From the journal

EU Council Adopts Digital Omnibus Amendments to AI Act, Deferring High-Risk Compliance to 2027

The Council of the EU formally adopted Digital Omnibus amendments to the EU AI Act on 29 June 2026, following the European Parliament's approval on 16 June. The package defers compliance deadlines for Annex III high-risk AI systems to 2 December 2027 and for Annex I embedded systems to 2 August 2028. Two new prohibitions covering non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.

2 min read

On 29 June 2026, the Council of the European Union formally adopted the Digital Omnibus on AI, completing the legislative cycle after the European Parliament approved the amendments on 16 June 2026. The amendments modify Regulation (EU) 2024/1689 (the EU AI Act) and enter into force as directly applicable EU law across all member states.

Under Annex III of the AI Act, compliance deadlines for stand-alone high-risk AI systems used in employment, education, biometric identification, and critical infrastructure management shift from 2 August 2026 to 2 December 2027. For Annex I high-risk AI systems embedded in products subject to sector-specific legislation (medical devices, machinery, toys, and civil aviation components), the deadline extends to 2 August 2028. The synthetic content watermarking obligation under Article 50(2) for outputs generated before 2 August 2026 is deferred to 2 December 2026. AI regulatory sandbox establishment under Article 57 is postponed to 2 August 2027.

HR technology vendors, recruitment platforms, educational assessment tools, biometric identification system operators, and AI-enabled critical infrastructure managers gain an additional 16 months before they must satisfy the AI Act's conformity assessment, technical documentation, logging, transparency, and human oversight obligations. Integrators embedding AI capability into regulated Annex I products gain 24 months. Both categories must continue to comply with pre-existing product safety and sector-specific regulatory requirements during the extended period.

Two new prohibited practices are added under Article 5 of the AI Act, effective 2 December 2026: generating or manipulating non-consensual intimate imagery and child sexual abuse material. These prohibitions sit alongside the existing bans on social scoring and subliminal behavioural manipulation. No transitional provisions apply to the new prohibitions.

Licentium advises technology companies and regulated entities on EU AI Act compliance and implementation planning. Organisations assessing their position under the revised deadlines are invited to contact us. Work we undertake includes Annex I and Annex III high-risk system classification, conformity assessment preparation, technical documentation design, human oversight programme development, and multi-jurisdictional AI regulatory mapping.

Source: Council of the EU, Digital Omnibus on AI: Council and Parliament agree to simplify and streamline rules, 7 May 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.