A postponement is not an amnesty
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, is dated 8 July 2026, was published in the Official Journal on the 24th and entered into force on 27 July. It amends the AI Act (Regulation (EU) 2024/1689), but it moves only one exam out of several: the one for high-risk systems.
High-risk systems
Until 2 December 2027 for Annex III systems (employment, biometrics, education) and until 2 August 2028 for those embedded in regulated products under Annex I.
What is already running
The Article 5 prohibitions have applied since February 2025, the obligations for general-purpose models since August 2025, and the Article 50 transparency rules are enforceable from 2 August 2026.
AI literacy (Art. 4)
It moves from guaranteeing a level of literacy to requiring measures to promote it, without imposing a specific level on anyone.
Two new prohibitions
From 2 December 2026: generating or manipulating realistic intimate images of identifiable people without their consent, and generating child sexual abuse material.
The calendar at a glance
| Date | What comes into play |
|---|---|
| February 2025 | Article 5 prohibitions. |
| August 2025 | Obligations for general-purpose AI models. |
| 27 July 2026 | The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force. |
| 2 August 2026 | Article 50 transparency becomes enforceable. |
| 5 October 2026 | Spain's Royal Decree 723/2026 enters into force: employers must inform workers in writing when an algorithmic system takes part in decisions about their work. |
| 2 December 2026 | The two new prohibitions begin to apply. The deadline for the Article 50.2 technical marking also falls here, for systems placed on the market before 2 August 2026 (new Art. 111.4). |
| 2 December 2027 | Annex III high-risk systems. |
| 2 August 2028 | High-risk systems embedded in regulated products (Annex I). |
Article 50: the one that will touch the most companies
It lacks the glamour of the prohibitions and the muscle of high risk, but it reaches more companies than either. It requires three things: that people know they are interacting with an AI, unless that is obvious; that synthetic audio, image, video or text content is marked in a machine-readable format; and that deepfakes are disclosed as such. Breaches are punishable by up to €15 million or 3 % of worldwide annual turnover (Art. 99.4.g). For SMEs and startups the lower of the two amounts applies (Art. 99.6), and that covers every fine in the article, including those under Article 5. But “lower” is not “zero”.
Three startups, three misunderstandings
None of them exists, and all three are recognisable.
The chatbot with a name and a photo
It believes Article 50 is about deepfakes. But 50.1 requires telling people they are talking to an AI system, and an assistant with a name and a profile picture is not obvious.
The 2025 video tool
It breathes easy because it has until 2 December. That deadline covers only the technical marking under 50.2, and only for systems placed on the market before 2 August 2026. And the new prohibitions are not judged by what the model can do, but by the safeguards you have put in place.
The shifts-and-tasks app
Depending on how it assigns work, it may fall under the Annex III employment uses, which have moved to December 2027. But Royal Decree 723/2026 already requires workers to be told how the algorithm works. And those rules will be asked of the provider.
“In Spain they don’t fine yet”: only half true
The organic law bill on the proper use and governance of AI, which designates the authorities (AESIA at the head) and sets the penalty regime, is still going through Parliament. But the Regulation is directly applicable, and the obligation does not become optional because the fine is pending. The first to ask for accounts is usually not an agency but the investor in their due diligence or the corporate client with their vendor questionnaire. Neither waits for the official gazette.
What to do this week
A one-page inventory
The AI systems you use or sell and the role you play in each: provider or deployer.
Run your product through Article 50
Is it clear from the first contact that it is an AI? Is what it generates marked?
Prepare the explanation
If your product touches employment decisions, have the explanation of how it works ready: your clients will ask for it from 5 October.
“A postponement is not an amnesty: it is a calendar.”
Miriam Acerete · Legal Today
This is a summary. The full article, with the examples and the analysis, is published in Legal Today (in Spanish).