On 24 July 2026, EU Regulation No. 2026/1744, also known as the Digital Omnibus on AI, was published in the Official Journal of the European Union. The Digital Omnibus forms part of the broader process of rationalising and coordinating EU legislation on digital matters, with reference to Regulation (EU) 2024/1689, the Artificial Intelligence Act, certain aspects of which it amends.
The Digital Omnibus aims to simplify and rationalise the AI Act to ensure clearer and more effective application, reduce administrative burdens on operators, eliminate regulatory overlaps and strengthen legal certainty within an increasingly complex regulatory framework.
The Regulation does not alter the substantive structure of the AI Act, nor does it aim to supersede or undermine the adjustments already implemented by companies. Its main interventions include a remodulation of certain timelines, postponing some obligations already provided for by the AI Act, and clarifications on specific application profiles. The aim is to allow operators to comply correctly with the applicable obligations while maintaining the so-called risk-based approach.
With reference to timing, in particular, the following deadlines have been postponed:
- the transparency obligations relating to the marking of digital content generated or manipulated by AI systems have been deferred to 2 December 2026, limited to systems already placed on the market before 2 August 2026;
- the obligations for high-risk AI systems qualified as autonomous, i.e. those not incorporated into a product already regulated by other European safety legislation, have been postponed to 2 December 2027;
- the obligations relating to high-risk systems embedded in products subject to European legislation on product safety and market surveillance have been postponed to 2 August 2028.
It should be noted that the deadlines of 2 February 2025 for prohibited practices and AI literacy obligations, and 2 August 2026 for transparency obligations applicable to systems not yet placed on the market, remain unchanged. In this regard, on 20 July 2026, the Commission published practical guidance for competent authorities, providers and deployers of AI systems. The aim is to ensure compliance with the transparency obligations set out in Article 50 of the AI Act in a consistent, effective, proportionate and uniform manner.
With reference to the safety profile, the Digital Omnibus clarifies the relationship between the AI Act and the Machinery Regulation (EU) 2023/1230 in order to avoid regulatory overlap where the product legislation itself ensures an equivalent or higher level of protection for health, safety and fundamental rights. A more precise definition of “safety component” is introduced: an AI system can be qualified as such only when it is expressly intended to prevent or mitigate risks to health and safety, or when its malfunction may endanger people or property. Therefore, AI systems with merely ancillary functions, such as user assistance, performance optimisation, service efficiency, automation, convenience or quality control not related to safety, are excluded.
The Regulation also extends certain measures previously introduced for small and medium-sized enterprises, providing for simplified documentation requirements for the use of AI, the adoption of codes of conduct, and the application of proportionality criteria in determining the penalties applicable to these entities.
In parallel, in Italy, on 10 June 2026, the Council of Ministers approved two draft implementing decrees of Law No. 132/2025 on AI. Among the main provisions, in the field of labour law, the decrees introduce specific guarantees for the use of AI systems in decision-making processes relating to employment relationships. In particular, employers using such systems must ensure that decisions concerning the establishment, management and termination of the employment relationship, including disciplinary proceedings, are not based exclusively on automated processing. A dismissal adopted in breach of this principle is null and void.
In addition, workers are expressly granted the right to obtain a clear and comprehensible statement of reasons for decisions concerning them, including an indication of the possible role and impact of AI systems in the decision-making process.
Finally, in order to facilitate and support private operators and SMEs in identifying internal governance systems for the complex regulatory framework on AI, the draft decrees introduce so-called regulatory experimentation spaces. These spaces, in line with the sandboxes provided for in the AI Act, are intended to support the sharing of best practices in AI, promote innovation and competitiveness, and encourage the development of an artificial intelligence ecosystem.
***
In light of the regulatory framework illustrated above, it is advisable to: (i) carry out a mapping of the AI systems in use, verifying whether any systems may be classified as high-risk and distinguishing between AI tools used only internally within the company, customer-facing tools and tools incorporated into products or services, including through the use of self-assessment documents; (ii) define and update internal IT policies on the use of generative AI for external content; (iii) expressly prohibit harmful, discriminatory, non-consensual and, in general, unlawful uses, including through reporting channels and procedures for responding to and managing violations; and (iv) provide training programs for employees and/or collaborators.
To this end, the Firm remains available to provide assistance and support in connection with the correct application of AI legislation, including in light of the innovations introduced by the recently approved Digital Omnibus.
***
Deadline summary
| Scope | Original deadline | New deadline | Notes |
|---|---|---|---|
| Prohibited practices and AI literacy requirements | 2 February 2025 | Unchanged | Already in force |
| General Purpose AI Models (GPAIs) | 2 August 2025 | Unchanged | Already in force |
| Transparency obligations (content generated and/or manipulated by AI) | 2 August 2026 | 2 December 2026 (only for systems already on the market) | For new systems, the original deadline remains |
| Autonomous high-risk systems | 2 August 2026 | 2 December 2027 | Systems not incorporated into regulated products |
| High-risk systems embedded in products | 2 August 2026 | 2 August 2028 | Products subject to EU safety regulations |
