AI regulation coming into force, and what it changes for enterprise deployments

What changed in 2026?

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, is dated 8 July 2026 and amends Regulation (EU) 2024/1689, the AI Act. It was published in the Official Journal on 24 July 2026 and enters into force on the third day after publication, which is 27 July 2026. (Source: Regulation (EU) 2026/1744, title and Article 4, as of 20 October 2026.)

The European Parliament's tracker records the path of the text: provisional agreement on 7 May 2026, approval by Parliament's plenary on 16 June, adoption by the Council on 29 June, signature on 8 July and publication on 24 July. The regulation's own footnote confirms the dates in June. (Sources: European Parliament Legislative Train, Digital Omnibus on AI, updated 20 September 2026, as of 20 October 2026; Regulation (EU) 2026/1744, footnote 4, as of 20 October 2026.)

Its main effect is on timing. Before the amendment the AI Act applied generally from 2 August 2026, with Article 6(1) and its obligations from 2 August 2027. The amended third paragraph of Article 113 now has the requirements for high-risk systems, in Chapter III, Sections 1 to 3 except Article 6(5), apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those classified under Article 6(1) and Annex I, which are products, or safety components of products, under listed Union harmonization law that need a third-party conformity assessment. Exhibit 1 sets out every date a deployer needs. (Sources: Regulation (EU) 2024/1689, Articles 6(1) and 113, as of 20 October 2026; Regulation (EU) 2026/1744, Article 1(40), as of 20 October 2026.)

What already applies to a business that uses AI?

Article 5 lists practices for which an AI system may not be placed on the market, put into service or used, and it has applied since 2 February 2025; a deployment inside one gains nothing from the later dates. The Commission's list includes emotion recognition in workplaces and education institutions, and it says the practice added by the 2026 amendment takes effect in December 2026. (Sources: Regulation (EU) 2024/1689, Article 5(1), as of 20 October 2026; European Commission, AI Act page, as of 20 October 2026.)

The AI literacy duty in Article 4, as replaced by the amendment, requires providers and deployers to take measures to support the development of AI literacy of their staff and of other people who operate or use AI systems on their behalf, taking into account their knowledge, experience and training and the context of use. It does not require them to secure a particular level of literacy for any individual. (Source: Regulation (EU) 2026/1744, Article 1(5), as of 20 October 2026.)

The transparency rules in Article 50 apply from 2 August 2026, and the Commission published guidelines on them on 20 July 2026. Systems that interact with people must inform them; deployers of emotion recognition or biometric categorization must inform the people exposed; deployers of AI that generates a deep fake must disclose it; and deployers of AI-generated text published to inform the public on matters of public interest must say so, unless it had human review under editorial responsibility. The information is due at the first interaction or exposure at the latest. (Sources: Regulation (EU) 2024/1689, Article 50(1) and (3) to (5), as of 20 October 2026; European Commission, Guidelines on transparency obligations page, updated 31 July 2026, as of 20 October 2026.)

How does a business tell whether a system is high-risk?

A system is high-risk under Article 6(1) when it is a product, or a safety component of one, covered by the Union harmonization legislation in Annex I and needs a third-party conformity assessment. Otherwise it is high-risk under Article 6(2) when it falls in an area listed in Annex III, which includes biometrics, education, employment and worker management, and access to essential services such as creditworthiness assessment. (Sources: Regulation (EU) 2024/1689, Article 6(1) and (2) and Annex III, as of 20 October 2026.)

An Annex III system is not treated as high-risk when it poses no significant risk of harm, including by not materially influencing the outcome of decision-making, and meets one of the conditions listed in Article 6(3), such as performing a narrow procedural task. It is always high-risk when it profiles natural persons, and a provider that takes the exemption must document its assessment before placing the system on the market. Exhibit 2 puts these questions in order; it is our reading of the articles, not a legal test. (Source: Regulation (EU) 2024/1689, Article 6(3) and (4), as of 20 October 2026.)

What will the high-risk rules ask of a deployer?

Article 26 expects a deployer to use a high-risk system according to its instructions for use; to assign human oversight to people with the necessary competence, training, authority and support; to monitor the system and, where it sees a risk, inform the provider and the authority and suspend use; to keep the logs it controls for at least the period the article sets, unless other law says otherwise; and, as an employer, to inform workers' representatives and affected workers before use at work. Regulation (EU) 2026/1744 does not amend Article 26: the list of articles amended in its Article 1 does not include it. (Sources: Regulation (EU) 2024/1689, Article 26(1), (2) and (5) to (7), as of 20 October 2026; Regulation (EU) 2026/1744, Article 1, as of 20 October 2026.)

Article 27 adds an assessment of the effect on fundamental rights before first use for deployers that are public-law bodies or private entities providing public services, and for deployers of systems that assess creditworthiness or the risk of life and health insurance customers, with the results notified to the market surveillance authority. The amendment replaced paragraphs 4 and 5: the assessment may cross-refer to a data protection impact assessment, and the AI Office is to develop a questionnaire template. (Sources: Regulation (EU) 2024/1689, Article 27(1) and (3), as of 20 October 2026; Regulation (EU) 2026/1744, Article 1(13), as of 20 October 2026.)

A system already in use is treated differently. As amended, Article 111(2) applies the high-risk rules to systems placed on the market or put into service before the date of application only if, from that date, their design is significantly changed. What counts as a significant change to a system a business built for itself is a question for counsel. (Source: Regulation (EU) 2026/1744, Article 1(39)(a), as of 20 October 2026.)

What has been published to help providers comply?

The amendment's second recital blames the delay on late standards and late national frameworks. The Commission has now published the reference to the first harmonized standard, EN 18286:2026, on quality management systems, which gives providers that apply it a presumption of conformity with the Article 17 requirements it covers. A deployer can ask its provider whether it does. (Sources: Regulation (EU) 2026/1744, recital 2, as of 20 October 2026; European Commission, First harmonised standard supporting the AI Act published in the Official Journal, last updated 19 October 2026, as of 20 October 2026.)

What should a business do with the time?

The sequence follows from the texts, and it is our reading of them. Check the inventory of AI in use against Article 5, including the additions that apply in December 2026, and confirm what the business does under Articles 4 and 50. Classify each system against Annex III and Article 6(3), and name an owner for each that is or may be high-risk, because Article 26 puts oversight, monitoring, logs and worker information on the deployer. Ask each provider for the instructions for use, which Article 26(1) makes the standard of correct use, and check whether Article 27 applies. (Sources: Regulation (EU) 2024/1689, Articles 4, 5, 6, 26, 27 and 50, as of 20 October 2026.)

What is not in this briefing?

It does not cover regimes outside the European Union, the proposed changes to data protection rules that the Parliament's tracker shows in separate procedures, the rules for general-purpose AI models, or the penalties. It does not say whether any system you run is high-risk, which depends on facts about the system. Nothing in it is legal advice.