EU formally adopts Regulation 2026/1744, delaying AI Act high-risk rules to 2027

Regulation (EU) 2026/1744, the Digital Omnibus on AI, amends the AI Act and delays enforcement of its high-risk system obligations.

It was signed on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force three days later, on 27 July 2026.

What it is

Regulation 2026/1744 is described in the Official Journal record as a measure amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence.

The measure was adopted after the European Parliament's position of 16 June 2026 and the Council's decision of 29 June, and signed in Strasbourg on 8 July.

What it requires

The regulation sets a fixed timeline that moves most Chapter III duties for stand-alone high-risk AI systems, those intended for purposes that are deemed to be high-risk, as set out in Annex III of the AI Act.

These Annex III obligations now apply from 2 December 2027, while high-risk AI systems used as a safety component of a product or otherwise subject to EU health and safety harmonisation legislation under Annex I of the AI Act are pushed to 2 August 2028.

The regulation's recital 40 justifies the delay by citing the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities.

Article 4 no longer requires operators to ensure, to their best extent, a sufficient level of AI literacy, but provides that providers and deployers shall take measures to support its development.

The regulation also gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2) watermarking duties.

What security leaders should do

Security and compliance teams should update AI Act readiness roadmaps to reflect 2 December 2027 for Annex III stand-alone systems and 2 August 2028 for Annex I embedded systems, rather than the original August 2026 and 2027 dates. Teams should keep delivering transparency controls under Article 50, since those obligations and the December 2026 watermarking deadline for pre-existing generative systems were not deferred. Because Article 4 now asks for support measures rather than guaranteed literacy outcomes, security leaders should still document training and awareness programs for staff and contractors who operate AI systems, since national market surveillance authorities retain enforcement power over that duty. Finally, programs should track upcoming Commission guidelines and harmonised standards referenced as the justification for the delay, since those documents will define what counts as adequate risk management once the Annex III deadline arrives.