EU AI Act Amendments 2026: What Regulation (EU) 2026/1744 Changed

By Stephane Boghossian · 2026-07-28 · Updated 2026-10-22 · 10 min read · Ai-legal-tech

Regulation (EU) 2026/1744 moved EU AI Act high-risk duties to December 2027 and August 2028. Every change, the guidance issued since July and the dates still ahead.

Key facts

Regulation (EU) 2026/1744 was signed in Strasbourg on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 (EUR-Lex; European Commission AI Act page, read 22 Oct 2026).
High-risk obligations: Annex III systems from 2 December 2027, Annex I Section A products from 2 August 2028, high-risk systems used by public authorities from 2 August 2030 (Regulation (EU) 2026/1744, Article 113 and Article 111 as amended; ActuIA summary of the text, 6 Oct 2026).
Two new Article 5 prohibitions (non-consensual intimate material and child sexual abuse material) and the end of the Article 50(2) grace period for systems already on the market both fall on 2 December 2026 (European Commission AI Act page, read 22 Oct 2026).
The Commission published guidelines on Article 50 transparency obligations on 20 July 2026, and assessed the voluntary Code of Practice on transparency of AI-generated content, finalised on 10 June 2026, as adequate in July 2026 (European Commission AI Act page, read 22 Oct 2026; Jones Day, June 2026).
The first harmonised standard under the AI Act, EN 18286:2026 on quality management systems, was cited by Commission Implementing Decision (EU) 2026/2274, published in the Official Journal on 14 October 2026 (Nemko, Oct 2026; Commission AI Act page lists it on 19 Oct 2026).
On 12 October 2026 the Commission opened consultation on a draft implementing regulation for AI Office proceedings under Articles 75c and 75d, open until 9 November 2026, with adoption planned for Q4 2026 (Cloud Security Alliance research note, Oct 2026).
Germany's AI Act implementation law (KI-MIG) was published on 28 July 2026 and names the Bundesnetzagentur as market surveillance authority; France's designation bill was still pending in October 2026 (ActuIA, 6 Oct 2026).

What did Regulation (EU) 2026/1744 change?

The regulation amends Regulation (EU) 2024/1689 (the AI Act), along with the Basic Aviation Regulation and the Machinery Regulation. It entered into force on the third day after publication instead of the usual twentieth, because 2 August 2026 was too close to leave the text pending. As a regulation it applies directly in all 27 member states, with no transposition.

It moved the calendar for the most expensive chapter and made a handful of obligations cheaper to discharge. The risk tiers stayed. The prohibited-practice list got longer. Article numbers below are to the AI Act as amended.

Topic	Before the amendment	After Regulation (EU) 2026/1744
Annex III high-risk systems (Art. 113)	2 August 2026	2 December 2027
Annex I Section A products (Art. 113)	2 August 2027	2 August 2028
High-risk systems used by public authorities (Art. 111)	2 August 2030	2 August 2030 (unchanged)
Prohibited practices (Art. 5)	8 practices since 2 February 2025	2 more from 2 December 2026
Machine-readable marking (Art. 50(2))	2 August 2026, no transition	2 August 2026 for new systems; 2 December 2026 for systems already on the market
AI literacy (Art. 4)	Ensure a sufficient level	Take measures to support it; no set level required
Bias-detection data (Art. 4a)	High-risk providers only	All providers and deployers, under strict necessity
National sandboxes (Art. 57)	2 August 2026	2 August 2027, plus a Union-level sandbox
Registration of self-assessed systems (Art. 6(3))	Required	Still required, with a slimmer Annex VIII filing
AI Office powers (Art. 75, 75a to 75d)	Focused on general-purpose models	Exclusive competence over AI built on a provider's own general-purpose model and AI in very large platforms, with inspections and periodic penalties

Three details deserve more than a table row. The Commission's November 2025 draft tied the high-risk dates to a standards-readiness trigger; the final text dropped it, so 2 December 2027 and 2 August 2028 are fixed dates that need a new legislative procedure to move. New Article 5(1a) catches a provider where generating the prohibited material is the intended purpose, or is reasonably foreseeable and reproducible without significant technical modification, so providers are expected to document safeguards such as refusal training, content filtering and abuse detection. And Article 99 gains a capped fine tier for small mid-caps, with explicit room for warnings and non-monetary measures.

What has happened since the amendment entered into force?

The regulation was the headline. The implementing work since July decides how it bites.

Article 50 guidelines (20 July 2026). The Commission's guidance on transparency obligations for providers and deployers, published two weeks before those obligations applied. If you run a client-facing chatbot or publish AI-drafted text on matters of public interest, read these before the Act itself.
Code of Practice on AI-generated content. Finalised on 10 June 2026 and assessed by the Commission in July as adequately covering Article 50(2), (4) and (5). Signing is voluntary; signatories get a recognised route to show they mark and label content correctly.
Enforcement switched on (2 August 2026). The AI Office's new investigative powers under Articles 75a to 75d, and the national authorities' powers, have applied since 2 August 2026.
First harmonised standard (October 2026). EN 18286:2026 covers the quality management system that Article 17 requires of high-risk providers. Following it gives a presumption of conformity for the requirements it covers and nothing more. Standards on risk management, data governance, logging, transparency, human oversight, accuracy and cybersecurity are still to come.
Draft procedural rules for the AI Office (12 October 2026). The draft implementing regulation under Articles 75c and 75d covers access to the file, business secrets and what interrupts the five-year limitation period. Comments close on 9 November 2026.
National authorities. Germany's KI-MIG entered into force on 29 July 2026 with the Bundesnetzagentur as market surveillance authority. France's designation bill had not completed its passage by October 2026. Check your own member state before assuming which regulator you answer to.

Which AI Act dates are still ahead?

Date	What applies
9 November 2026	Consultation closes on the draft AI Office procedural regulation (Art. 75c, 75d)
2 December 2026	Two new Article 5 prohibitions; Art. 50(2) marking for systems placed on the market before 2 August 2026
1 August 2027	Commission guidelines on the interplay with Annex I sectoral legislation due (Art. 96)
2 August 2027	National AI regulatory sandboxes operational (Art. 57); general-purpose models placed on the market before 2 August 2025 must comply
2 December 2027	High-risk obligations for Annex III systems
28 January 2028	Deadline for Annex I Section A notified bodies to apply for designation under the AI Act (Art. 43(3))
2 August 2028	High-risk obligations for Annex I Section A products
2 August 2030	Legacy high-risk systems used by public authorities

Does the EU AI Act regulate agentic AI?

Only by name. The amendment adds an Annex XIV, a table of nomenclature codes used to designate what a notified body is competent to assess. Among the new horizontal technology codes, AIH 0401 is agentic AI, and its sibling AIH 0205 covers systems that learn from their environment, excluding agentic AI. As far as we can tell, that is the first time the phrase appears in binding Union law.

An administrative code is not a definition. There is no article defining an agent, no risk tier keyed to autonomy and no obligation that scales with how many steps a system takes without a person. For anyone shipping agents in a regulated field, the safer design constrains what an agent can do before it acts, which is the argument we make in governance by construction.

What does the EU AI Act require of a law firm that uses AI?

A provider develops an AI system and places it on the market under its own name. A deployer uses one under its own authority. Most law firms are deployers. Deployer duties are thinner than provider duties, and several are live today.

AI literacy (Article 4). Binds deployers. The amended duty is to take measures to support staff AI literacy, with no set level required and no small-firm exemption.
Client-facing chatbots (Article 50(1)). Tell people they are dealing with an AI system unless it is obvious. In force since 2 August 2026.
AI-drafted public commentary (Article 50(4)). Text published to inform the public on matters of public interest must be disclosed unless a human took editorial responsibility. A firm blog produced at volume with no named reviewer is the case this describes.
CV screening. Recruitment is Annex III point 4, so a firm screening applicants with AI deploys a high-risk system. Those duties now apply from 2 December 2027.
Internal builds. A firm that puts its own tool into service under its own name may become a provider, with registration under Article 6(3) where it applies. Get that assessed.
Fairness testing. New Article 4a gives deployers a lawful basis to process special-category data strictly to detect and correct bias.
Reach outside the EU. Article 2 covers providers and deployers outside the Union where the output is used inside it. A firm in Dubai or Beirut serving EU clients is in scope.

What should you ask your legal AI vendor?

Disclosure: HAQQ is a legal AI vendor and has to answer these too. Each one has a specific, checkable answer.

Are you the provider of an Annex III high-risk system for anything we use, and under which point of Annex III?
Which Article 50 obligations does your product discharge for us, and which stay with us as deployer?
Do you mark AI-generated output in a machine-readable way today, and will you by 2 December 2026? Have you signed the Code of Practice on AI-generated content?
Where Article 6(3) self-assessment applies, are you registered in the EU database, and can we see the entry?
What does your Article 4 literacy support consist of?
Which of the two new Article 5 prohibitions could our use foreseeably trip, and what safeguards do you document?
Who is your authorised representative in the Union, and which market surveillance authority supervises you?
If your system runs on your own general-purpose model, is the AI Office your supervisor under Article 75?

What did not change?

General-purpose AI obligations in Articles 51 to 55, applicable since 2 August 2025.
The original prohibitions, applicable since 2 February 2025.
Annex III itself. A system that was high-risk before the amendment is still high-risk; only the compliance date moved.
The top penalty tier of up to €35 million or 7% of worldwide annual turnover for prohibited practices.
The architecture: risk tiers, conformity assessment, notified bodies, the EU database and market surveillance.

How should a firm plan for the rest of 2026?

Treat it as two deadlines. Article 50 and Article 4 are live, so the work for most firms this quarter is a written AI-use policy, a literacy programme with a record of who attended, chatbot disclosures and a named reviewer for anything AI-drafted that you publish. The 2 December 2026 date matters mainly to vendors of generative tools. The high-risk work, if you screen CVs or build tools in-house, has a fixed date of 2 December 2027 and should start with an inventory of every AI system the firm uses and who supplies it.

We build from Beirut and serve clients across the Middle East and Europe, which puts us inside Article 2. We will update this page as further standards, guidelines and implementing acts are published.

Sources

FAQ

What is Regulation (EU) 2026/1744?

It is the amending regulation known as the Digital Omnibus on AI. It was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends Regulation (EU) 2024/1689 (the EU AI Act), the Basic Aviation Regulation and the Machinery Regulation, and applies directly in all 27 member states.

When do the EU AI Act high-risk obligations apply now?

Stand-alone high-risk systems listed in Annex III must comply from 2 December 2027, moved from 2 August 2026. AI embedded in products covered by Annex I Section A has until 2 August 2028. Legacy high-risk systems used by public authorities have until 2 August 2030. The final text dropped the standards-readiness trigger in the Commission's draft, so these are fixed dates.

What happens on 2 December 2026 under the EU AI Act?

Two new Article 5 prohibitions apply: generating or manipulating intimate material without explicit consent, and generating child sexual abuse material. The same day ends the grace period for machine-readable marking of synthetic output under Article 50(2) for generative systems placed on the market before 2 August 2026. New systems have had to mark output since 2 August 2026.

What has the Commission published since the amendment?

Guidelines on Article 50 transparency obligations on 20 July 2026; an assessment in July 2026 that the voluntary Code of Practice on AI-generated content adequately covers Article 50(2), (4) and (5); the first harmonised standard, EN 18286 on quality management systems, cited by Implementing Decision (EU) 2026/2274 on 14 October 2026; and, on 12 October 2026, a draft implementing regulation on AI Office proceedings under Articles 75c and 75d, open for comment until 9 November 2026.

Does the EU AI Act apply to law firms that only use AI?

Yes, as deployers. Article 4 AI literacy applies to deployers, in its softened form, with no small-firm exemption. Article 50 disclosure duties have applied since 2 August 2026, covering client-facing chatbots and AI-generated text published to inform the public. A firm that screens job applicants with AI deploys an Annex III high-risk system, with duties from 2 December 2027. A firm that puts its own tool into service under its own name may become a provider.

Does the EU AI Act regulate agentic AI?

Not in substance. The amendment's new Annex XIV includes code AIH 0401 for agentic AI, used to designate which notified bodies may assess such systems. There is no legal definition of an AI agent, no risk tier based on autonomy and no obligation that scales with how much a system does without human review.