EU AI Act News: Digital Omnibus on AI, New Guidance on Risk Classification, GPAI, and Transparency Obligations

This Legal Update covers several key developments relating to the European Union's Artificial Intelligence Act ("EU AI Act"):

1. The "Digital Omnibus on AI" (EU Regulation 1744/2026) has been published in the Official Journal of the European Union and becomes applicable on 27 July 2026, bringing several changes to the EU AI Act, aiming at simplifying implementation and reducing overlaps with existing regulation.
2. On 19 May 2026 , the European Commission published draft guidelines (the "Guidance") to support providers and deployers of AI systems, as well as the relevant market authorities, in assessing whether an AI system should be classified as high-risk, facilitating enforcement of Article 6 of the EU AI Act.
3. Guidelines have also been published, on 18 July 2026, on the scope of general purpose AI systems governed by the EU AI Act. For more information on the obligations affecting these systems, see our Legal Update.
4. Finally, on 20 July 2026, the European Commission adopted its final Guidelines on the transparency obligations under Article 50 of the EU AI Act.

Digital Omnibus on AI

New Deadlines

The Omnibus postpones the application of rules on high-risk AI systems to allow necessary harmonised standards and support measures to be put in place. The revised deadlines are as follows:

• The watermarking obligations for AI-generated content will apply from 2 December 2026, rather than the 2 February 2027 date originally proposed by the Commission.
• Obligations on high-risk use case AI systems (including those involving biometrics, and those used in critical infrastructure, education, employment, law enforcement, and border management) will apply from 2 December 2027.
• Obligations on high-risk AI systems used as safety components in products covered by EU sectoral legislation will apply from 2 August 2028.

The new changes will not delay other transparency requirements (e.g., the obligation to disclose that individuals are interacting with AI under Article 50(1) of the EU AI Act and to disclose deepfakes under Article 50(4) of the EU AI Act), which will come into force on 2 August 2026 for AI systems which are placed on the market after this date.

The Omnibus will also amend the EU AI Act to specify that the EU AI Act applies to operators of high-risk AI systems in service before these dates (as may be delayed by the Omnibus), only if those systems are subject to significant changes in their designs from that date. However, for operators of high-risk AI systems which are public authorities, it is unclear if the dates of application will be delayed.

Ban on "Nudifier" Apps

The Omnibus introduces a new prohibition on AI systems that create child sexual abuse material or depict the intimate parts of an identifiable person, or them engaged in sexually explicit activities, without that person's consent.

The prohibition applies to:

• Placing AI systems on the EU market with the purpose of creating such content;
• Placing them on the EU market without reasonable safety measures to prevent such creation; and
• Deployers using these systems for the purpose of creating such content.

The prohibition extends to AI-generated images, video, and audio. Providers will have until 2 December 2026 to ensure compliance.

Other Changes: Reducing Overlap, Centralised Enforcement

Article 6(1) of the EU AI Act establishes a common classification mechanism for AI safety components in products, but the EU AI Act differentiates its consequences by product regime.

For Annex I Section A products (e.g., toys, radio equipment, and medical devices), the EU AI Act applies the full high-risk framework directly, allowing integration into existing product compliance systems. For Annex I Section B products (e.g., motor vehicles, civil aviation, and rail systems), it limits its direct application, relying instead on sectoral legislation to incorporate AI-related requirements. This reflects a deliberate judgment that some regimes can accommodate the EU AI Act's horizontal requirements directly, while others need a more tailored, sector-specific approach.

The Omnibus places the EU Machinery Regulation (EU) 2023/1230 in Annex I Section B, so that the AI-related requirements for AI-enabled machinery are addressed through that Regulation rather than the EU AI Act directly. To maintain equivalent health and safety protections, the Commission must, by 2 August 2028, adopt delegated acts integrating the AI obligations for high-risk safety components in machinery into the product-safety regime.

Another noteworthy development is that providers and deployers of both high-risk and non-high-risk AI systems will be permitted to process personal data (including special categories of data) where strictly necessary to detect and correct biases, subject to appropriate safeguards.

Other changes under the Omnibus include:

• The definition of "safety component" has also been narrowed, meaning that AI functions which merely assist users or optimise performance (without creating health or safety risks in the event of failure) will not automatically be classified as high-risk.
• Existing regulatory exemptions available to small and medium-sized enterprises under the EU AI Act will be extended to small mid-cap enterprises to support their growth.

Draft Guidance: High-risk Classification & Exemptions

The Guidance sets out additional detail to assist businesses in understanding the scope of high-risk AI systems–the responsibility for assessing whether an AI system is intended for a high-risk use case is the responsibility of the provider, but under Article 25(1) of the EU AI Act it is possible for obligations to flow to distributors, importers, or deployers:

• "Intended purpose" is defined under Article 3(12) of the EU AI Act as the use for which the system is intended by the provider, including the specific context and conditions of use, as specified in instructions for use, promotional or sales materials, statements, and technical documentation. The Guidance sets out that Providers must clearly describe the envisaged use of the system and its functionalities in these documents so that there is no ambiguity on what it is intended to be used for.
• For systems with multiple purposes, the description given by the Provider in these documents will be highly relevant. If they present the AI system as broadly applicable and do not limit its application to exclude high-risk uses, the system's intended purpose will be deemed to encompass high-risk use cases and therefore qualify as high risk.
• In relation to AI systems which are classified as high risk under Article 6(1) EU AI Act, the Guidance is clear that this can apply whether the AI system is embedded within the product or operates independently. For example, a software update could be sufficient. Where an AI system is a safety component (not the product itself), it should be evaluated as part of the product's overall safety assessment as may be required by the product/sector specific regulation.
• Safety functions include preventative functions, monitoring and detecting harmful situations or maintenance requirements, and supervision of another system. However, optimisation of performance or efficiency, or quality control, are not safety functions. 

Additionally, the Guidance gives further clarity around the exceptions to the high-risk classification set out in Article 6(3) of the EU AI Act. These exempted systems need to be registered in a database under Article 71 EU AI Act:

• AI system output which is intended to inform a human operator's decision can be excluded as performing a "preparatory task." However, the Guidance states that a specific recommendation or evaluation from the AI system is a "decisive role" and would not fall within the exception. For example, referring a human operator to relevant data could be preparatory.
• The Guidance states that "simple" classification of individuals based on personal characteristics such as age, sex, or height does not necessarily lead to profiling. Whether an evaluation constitutes profiling depends on the purpose of the classification–specifically, whether it involves evaluating personal aspects of a natural person that include prediction, assessment or judgement about that person. For example, basic classification for the purpose of assessing compliance with recruitment policies would be profiling.

Beyond these exemptions, the Guidance also addresses the interpretation of key classifications, particularly in the context of biometric data and employment-related AI systems:

• "Biometric data" in the context of the EU AI Act is broader than for the EU GDPR, and does not require "unique identification" of an individual. The draft Guidance notes that the EU AI Act definition covers AI systems that use biometric data not only for identification purposes, but also for biometric categorisation, emotion recognition or other purposes. Where biometric identification is involved (i.e. matching against a reference database to establish identity), a database of individuals is required, e.g., a public database of radio (voice records) to be matched against, or a list of approved fingerprints for doorway access.
• Where the EU AI Act refers to "employment" or a "worker," this is not limited to formal employment contracts but should capture broader arrangements. Similarly, "worker's management" is also expected to be interpreted broadly including to cover recruitment, work allocation, monitoring, worker evaluation, and decisions on promotion, remuneration or termination.
• Where an AI system used in recruitment could be classified as high-risk, this should relate to the "substance" of recruitment including both preparatory steps (like application screening) and the selection process (shortlisting, grading, ranking, or testing candidates). Many practical examples are given, including:
• An AI system which generates job descriptions could be exempted if its task was narrow and limited to preparing a description based on the necessary qualifications and skills as identified by a human, but one that generated the required qualifications would be high risk. 
• An automated job matching and ranking tool which filtered candidates would be high risk where the scores of the AI system are the primary input for decision making.
• An AI system for identifying discriminatory wording in a job advert would not be high risk.

Guidance on General Purpose AI Models

On 28 April 2026, the Commission also issued guidelines to clarify the scope of the obligations for providers of general-purpose AI ("GPAI") models under the EU AI Act (the "GPAI Guidelines"). The GPAI Guidelines help operators in the AI ecosystem understand whether the obligations apply to them and what is expected of them, and relate to obligations that are already in force under the EU AI Act. The GPAI Guidelines are intended to complement, not replace, the voluntary General-Purpose AI Code of Practice.

The Guidelines introduce clearer technical criteria for understanding when an AI model is considered "general-purpose." Instead of relying on a list of functionality, "training compute" measured in floating-point arithmetic operations ("FLOPS") shall be used. The indicative threshold is currently 1023 FLOPs, and the ability to generate language/images/audio. Certain obligations around transparency (e.g., to keep up to date technical documentation related to training under Article 53(1) of the EU AI Act) will not apply to providers of open-source GPAI systems, which are released under a free and open-source licence allowing access, use and distribution of the model, unless they pose a "systemic risk." From 2 August 2026, the Commission's enforcement powers are available, including the power to impose fines. By 2 August 2027, providers of GPAI models placed on the market before 2 August 2025 must also comply with the relevant provisions of the EU AI Act (and the GPAI Guidelines).

Guidelines on Transparency Obligations

The Guidelines on transparency obligations (the "Transparency Guidelines") provide detailed guidance about how the transparency provisions should be applied in practice. Below, we share some of the most notable additions in the Guidelines, how these relate to the main Article 50 obligations, and the potential impacts for providers and deployers.

Interactive AI systems

Providers of AI systems that interact directly with people, such as chatbots, are required to design those systems so that users are informed they are interacting with AI, unless this is obvious, or a law-enforcement exception applies. The Transparency Guidelines add specific directions for AI agents, for example: an AI agent must disclose not only its artificial nature but also the person on whose behalf it is acting. If it is not certain whether an AI agent will interact with individuals, the AI agent must be designed to disclose itself by default in any situation where such interaction is reasonably likely. This means that the interactive disclosure obligation for providers of AI agents may be more extensive than anticipated.

Marking and detection of AI-generated content

Providers of AI systems generating synthetic audio, image, video or text content must ensure that their outputs are marked in a machine-readable format and detectable as AI-generated or manipulated. The Transparency Guidelines recognize some additional scenarios where this general obligation may not apply, such as industrial AI applications which are strictly technical in nature, are only intended to be perceived by a limited number of individuals in a professional capacity, and will not be shared outside the company. Real-time content generation that is ephemeral and consumed immediately (where marking is not technically feasible, and the persons exposed to the content are made aware that the content is AI-generated) is also highlighted as a type of content that may be exempted. Providers of these types of AI systems may therefore not need to comply with the marking requirement.

Deepfakes and public-interest text

Deployers are to provide clear disclosures where AI-generated image, audio or video content constitutes a deepfake, or when AI-generated text is published to inform the public on matters of public interest. The Commission's interpretation of a "deepfake" in the Transparency Guidelines merits particular attention: while the EU AI Act defines a deepfake as an "image, audio or video content that appreciably resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful," the Transparency Guidelines extend the definition considerably by stating that content may qualify as a deepfake if it depicts something that "could exist"—that is, a realistic scenario or plausible event—even if the specific depicted person or situation never actually existed or occurred. On the other hand, when assessing whether AI-generated content would "falsely appear to a person to be authentic or truthful" under the EU AI Act's definition, the specific deployment context and audience expectations should be taken into account, meaning that content may be considered not to be a "deepfake" where the audience are not expecting content to be true or authentic. This means that deployers should remain attentive to realistic AI-generated content, but the deepfake disclosure obligation will potentially not apply in some deployment contexts.

Key Takeaways

The European Union has been ambitious in its aim to be the first jurisdiction to comprehensively regulate AI, but these recent developments demonstrate that the Commission is actively working to provide practical guidance and support to help users and developers achieve compliance, extending deadlines where necessary to ensure a measured transition.

While companies now have more time to prepare for the high-risk AI system rules and watermarking requirements, they also benefit from greater clarity on what constitutes high-risk, particularly the principle that it is the provider who determines the intended purpose. Businesses should take this into account when developing AI systems and preparing technical and marketing materials. For GPAI systems, the draft Guidelines underscore the risk that a system could be classified as high-risk if one of its potential purposes falls within a high-risk category, warranting closer attention to compliance and communication strategies. The recent Transparency Guidelines provide further impetus for companies to prioritize regulatory compliance in this area, given the forthcoming deadline of 2 August 2026.

In practice, the topics covered in this Legal Update are deeply intertwined. While the EU AI Act assigns distinct roles and attributes specific obligations to each–such as provider of GPAI models or deployer of high-risk systems, companies frequently occupy multiple roles simultaneously and will invariably interact with counterparties fulfilling other roles in the AI value chain. For this reason, in-house counsel and AI professionals will often need to understand these regulatory frameworks holistically. We assist clients across all of these developments, ensuring coordinated and comprehensive guidance.

Further guidance will be available through the AI Office, the EU AI Act Service Desk on the Single Information Platform and the AI regulatory sandboxes (to be established by 2 August 2026). Please reach out to the authors for further guidance on EU AI Act compliance.