AI Omnibus (Digital Omnibus on AI)

It is prohibited to place on the market, put into service or use an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of such a person engaged in sexually explicit activities, without that person’s freely given, specific, informed, unambiguous and explicit consent, or that generates or manipulates material or a performance within the meaning of Art. 2, points (c) and (e), of Directive 2011/93/EU, except where a "without right" defence applies under national law. Art. 5(1a) narrows the scope: placing on the market or putting into service is prohibited only where such generation or manipulation is the system’s intended purpose, or where its design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome without significant technical modification and the system lacks reasonable and adequate technical safety measures and other safeguards to reliably prevent it, taking reasonably foreseeable misuse into account, and to correct observed or reported misuse. Use is prohibited only where the deployer uses the system for that purpose. In practice, the decisive question is whether the "reliably prevent and correct" safeguards can be evidenced.

Applies when

Chinese companies offering image, video or audio generation or face-swap and editing capabilities, and companies deploying such tools in the EU. Even a general-purpose creative tool can fall within the prohibition where the misuse outcome is reasonably foreseeable and reproducible without significant technical modification.

Deadline: Applies from 2 Dec 2026.

Applies from: 2026-12-02

Evidence to retain

• · Safeguard design documentation covering input blocking, output filtering, person recognition and consent verification logic
• · Red-team test report against reasonably foreseeable misuse, with bypass-rate statistics
• · Standard operating procedure and case log for receiving and handling abuse reports
• · Version history of the model and safety policies evidencing that the corrective capability remains effective

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

The new AI Act Art. 111(4) requires providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content that were placed on the market before 2 Aug 2026 to take the necessary steps to comply with Art. 50(2) machine-readable marking and detectability by 2 Dec 2026. Legacy products cannot rely on having launched before the application date to avoid marking.

Applies when

Chinese generative products already available to EU users before 2 Aug 2026 (image generation, voice synthesis, AI writing, digital humans), whether via a first-party app, an API or EU distribution channels.

Deadline: To be completed by 2 Dec 2026.

Applies from: 2026-07-27

Evidence to retain

• · Inventory of legacy systems with evidence of the date each was first placed on the EU market
• · Technical retrofit plan for the marking capability and its release records
• · Detectability verification report comparing outputs before and after the retrofit

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

The amended AI Act Art. 11(1) allows SMEs including start-ups, and small mid-cap companies (SMCs, as defined in point (2) of the Annex to Recommendation (EU) 2025/1099), to provide the Annex IV elements in a simplified manner using the simplified technical documentation form to be established by the Commission, which notified bodies must accept. A company must first determine and evidence its size classification and plan the documentation effort accordingly.

Applies when

Chinese companies placing high-risk AI systems on the EU market that meet the EU SME or small mid-cap definitions. Note that the EU size test aggregates linked and partner enterprises, so subsidiaries of Chinese groups frequently fail to qualify.

Applies from: 2026-07-27

Evidence to retain

• · Size classification determination (headcount, turnover or balance-sheet total, with linked and partner enterprises aggregated)
• · Completed simplified technical documentation form
• · Notified body confirmation that the simplified form was accepted

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

The new AI Act Art. 4a permits providers of high-risk systems, to the extent strictly necessary for bias detection and correction under Art. 10(2)(f) and (g), to exceptionally process special categories of personal data, provided six cumulative conditions are met in addition to the GDPR and related instruments: (a) the objective cannot be effectively achieved by processing other data, including synthetic or anonymised data; (b) the data is subject to technical limitations on re-use and to state-of-the-art security and privacy-preserving measures including pseudonymisation; (c) security measures with strict access controls and documented access ensure that only authorised persons under confidentiality obligations can access it; (d) the data is not transmitted, transferred or otherwise accessed by other parties; (e) it is deleted once the bias has been corrected or the retention period ends, whichever comes first; and (f) the GDPR records of processing state why the processing was strictly necessary and why other data could not achieve the objective. Art. 4a(2) extends the route conditionally to providers and deployers of other AI systems and models and to deployers of high-risk systems, without creating any obligation to perform bias detection.

Applies when

Chinese AI companies that need to assess model bias across race, ethnicity, religion, health or sexual orientation. This is one of the few explicit EU routes permitting sensitive-data processing for fairness evaluation, but every one of the six conditions must be evidenced; failing any one returns the processing to the general prohibition in GDPR Art. 9.

Applies from: 2026-07-27

Evidence to retain

• · Strict-necessity justification, including why synthetic or anonymised data would not work
• · Implementation description and configuration evidence for pseudonymisation and re-use limitations
• · Access control list, access logs and signed confidentiality undertakings
• · Deletion execution records with trigger conditions and timestamps
• · The corresponding entry in the GDPR Art. 30 records of processing activities

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

The new AI Act Art. 6(1a)-(1c) provides that AI systems used solely for non-safety-related user assistance, performance optimisation, service efficiency, automation, convenience or quality control do not qualify as safety components; that systems whose failure or malfunction would endanger health and safety do; and that a product required to undergo third-party conformity assessment solely because of risks other than health and safety, in particular radio-spectrum allocation or electromagnetic interference not affecting health and safety, does not satisfy Art. 6(1)(b). Annex I Section A point 1 was deleted and the Machinery Regulation (EU) 2023/1230 moved to Section B point 21. Companies should re-issue their written classification conclusions accordingly.

Applies when

Embodied-AI, industrial robotics, smart hardware and in-vehicle system vendors. Typical effect: a vision model used for cycle-time optimisation or quality inspection whose failure would not endanger persons may no longer be a safety component and thus falls outside the Annex I high-risk route, while models governing emergency stop, obstacle avoidance or force control remain safety components.

Applies from: 2026-07-27

Evidence to retain

• · Re-run safety-component determination under Art. 6(1a)-(1c), listing failure consequences function by function
• · Cross-reference to product safety engineering and FMEA analyses
• · Approval record for any change of classification conclusion and its impact on the conformity assessment plan

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)