Digital Omnibus enters into force, setting Dec 2, 2026 AI-labelling deadline

The Digital Omnibus amending the EU AI Act, Regulation (EU) 2026/1744, was published in the Official Journal of the EU on 24 July 2026 and came into force on the 27th.

That amendment set the date when a grace period for marking AI-generated content ends and when new prohibitions on non-consensual intimate deepfakes and AI-generated child sexual abuse material begin to apply.

What it is

Article 50 of the AI Act addresses four scenarios, split between obligations on providers who develop AI systems and obligations on deployers who use them.

These transparency rules have applied since August 2, 2026, and the Digital Omnibus did not postpone them; it shortens the grace period for AI-generated content.

What it requires

Providers of generative AI systems already on the market before August 2, 2026 now have until December 2, 2026 to comply with the machine-readable marking and detection requirement, a grace period confirmed for systems placed on the market before that earlier date.

Starting the same day, the new prohibition extends to so-called nudifier applications, meaning AI systems that generate or manipulate sexually explicit or intimate images, video, or audio without explicit consent, or that create CSAM.

Violations of that intimate-content ban may trigger fines of up to 35 million euros or 7% of annual worldwide turnover, whichever is higher.

Missing the Article 50 marking and labelling obligations carries a separate penalty of up to 15 million euros or 3% of worldwide annual turnover.

Enforcement sits with national market surveillance authorities, the AI Office for systems under its supervision, and the European Data Protection Supervisor when EU institutions act as providers or deployers.

Providers can also point to the voluntary Code of Practice on Transparency of AI-generated Content, which by the end of July 2026 had about 190 companies and organisations signed on.

What security leaders should do

Inventory every generative AI system that was already running before August 2, 2026 and confirm its outputs now carry machine-readable marks ahead of the December 2, 2026 deadline. Review any system capable of producing intimate imagery or audio of real people and confirm it blocks non-consensual requests, given the scale of the new fines tied to the intimate-content ban. Decide whether signing the Code of Practice gives your organization a faster, better-documented path to demonstrating compliance than building bespoke marking and detection evidence from scratch. Clarify internally which teams hold the provider role and which hold the deployer role for each AI system, since the marking, labelling, and enforcement duties differ between the two under Article 50.