After intense negotiations between the European Parliament, the European Council and the European Commission following the Commission’s proposed European Union (EU) Digital Omnibus targeting amendments to the EU Artificial Intelligence (AI) Act (see our alerts here and here), on Friday 24 July 2026, the law¹ amending the AI Act (the AI Act Amendment) was published in the Official Journal, and it became effective on Monday, 27 July 2026.

The key amendments to the AI Act impact both providers and deployers, and are discussed in more detail below. In brief:

• The AI Act Amendment extends the deadlines for compliance with the obligations regarding high-risk AI systems (originally due to apply on 2 August 2026), by 18 months for some high-risk AI systems and two years for others, recognising the need for more time and in light of “lessons learnt” from the experience gathered from the implementation of applicable obligations so far.
• The 2 August 2026 deadline in relation to transparency requirements for certain AI systems remains in place, except for AI systems (including general-purpose AI systems) generating synthetic audio, image, video or text content—these benefit from a short four months’ extension.
• The list of prohibited AI systems has been expanded, to include AI systems generating non-consensual intimate images, videos, audio and similar material.
• The obligation in relation to AI literacy has been softened, as providers and deployers must now take measures to support the development of AI literacy rather than (as previously) ensure, to their best extent, a sufficient level of AI literacy.
• Regarding the AI supply chain, the AI Act now details the original provider’s obligations to cooperate with and assist the new provider and specifies fines for breach of that obligation.

Details of the Amendments

Extended deadlines: The AI Act Amendment recognises that in relation to the obligations for high-risk AI systems, the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities have led to challenges that jeopardise the effective application and enforcement of those obligations. The AI Act Amendment states that these delays and challenges risk a significant increase in implementation costs in a way that does not justify maintaining their initial date of application which was 2 August 2026. Against that background, the deadline for AI systems classified as high-risk pursuant to Article 6(2) and Annex III has been extended to 2 December 2027; and for AI systems classified as high-risk pursuant to Article 6(1) and Annex I, i.e. specific EU laws including product legislation—to 2 August 2028. The AI Act Amendment recognises the need for additional clarification and regulatory guidance on implementation, requiring the Commission to ensure that measures in support of compliance are in place in due time. In addition, the deadline in relation to transparency requirements for AI systems (including general-purpose AI systems) generating synthetic audio, image, video or text content has been extended to 2 December 2026. The 2 August 2026 deadline in relation to transparency requirements for all other relevant AI systems remains in place.

New prohibitions: In light of technological and societal developments since the adoption of the original AI Act, including the deployment and widespread use of AI systems generating non-consensual intimate images, videos, audio and similar material (‘non-consensual intimate material’) and child sexual abuse material, the EU found it necessary to amend the list of prohibited AI systems. AI systems that generate or manipulate non-consensual intimate material pose a risk that is unacceptable for the EU and are prohibited as of 2 December 2026.

AI literacy: Previously, providers and deployers had to take measures to “ensure, to their best extent, a sufficient level of AI literacy” of their staff and other persons dealing with the operation and use of AI system on their behalf. Now, they need to take measures to “support the development of AI literacy” of those individuals. Thus, they are not required to guarantee any specific level of AI literacy. Recognising that the previous obligations created an additional compliance burden and were not suitable for all types of providers and deployers, whereas AI literacy should be a strategic priority (regardless of regulatory obligations and potential sanctions), the AI Act Amendment now includes obligations on the Commission and Member States to support and facilitate the efforts of providers and deployers, including through offering training opportunities, providing informational resources, and allowing exchange of good practices.

Bias detection: Under the AI Act, providers of high-risk AI systems are already allowed to process special categories of personal data in order to detect and correct bias, provided six listed conditions are satisfied. The AI Act Amendment now allows providers and deployers of other AI systems and models, as well as deployers of high-risk AI systems, to process special categories of personal data if the six listed conditions are satisfied and if it is strictly necessary to detect and correct biases likely to affect individuals’ health and safety, have a negative impact on their fundamental rights or lead to prohibited discrimination, in particular where data outputs influence inputs for future operations.

AI supply chain: In relation to responsibilities along the AI value chain, the AI Act Amendment sets out detailed steps as to how the initial providers have to cooperate with the new providers in respect of, for example, providing necessary information and targeted technical access (Article 25). A breach of these obligations has been added to the list of non-compliance which can be penalised with fines of up to 3% of global annual turnover or 15 million euro (approx. US$ 17 million), whichever is higher (Article 99(4)).

Inter-play with other EU laws: More provisions have been introduced that address how the obligations under the AI Act interact with the obligations under a myriad of other EU laws, including with (i) the Cyber Resilience Act, and how the obligation under it in relation to essential cybersecurity of products with digital elements interacts with the cybersecurity requirements for high-risk AI systems under the AI Act; (ii) the GDPR, and how the fundamental rights impact assessment and the data protection impact assessment (DPIA) work together; and (iii) other EU product legislation, for example regarding limitations on certain obligations introduced by the AI Act where other EU legislation lays down requirements providing for an equivalent level of protection of health, safety or fundamental rights, as well as regarding conformity assessment procedures and applications for designations of conformity assessment bodies.

Powers of the AI Office: The provisions regarding the powers of the AI Office, which sits within the European Commission in Brussels, have been strengthened, confirming that the AI Office will act as the market surveillance authority for general purpose AI as well as for AI systems qualifying as a very large online platform (VLOP) or a very large online search engine (VLOSE) in accordance with the Digital Services Act, or where the AI system is embedded in such a platform or search engine (Articles 64 and 75-75d).

Technical standards: Regarding standardisation, the AI Act Amendment includes an obligation on the Commission to request, without undue delay, the European standardisation organisations to develop harmonised standards and other deliverables to facilitate the joint compliance and presumption of conformity with the requirements and obligations on providers of high-risk AI systems under the AI Act and the relevant requirements and obligations in other EU product legislation. The European standardisation organisations announced last week (on 22 July 2026) that the first European AI standard supporting the AI Act has been published: EN 18286 on Quality Management System. The Chair of the European Committee for Standardisation (CEN) and Committee for Electrotechnical Standardization (CENELEC) has confirmed that they are expecting to conclude the public consultations on all other standards underpinning the high-risk requirements in the AI Act, and to publish them in late 2026 / beginning of 2027.

Other amendments: Further clarification has been adopted by the AI Act Amendment to define the term “safety component” in relation to high-risk AI systems (Articles 4 and 6) and the operations of sandboxes (Article 57).

The next steps for providers and deployers of AI systems and tools include recalibrating the priorities in order to achieve compliance with the obligations under the AI Act and continue monitoring for publication of any consultations or guidance. Please contact Jenny Arlington or another member of the Akin AI/Cyber team for full list of compliance deadlines and advice on how to fulfil these obligations.

^{1 Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI).}