The Digital Omnibus on AI is law: published in the Official Journal on 24 July as Regulation (EU) 2026/1744, in force from 27 July, with a derogation from the usual twenty days to land before 2 August. The headlines reported a delay, and in our July audits we keep finding clients convinced nothing is left to do.
What actually slipped
The delay concerns high-risk systems. Standalone Annex III systems (recruitment screening, credit scoring, law enforcement support) move from 2 August 2026 to 2 December 2027; those embedded in regulated products under Annex I from 2 August 2027 to 2 August 2028; national sandboxes to 2 August 2027.
In June we wrote that for the average SME the AI Act almost always comes down to the transparency obligations. The omnibus does not change that: anyone who reads "postponed" and closes the file is reading the part of the regulation that does not apply to them.
What starts on 2 August regardless
Article 50 was left substantively untouched, and on 20 July the Commission adopted its final guidelines on applying it: not binding, but what the market surveillance authorities will read.
- Chatbots: the user must know they are talking to an AI no later than the first interaction. The "obvious from context" exception is narrower than people read it: a disclosure buried in the FAQ or the terms does not reach the first interaction.
- Synthetic content: providers of generative systems must mark output in a machine-readable format, with no technique mandated (watermarking, provenance metadata, cryptographic methods). Systems already on the market before 2 August have until 2 December 2026.
- Deepfakes and public-interest text: the duty sits with whoever publishes them; for text there is a way out, human review with documented editorial responsibility.
- Emotion recognition and biometric categorisation: the people exposed must be informed.
The code of practice on marking, published on 10 June, stays voluntary.
What getting it wrong costs
The penalties in Articles 99 and 101 also start applying on 2 August. Article 50 sits in the band up to 15 million euro or 3% of worldwide turnover, not the 35 million reserved for prohibited practices, and SMEs pay the lower of the fixed amount and the percentage. Numbers wildly out of proportion to the cost of fixing it.
Who enforces it in Italy
Law 132/2025 gives ACN market surveillance, with inspection and sanctioning powers, and AgID the notifying authority role. This is not Brussels: it is the agency you already know from NIS2. Then there is the criminal layer almost nobody connects to Article 50: since 10 October 2025, article 612-quater of the criminal code punishes distributing images or voices altered with AI, without consent and causing unjust harm, with one to five years in prison. And from 2 December 2026 the omnibus bans systems that generate non-consensual intimate content or child sexual abuse material.
Verdict
For the average SME this is not a project, it is half a day of work: one line in the chatbot welcome message, a note on generated content, one clause in the SaaS contract on who owns the 50(2) marking obligation. Do it before 2 August, because the expensive part is not the fine: it is finding out in September that your vendor assumed the obligation was yours.