The European Parliament and the Council approve the Digital Omnibus Package on AI
Regulation (EU) 2026/1744, known as the ‘Digital Omnibus’, was published in the Official Journal of the European Union on 24 July 2026 and entered into force three days later, on 27 July 2026. It amends the Artificial Intelligence Regulation (AIR) to simplify its application, ease compliance burdens – particularly for SMEs and small mid-cap companies – and extend certain deadlines, whilst at the same time strengthening supervision.
Key new provisions include:
- New AI prohibitions (Article 5 of the AI Regulation): the use of AI systems to generate non-consensual intimate material of identifiable individuals, as well as child sexual abuse material, is prohibited. These will apply from 2 December 2026.
- Clarification of the concept of ‘safety component’: it is specified that an AI system is only considered a safety component when its intended purpose is to prevent risks to health and safety; functions such as user assistance or performance optimisation are excluded.
- More flexible AI literacy (Article 4): organisations are no longer required to “guarantee” a level of literacy, but rather to “take measures to support its promotion” amongst staff.
- New legal basis for correcting bias (Article 4a): the possibility of processing special categories of data to detect and correct bias is extended to more providers and those responsible for deployment, subject to strict safeguards.
- Greater support for SMEs: simplified technical documentation, quality management systems proportionate to the size of the business, more moderate fines and priority access to the AI Office’s sandboxes.
- Simpler conformity assessment: a single procedure for bodies wishing to be designated under both the AI Act and other EU harmonisation standards.
The Omnibus Directive also strengthens the supervisory framework and provides greater scope for innovation:
- Sandboxes and real-world testing (Articles 57, 58, 60 and 60a): Member States must have a national sandbox operational by August 2027, and the scope for testing AI systems in real-world conditions is expanded, including for high-risk systems.
- The European AI Office gains exclusive powers over the most significant AI systems — general-purpose models and very large platforms or search engines — with the authority to inspect, investigate on its own initiative and impose fines of up to €35 million or 7 per cent of global turnover.
- Transitional period for content labelling (Article 50): providers who were already marketing synthetic content generation systems before August 2026 have until 2 December 2026 to comply with the labelling obligations.
- Alignments with sector-specific regulations: the Machinery Regulation will now be governed by a sector-specific approach within the RIA, and coordination with the Cyber Resilience Regulation is strengthened.
- Other changes: simplification of registration procedures, a voluntary model for post-market surveillance, clarifications regarding the grace period for systems already on the market, and an expanded penalty regime with more favourable caps for small businesses.
- Key deadlines to watch: the new prohibitions come into force on 2 December 2026; high-risk systems listed in Annex III have until 2 December 2027 to comply, and those in Annex I until August 2028.
The TMT team at ECIJA recommends reviewing how these changes affect ongoing AI projects and keeping an eye on the guidelines the Commission will publish in the coming months on sectoral complementarity (August 2027) and post-market surveillance (September 2027).
Related professionals
LATEST FROM #ECIJA
The historic agreement between Michael Jackson and Pepsi marked a turning point in the commercial exploitation of image rights, laying the foundations for modern sponsorship contracts. Today, in a world dominated by social media and artificial intelligence, these agreements are more complex and strategic than ever.
ECIJA’s TMT department analyses the ‘Digital Omnibus’, the reform approved by the European Union that streamlines the Artificial Intelligence Regulation (AIR). It extends deadlines, reduces the burden on SMEs and strengthens the powers of the European AI Office, without compromising the level of protection of rights and security.
In light of the rise in online scams and fraud, SUTEL is calling for changes.
ECIJA has advised NOSTROMO PICTURES and BETA FICTION on the film “CRONOS”, which is based on the real-life accounts of those involved and recounts the unfolding of Operation Cronos, the operation launched following the terrorist attack carried out on Las Ramblas (Barcelona) on 17 August 2017.
Félix Jáquez, a partner at ECIJA DOMINICAN REPUBLIC, is taking part as a moderator at the 2026 Trust Services and Digital Certification Congress
Most companies believe they have a clear understanding of what personal data they process. However, this perception is often limited to their customer database, when in fact the processing of personal data covers much more than that.
On 18 June 2026, SUTEL approved the most comprehensive regulatory measures adopted to date in Costa Rica to combat cyberattacks via SMS text messages (smishing) and fraudulent telephone calls (vishing).
Strong democracies are not those where nobody tries to exert influence. They are those where everyone knows who exerts influence, on what issues and under what rules.
Costa Rica has been waiting for this fast passenger train project for several years.
