and in particular for the transparency obligations of Article 50, for the measures supporting innovation and above all for the start of enforcement at national and EU level. The transparency obligations cover very concrete things, that is telling people clearly when they are interacting with an AI system and marking artificially generated or manipulated content, deepfakes included.

Two new deadlines are then added that did not exist before. From 2 December 2026 the new prohibitions introduced by the Omnibus start to apply, and the same date marks the end of the four month transitional period granted to providers on the labelling of artificially generated content, reserved for those who had already placed their systems on the market before 2 August 2026. The deadline for setting up national regulatory sandboxes has instead been pushed to 2 August 2027.

Article 4 was not abolished, it changed nature

Here is the news that concerns us most closely, and the one most likely to be misread.

In the original version of the AI Act, Article 4 required providers and deployers to ensure a sufficient level of AI literacy for their staff and for anyone using those systems on their behalf. It was a duty of result, with an implicit threshold to reach. In the version rewritten by the Omnibus, the duty becomes that of taking measures to support the development of such literacy. The new text clarifies that no specific level of competence is imposed, and it gives the Commission and the Member States a more active role in promoting AI literacy through practical materials and recommendations.

Comparison between the old and the new wording of Article 4 of the AI Act, from a duty of result to a duty of means.

How Article 4 of the AI Act changes with the AI Omnibus. Source, Regulation (EU) 2026/1744.

In plain legal language, this is a shift from an obligation of result to an obligation of means. The reason stated by the legislator is that a rigid duty did not suit every type of provider and deployer and produced a disproportionate compliance burden for smaller organisations.

Now, three clarifications that make the difference.

The first is that the duty remains. There is no repeal. If you do nothing, you are taking no measures, and you are out of compliance.

The second is that the personal scope has not narrowed. It still covers staff and anyone dealing with the operation and use of the systems on behalf of the organisation, so collaborators and suppliers too.

The third is the most uncomfortable one. A duty of means is proven with evidence of what you did, that is a plan, content, attendance records, traceability. Paradoxically, the softer wording shifts the centre of gravity from certifying the level reached to documenting the path taken. Anyone who thinks they got a discount will discover they were asked to keep a register instead.

What gets added, because the Omnibus does not only remove

Telling this regulation purely as a relaxation is inaccurate. Alongside the simplifications come new safeguards and new powers.

Article 5, the one on prohibited practices, gains two entries that start to apply on 2 December 2026. AI systems that generate or manipulate non consensual sexually explicit or intimate content are banned, meaning so called nudification apps, unless the person depicted has given free, specific, informed and unambiguous consent. Also banned is the generation or manipulation of child sexual abuse material, even partly synthetic, without prejudice to the justifications provided by national law such as investigative activity.

The enforcement architecture changes too. Three new articles give the Commission's AI Office powers comparable to those of a market surveillance authority, namely requests for information, inspections, binding commitments and fines. Its competence focuses on systems built on general purpose models developed by the same provider and on systems embedded in very large online platforms and search engines under the Digital Services Act. National authorities keep areas such as law enforcement, borders, justice and financial institutions.

On the simplification side, the reliefs so far reserved for SMEs are extended to small mid-cap companies, with simplified technical documentation, lighter procedures for the quality management system and capped fines. The way is opened for an EU level regulatory sandbox run by the AI Office, with priority access for SMEs and start-ups, and a specific legal basis is introduced for processing special categories of personal data where this serves to detect and correct algorithmic bias.

What has not changed at all

It is worth listing explicitly what stays identical, because that is the part most likely to vanish from the public story.

Diagram distinguishing the obligations postponed by the AI Omnibus from those confirmed for 2 August 2026.

What moves and what stays with the AI Omnibus. Source, Regulation (EU) 2026/1744 and European Commission.

The Article 5 prohibitions already in force since 2 February 2025 were not touched, so emotion recognition in the workplace and in educational institutions remains banned, as does social scoring. The obligations for general purpose models, operational since 2 August 2025, remain. The transparency obligations of Article 50 start on 2 August 2026. Enforcement starts on 2 August 2026. And Article 4, as we have seen, remains in a different form but remains.

If you work in a school, this means the time you gained concerns systems for assessing learning, for admissions or for exam proctoring, not the generative tools your teachers use every day. If you run a company, the delay concerns recruitment and staff evaluation software, not your duty to tell people when they are talking to an automated system. If you have a professional firm, none of this touches professional secrecy and the GDPR, which continue to apply exactly as before.

We should also remember that in Italy the European framework interacts with law 132/2025, which we covered in our piece on decrees, the Italian law and training, and with the overall picture we reconstructed in our guide to the AI Act and the GDPR, which now has to be read in the light of these new dates.

The risk of misreading this news

There is an interpretation error already circulating, namely the idea that Europe has backtracked and that everything can therefore be put off for a year and a half.

The reasoning does not hold, for three reasons. First, the delay was motivated by the unavailability of technical standards, not by second thoughts on the substance. When the standards arrive, the obligations will arrive with them, and they will be more precise than they are now. Second, enforcement starts anyway on 2 August 2026, so from that moment someone can ask you to account for what you do. Third, none of the postponed deadlines concerns the most widespread and everyday use of AI in organisations, which is generative use by people.

If anything, the extra time only makes sense if you use it. Sixteen extra months spent doing nothing produce exactly the same unpreparedness, with the added problem that in the meantime the adoption of tools inside organisations will have grown and so called Shadow AI, that is the spontaneous and unrecorded use of free tools by individuals, will be harder to map.

What to do now, concretely

The plan does not change much compared with before, what changes is the order of priorities.

First, reread your inventory. If you classified a system as high risk, check whether it falls under Annex III or among systems embedded in products, because the two categories now have different dates, that is December 2027 and August 2028. The new and narrower definition of safety component may also take out of the high risk bracket some system you had put there out of caution.

Then, prepare your Article 4 file. You do not need to certify a level, you need to be able to show the measures adopted, that is the training plan, the materials, the people covered, the dates, the planned updates. Make it a living document, not a forgotten annex.

Next, treat 2 August 2026 as the real date. Check that your artificially generated content is recognisable, that anyone interacting with an automated system of yours knows it, and that inside the organisation there is an identified person responsible for these matters.

Finally, review your supplier contracts in the light of the AI Office's new powers, especially if you use systems built on general purpose models, because the chain of responsibility is now more explicit.

Where the rule and the skill meet

There is an underlying reading worth spelling out. The European Union softened the formal AI literacy duty because it realised that imposing a uniform threshold on a bakery and on a multinational made no sense. It did not soften the problem. People who use AI without understanding how it works keep producing the same mistakes, the same data leaks and the same bad decisions, regardless of how Article 4 is worded.

The difference is that training now stops being a compliance item with a threshold to clear and goes back to being what it always was, namely a quality choice made by the organisation. Those who do it will do it because it is useful, not because they are forced to. And it will show.

If you want to understand where you stand against this picture, start with a diagnosis. Our AI Readiness Report photographs the real level of your organisation and tells you where it makes sense to start, with a measurement before and after the programme that leaves you a document you can also use to report on public or corporate funding. Write to us for an assessment, or read our manifesto to see how we work.

Methodological note

This article is informative and educational in purpose and does not constitute legal advice. The information reported is based on the text of Regulation (EU) 2026/1744 published in the Official Journal of the European Union of 24 July 2026, on the official European Commission communication of 27 July 2026 and on legal analyses published in the days immediately after. Since the text has only just entered into force, some operational interpretations may be refined by later Commission guidelines, by delegated and implementing acts and by national authority guidance. The dates given refer to when provisions start to apply, which is a different thing from the entry into force of the regulation. For specific decisions, turn to your legal advisers and your DPO.

Sources