July 27, 2026 | Law Implementation | Data Governance

On 27 July 2026, the Regulation on the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI Regulation) entered into force. The Regulation extends the legal basis for processing special categories of personal data for bias detection and correction. Under the AI Act (Regulation (EU) 2024/1689), this legal basis applied only to providers of high-risk AI systems. The Regulation extends it to deployers of high-risk AI systems and to providers and deployers of other AI systems and models, where processing is strictly necessary and subject to appropriate safeguards. The Regulation also sets fixed application dates for data governance obligations. Obligations for AI systems listed in Annex III of the AI Act would apply from 2 December 2027, and obligations for AI systems covered by Article 6(1) of the AI Act would apply from 2 August 2028.

July 27, 2026 | Law Implementation | Authorisation, Registration And Licensing

On 27 July 2026, the Regulation on the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI Regulation) entered into force. The Regulation simplifies the content required for registration of AI systems in the EU database, under Article 49(2) of the AI Act, for providers that consider their AI systems exempt from high-risk classification pursuant to Article 6(3). Providers applying Article 6(3) remain obligated to document their assessment before the AI system is placed on the market or put into service, and national competent authorities may request that assessment. SME exemptions from certain requirements are extended to small mid-cap enterprises (SMCs), defined by reference to Commission Recommendation (EU) 2025/1099.

July 27, 2026 | Law Implementation | Data Governance

On 27 July 2026, the Regulation on the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI Regulation) entered into force. The Regulation sets fixed application dates for high-risk AI system obligations, including cybersecurity requirements under Article 15 of the AI Act (Regulation (EU) 2024/1689). Obligations for Annex III systems apply from 2 December 2027, and obligations for Article 6(1) systems apply from 2 August 2028. The Regulation clarifies the relationship between the cybersecurity requirements of the AI Act and those of the Cyber Resilience Act (Regulation (EU) 2024/2847). High-risk AI systems that fall within the scope of the Cyber Resilience Act and meet the conditions of its Article 12(1) are deemed to comply with the AI Act's cybersecurity requirements. The Regulation also moves the Machinery Regulation (EU) 2023/1230 from Section A to Section B of Annex I to the AI Act, narrowing the AI Act's direct application to AI-enabled machinery, with the Commission empowered to adopt delegated acts by 2 August 2028 adding health and safety requirements to Annex III of the Machinery Regulation reflecting the AI Act's Chapter III, Section 2, and Articles 17, 19, 72 and 73.