As Artificial Intelligence (AI) becomes part of how organisations work, how the world is shaped, and how we interact as individuals, the rules around it are rapidly changing in an attempt to govern the unknown.
The European Union’s AI Act was introduced to create a common framework for how Artificial Intelligence is developed and used across the E.U., but putting those rules into practice is not as straightforward as it seems. Different industries have different requirements, meaning organisations also need the standards, guidance and regulatory structures needed to truly comply.
To address some of these implementation challenges, the E.U. introduced the AI Omnibus. Regulation (EU) 2026/1744, also known as the Digital Omnibus on AI, amends parts of the EU AI Act to simplify its implementation. It was published on 24 July 2026 and entered into force on 27 July 2026.
One important distinction: the AI Omnibus is not the same as the wider Digital Omnibus proposals, which cover areas such as the General Data Protection Regulation (GDPR),2016 ePrivacy Directive, 2002 and the Data Act, 2023 which sets rules on access to and use of data, including data generated by connected products and services. Those changes are still being considered. Regulation (EU) 2026/1744 is the part concerning AI that has become law.
So, what changed?
One of the biggest changes in the AI Omnibus concerns high-risk AI systems. Under the AI Act, certain AI systems that could significantly affect people’s health, safety or fundamental rights are subject to additional requirements, while the Omnibus gives organisations more time to prepare. For certain high-risk AI systems covered by Annex III, the relevant requirements will apply from 2 December 2027. Examples include AI used to analyse and filter job applications, evaluate learning outcomes, assess creditworthiness, or perform remote biometric identification, biometric categorisation or emotion recognition where permitted under the AI Act. For high-risk AI systems covered by Annex I, the relevant requirements will apply from 2 August 2028. Examples include AI systems used as safety components of certain regulated products, such as machinery, toys and lifts, or AI systems that are themselves regulated products for which third-party conformity assessment is required. These extensions are linked to delays in standards, guidance and other supporting infrastructure needed for implementation; they are not exemptions from the requirements.
Another change found in the Omnibus is the approach to AI literacy, which remains a critical part of the Act. Whether an organisation develops an AI system or simply uses one, the people involved need to understand the technology they are working with and the risks that come with it. The Act places this responsibility on two key roles: the provider and the deployer. A provider is an organisation or individual that develops an AI system, or has one developed on its behalf, and places it on the market or puts it into service under its own name or trademark. A deployer, by contrast, is an organisation or individual that uses an AI system under its own authority. For example, a company that develops and supplies an AI recruitment system would generally be the provider, while an organisation that uses that system to screen job applicants would be the deployer.
Providers and deployers must still take measures to support AI literacy, but the amended rules recognise that AI literacy should reflect how and where an AI system is being used. The knowledge needed will vary depending on a person’s role, technical knowledge, experience, education and training. For companies, this means considering what employees need to understand based on the AI systems they use and the responsibilities they have, rather than taking a one-size-fits-all approach to AI literacy.
For instance, the knowledge needed to use an AI writing tool such as Microsoft Copilot is not the same as what is required to oversee an AI system that can affect decisions about people, such as an AI recruitment system, credit-scoring system or system used to assess student performance.
Where privacy and AI meet
A critical change for those seated at the intersection of privacy and AI governance is the introduction of rules allowing certain special categories of personal data (i.e. information about a person’s racial or ethnic origin; political opinions; religious beliefs; health data; biometric data used for identification; sexual orientation), to be processed when strictly necessary to detect and correct bias in AI systems.
Mandatory safeguards include considering whether anonymised or synthetic data could achieve the same purpose, as well as requirements around pseudonymisation, strict controls and documentation of access, and recording why the processing was strictly necessary and why other data could not achieve the same purpose. The data must also be deleted once the bias has been corrected or the applicable retention period ends. This is not a general permission to process sensitive personal data in connection with AI. It is a specific provision for using such data where it is strictly necessary to detect and correct bias and the required safeguards are in place. For example, a healthcare AI system analysing cancer risk may use health or genetic data to check whether its predictions are less accurate for particular patient groups and correct any bias identified.
Testing AI before deployment
The Omnibus also strengthens the framework for AI regulatory sandboxes by requiring Member States to ensure that their competent authorities establish at least one national sandbox, operational by 2 August 2027. The AI Office, which forms part of the European Commission and supports the implementation and enforcement of the AI Act, may also establish a Union-level sandbox for AI systems subject to EU-level supervision, with priority access for SMEs, including start-ups, and small mid-cap companies.
These sandboxes provide a controlled environment where providers can develop, train, test and validate innovative AI systems for a limited period before they are placed on the market or put into service, working with the relevant authorities and putting appropriate safeguards in place. Where personal data is involved, the relevant data protection authorities are also involved in overseeing those aspects. Where appropriate, testing can take place in real-world conditions.
What should organisations be doing?
For organisations affected by the extended timelines, the extra time should be used to prepare rather than pause. Start by identifying which AI systems fall within the AI Act, where they are being used, who is responsible for them and what needs to be in place before the applicable requirements take effect.
A useful starting point is to:
● Understand your AI: What systems are being used, by whom and for what purpose?
● Deadline check: Which AI Act requirements apply now, and which have been extended?
● AI literacy review: Do staff using AI understand the system and the risks relevant to their
role?
● Data review: What personal data is involved (is there any special category data?), and
what safeguards are in place?
● Document your decisions: Maintain evidence of risk assessments, AI impact and bias
assessments, testing, oversight and applicable controls.
The wider Digital Omnibus – what’s next?
Alongside the changes to the AI Act, the E.U. is also considering a broader Digital Omnibus covering data and privacy rules. It includes proposed changes to the GDPR, ePrivacy rules and the Data Act, including changes to how pseudonymised data is handled, when organisations need to carry out Data Protection Impact Assessments and report data breaches, and how personal data can be used when developing AI systems. The proposals also include simpler cookie requirements, including removing consent for some low-risk uses. These changes remain proposals and have not yet become law.
For organisations, the bigger picture is not simply about having more time to comply. It is about understanding how AI is being used, where the risks sit and how privacy, cybersecurity, risk and AI governance need to work in tandem.
At T.A.A.S Cyber Solutions Ltd, we believe effective governance should support responsible innovation rather than become another layer of paperwork. As AI becomes more embedded in everyday business, organisations that build governance into how AI is selected, assessed and used will be better positioned to adapt as the regulatory landscape continues to evolve. Email us now on info@taas-ltd.com for more information about building an AI governance program that complies with the EU AI Act and applicable laws.