What the AI Act digital omnibus changed for companies using AI (Regulation (EU) 2026/1744)

Regulation (EU) 2026/1744 amends the AI Act, Regulation (EU) 2024/1689, in 43 points. The table lists the changes that matter to a company that uses AI systems rather than building high-risk products.

Article 5(1)(ba) prohibits “the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation”.

Article 5(1)(bb) prohibits “the placing on the market, the putting into service or the use of an AI system that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law”. Directive 2011/93/EU is the EU directive on combating the sexual abuse and sexual exploitation of children.

For a company using AI, the deployer rule in Article 5(1a)(b) is the one that applies: “the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.” Article 5(1b) adds that manipulation which does not increase the exposure of depicted intimate parts or alter the nature of depicted sexually explicit activities is not manipulation for point (ba).

The date is in Article 113(3)(a) as amended: “Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026”. Breaching a prohibition in Article 5 carries fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3), not amended). For SMEs, and now for SMCs, the lower of the two applies.

A related duty already applies. Since 2 August 2026, Article 50(4) has required: “Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated.”

Article 4 was replaced. Providers and deployers still take measures to support the AI literacy of their staff and of others acting on their behalf, and Article 4(1) now ends: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The earlier wording, to ensure “to their best extent, a sufficient level of AI literacy”, is gone.

What the duty asks for now, what the Commission's Q&A expects and a checklist with training records are on the page about AI literacy under Article 4. The new prohibitions belong in that training: people who generate images, video or audio should know what is prohibited.

Article 26, the deployer duties for high-risk AI systems. No point of 2026/1744 amends it. Deployers use the system according to the instructions for use, assign human oversight to people with the necessary competence, training and authority (Article 26(2)), monitor the system, keep the logs under their control for at least six months (Article 26(6)) and inform workers before using a high-risk system at the workplace. Only the start date moved, through Article 113.

The transparency duties in Article 50. Only Article 50(7), on codes of practice, was replaced. The deepfake disclosure in Article 50(4) and the marking duty in Article 50(2) read as before.

The original prohibited practices in Article 5(1)(a) to (h), which have applied since 2 February 2025, the definitions of deployer (Article 3(4)) and AI literacy (Article 3(56)), the list of high-risk uses in Annex III, and the fine ceiling for prohibited practices in Article 99(3).

How these duties apply to a company using LLMs is on the page about EU AI Act obligations.

The new prohibitions apply from 2 December 2026. These steps fit into the documents most companies already keep.

Acceptable-use rules are easier to keep when access to models runs through one place. Standard Compute is one way to do that for model APIs, Claude Code and Claude Desktop: give every person and every app its own key, all under one company account. Decide which models each key can use, so every app and every team member gets exactly the models you approve.

Choose exactly which inference providers may handle your data, for the whole company, a team or a single key. Every admin change is recorded with before and after values, so the record of who could use which model sits next to your policy.

These controls decide which models and providers can be used. They do not review prompts or outputs, and they do not make any use lawful.