Digital Omnibus on AI
European Union · Regulation · European Parliament and Council of the European Union
Our summary
This regulation amends three existing EU rules to streamline how artificial intelligence systems are governed by addressing implementation challenges and reducing compliance burden. It applies to providers and deployers of AI systems across the European Union and related territories. The changes clarify technical requirements, extend protections against bias, support small and medium enterprises, and enable better coordination between EU and national authorities.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
7 sections
Jump to a chapter
Article 1 Amendments to Regulation (EU) 2024/1689
The amendment modifies AI system definitions and classifications, requires providers and deployers to support staff competence and cooperate closely when transferring systems between providers with technical documentation and access; prohibits AI systems generating non-consensual intimate images or child exploitation material except where lacking safeguards or foreseeability. It establishes unified conformity assessment procedures for high-risk AI systems under Union harmonisation legislation, with notified bodies designated under such legislation permitted to assess compliance if verified during existing notification and required to apply for designation by 28 January 2028. Member States must establish operational AI regulatory sandboxes by 2 August 2027; the Commission may promote Union-level codes of practice for labelling synthetic content and adopt rules if inadequate; SMEs and start-ups may use simplified quality management guidelines.
Article 75b Commitments
Allows the AI Office to make an operator's proposed commitments binding and close proceedings if they ensure rule compliance, while reserving the right to reopen if facts change, the operator violates the commitments, or information was false or incomplete.
Article 75c Non-compliance, fines and periodic penalty payments
The AI Office may adopt decisions establishing non-compliance when operators fail to comply with relevant regulation or binding commitments, and shall order necessary steps to achieve compliance within a reasonable timeframe; administrative fines apply for regulatory infringements, failure to comply with decisions or binding commitments, or supplying incorrect or incomplete information. The AI Office may also impose periodic penalty payments up to 5 percent of average daily income or worldwide annual turnover per day to compel operators to submit to investigations, comply with information requests, undergo inspections, provide answers, comply with corrective actions or binding commitments, or comply with non-compliance decisions. The Court of Justice has unlimited jurisdiction to review, cancel, reduce or increase imposed fines; enforcement powers are subject to a five-year limitation period from when the infringement occurs or ceases.
Article 75d Safeguards and further specification
Operators subject to AI Office oversight have rights of defence and file access under negotiated disclosure terms, subject to business secrets protection; the AI Office publishes decisions under binding commitment and non-compliance provisions with party names and main contents including penalties. National public authorities supervising fundamental rights may request information from market surveillance authorities in accessible and machine-readable format, which shall grant access without undue delay and cooperate closely. The Commission received delegated powers for five years from 1 August 2024 and for certain provisions from 27 July 2026, with reports required nine months before each period ends, tacit extension unless objected within three months, and revocation possible at any time by either Parliament or Council; delegated acts enter into force unless objected within three months, extendable by three months.
Article 2 Amendments to Regulation (EU) 2018/1139
Requires that when aviation regulation articles adopt implementing or delegated acts covering AI systems functioning as safety components, they must account for the AI regulation's requirements for such systems.
Article 3 Amendments to Regulation (EU) 2023/1230
The Commission must adopt acts by 2 August 2028 to add health and safety requirements to machinery safety standards for high-risk AI systems classified under the AI Act that are safety components in machinery products or themselves machinery products; until such standards exist, compliant high-risk AI systems are presumed to meet machinery regulation health and safety requirements. The Commission's power to adopt these acts lasts five years from 27 July 2026 and may be revoked by Parliament or Council. Delegated acts under the machinery regulation enter into force only if neither Parliament nor Council objects within two months of notification, or both have informed the Commission they will not object; this period extends for two months if either body initiates extension.
Article 4 Entry into force and application
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 8 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 2 of 4
- Registration and notification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 1 of 5
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 14 are shown.
Article 75b 3 controls
- Applies to: Public authorityDrafted by the Index
The AI Office may make an operator's proposed commitments legally binding and close proceedings by decision if those commitments will ensure the operator complies with the Regulation.
- Applies to: Public authorityDrafted by the Index
The AI Office may reopen proceedings if material facts underlying its decision have changed, the operator violates its binding commitments, or the decision relied on incomplete, false or misleading information from the operator.
- ObligationApplies to: Public authorityDrafted by the Index
The AI Office must reject proposed commitments in a reasoned decision if it believes they cannot effectively ensure the operator will comply with the Regulation.
Article 75c 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The AI Office must adopt a decision when it finds that an operator does not comply with the Regulation or with binding commitments.
- ObligationApplies to: Public authorityDrafted by the Index
Before deciding on non-compliance, the AI Office must notify the operator of preliminary findings and explain what corrective action or remedial measures it is considering.
- Applies to: Public authorityDrafted by the Index
The AI Office may order an operator to take necessary measures to ensure compliance within a reasonable timeframe specified in the enforcement decision and to report on those measures once implemented.
- Applies to: Public authorityDrafted by the Index
The AI Office may engage in structured dialogue with an operator during enforcement to propose or refine commitments before finalising corrective action requirements.
Article 75d 4 controls
- RightApplies to: OthersDrafted by the Index
Operators subject to AI Office supervision have full rights of defence and access to the AI Office file under negotiated disclosure rules that protect legitimate business secrets.
- Applies to: Public authorityDrafted by the Index
The AI Office may adopt decisions setting out disclosure terms when the AI Office and operator disagree on access to confidential business information during proceedings.
- Applies to: Public authorityDrafted by the Index
The Commission may adopt implementing acts to specify practical procedures for file access and negotiated disclosure of information in AI Office proceedings.
- ObligationApplies to: Public authorityDrafted by the Index
The AI Office must publish decisions made under the enforcement articles, disclosing the names of parties, the main content and any penalties, while respecting rights to protect confidential information.
Article 2 1 control
- ObligationApplies to: Public authorityDrafted by the Index
When public authorities adopt implementing or delegated acts for aircraft safety covering AI systems that are safety components under the AI Act, they must account for the high-risk AI requirements in that Act's Chapter III, Section 2.
Article 3 2 controls
- ObligationApplies to: Public authorityDeadline Drafted by the Index
The Commission must adopt delegated acts to add health and safety requirements for high-risk AI systems under the AI Act to the product safety regulation's Annex III, reflecting the high-risk requirements in that Act.
- Applies to: ProviderDrafted by the Index
Until the Commission adopts harmonised standards or common specifications for high-risk AI systems, high-risk systems that comply with the AI Act's referenced standards shall be presumed to conform to the product safety regulation's essential health and safety requirements.
Change history
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)
- Official text wordingSource for this change (opens in a new tab)