The AI Act after the Digital Omnibus: the new timeline and your contracts

Regulation (EU) 2026/1744 amends the AI Act, Regulation (EU) 2024/1689. It was signed in Strasbourg on 8 July 2026 and published in the Official Journal of the European Union on 24 July 2026. It enters into force on the third day following its publication, that is, 27 July 2026.

It does not replace the AI Act. It adjusts its timeline and some of its obligations. Its recital explains the postponement by delays in the availability of standards and guidance, and in the setting up of national authorities.

These are the dates that follow from the text of the AI Act as amended by revised Article 113:

• 2 February 2025: Chapters I and II, including prohibited practices and the AI literacy obligation.
• 2 August 2026: general date of application, which has not changed. It covers Article 50 in particular.
• 2 December 2026: new prohibitions added to Article 5, and end of the marking deadline for systems placed on the market before 2 August 2026.
• 2 December 2027: high-risk rules for Annex III systems. The original date was 2 August 2026.
• 2 August 2028: high-risk rules for Annex I systems, built into regulated products. The original date was 2 August 2027.

The new prohibitions target in particular systems that generate realistic intimate or sexually explicit images of an identifiable person without their consent. They have little bearing on contract management, but they add to the Article 5 list.

New Article 111(4) sets 2 December 2026 for systems already on the market. A recital of the regulation refers to a four-month transition period.

This deadline is narrow. It only covers providers of AI systems that generate synthetic content, and only for systems placed on the market before 2 August 2026. It only concerns Article 50(2): marking outputs in a machine-readable format. The text requires this marking without using the word watermark.

A system placed on the market after 2 August 2026 does not benefit from this deadline. Nor do the other paragraphs of Article 50.

Article 50 splits obligations between two roles. The provider develops the system or places it on the market. The deployer uses it under its own authority in a professional context. A company that buys an AI assistant is generally a deployer, but the classification depends on the facts.

• Providers: inform people that they are interacting with an AI, unless this is obvious from the context, and mark generated content.
• Deployers: disclose deepfakes, and state that text published to inform the public on matters of public interest has been generated or manipulated by AI.

This last obligation does not apply when the text has undergone human review or editorial control, and a person holds editorial responsibility. A draft contract exchanged between two parties is not, on a first reading, a text published to inform the public. Your lawyer should assess this point based on actual use.

Annex III lists a set of areas. For a company, these include recruitment and the management of employment relationships, as well as creditworthiness assessment of natural persons. Justice is listed for systems used by judicial authorities or on their behalf.

Reviewing business contracts does not appear as a category in its own right. This does not remove the need to analyze each case: what matters is the intended purpose of the system. Article 6(3) also provides that an Annex III system is not high-risk if it does not pose a significant risk of harm.

When a system is high-risk, Article 26 requires the deployer in particular, from the postponed date:

• to use it in accordance with the instructions for use;
• to assign human oversight to competent people;
• to monitor its operation and keep the logs under its control for at least six months;
• to inform workers before using it in the workplace.

A company can also become a provider, within the meaning of Article 25, if it markets the system under its own brand, substantially modifies it or changes its intended purpose to the point of making it high-risk.

The regulation does not rewrite your contracts. A date stated in a clause, an annex or a compliance plan does not move on its own. The review can follow a few questions:

• Timeline: does the contract cite 2 August 2026 or 2 August 2027 for high-risk requirements?
• Roles: are the provider and the deployer identified, and is the intended use described?
• Documentation: do you have access to the instructions for use and the information you need for your own obligations?
• Logs: who keeps them, and can you access them for the required period?
• Changes: how are you informed of a change of model or intended purpose?
• Subprocessing: does the contract state who processes the data, in line with Article 28 of the GDPR?

For a provider of a high-risk system, Article 25(4) requires a written agreement with third parties that supply integrated components or services. It specifies the information and assistance required. The Digital Omnibus expressly adds this paragraph to the list of infringements penalized under Article 99.

Article 99 provides for fines of up to €35 million or 7% of total worldwide annual turnover for prohibited practices. For deployer obligations under Article 26 and transparency obligations under Article 50, the cap is €15 million or 3%. For an SME, the lower amount applies. The Digital Omnibus extends this rule to small mid-cap companies for fines under Article 99(4) and (5), which include this €15 million cap.

Still to be watched: harmonized standards, Commission guidance and codes of practice on marking. Article 50(7) leaves it to the Commission to assess whether these codes are sufficient. The penalty regime also depends on each Member State.

Docform does not classify your AI systems for you. It helps you find and review the contracts concerned: the contract repository centralizes your contracts by folder, tag and status, and deadline tracking makes renewals visible. The assistant analyzes a contract and flags points of attention, citing the source passage, according to the contract playbook defined by your team. AI can make mistakes: the lawyer checks and decides.