EU AI Act Omnibus enters into force, adding nudification ban

The European Commission confirmed on 27 July 2026 that the Digital Omnibus on AI, carrying targeted amendments to the AI Act, entered into force that day following a political agreement reached in May.

The Omnibus was adopted by the Commission in November 2025 and takes the form of two distinct proposed regulations. Its AI Act amendments sit within a wider digital rulebook simplification agenda that also consolidates data governance instruments and repeals the platform-to-business regulation, whose provisions had been partially superseded by the Digital Services Act. The policy rationale traces directly to the 2024 Draghi report, which attributed part of the EU's competitiveness deficit to administrative burdens and regulatory inconsistencies, singling out constraints on digital-sector innovation and the difficulties facing European start-ups seeking to scale. The AI Act amendments are targeted, not a wholesale rewrite.

The Commission's May 2026 political agreement covered both innovation-enabling simplifications and a ban on nudification applications, the latter a consumer-protection addition to the Act's unacceptable-risk category. The source does not specify the precise article reference for that ban or the technical criteria that define a nudification application in the amended text.

For compliance teams, the 27 July entry into force sits alongside the August 2026 high-risk-obligations application date that has been the dominant planning horizon since the Act was published. The Omnibus does not displace that timeline; it adjusts specific provisions within it. The foundation-model versus deployed-system split that structures the Act's obligations remains intact, as do the GPAI designation thresholds and the Article 6 high-risk test for deployed systems. What the Omnibus introduces is a simplification layer, reducing friction at the compliance-process level rather than reclassifying obligations or moving tier thresholds.

The cybersecurity dimension of the broader Omnibus package is relevant to AI providers with overlapping Cyber Resilience Act exposure. A 20 January 2026 Commission cybersecurity package proposed amendments to the NIS2 directive, and the Omnibus incorporates measures to simplify jurisdictional rules, streamline ransomware-attack data collection and reinforce ENISA's coordinating role for cross-border entities. The Commission estimates those cybersecurity simplifications ease compliance for 28,700 companies, including 6,200 micro and small enterprises. The source does not specify what share of those are AI providers, but firms running high-risk AI systems that already carry NIS2 obligations will face a revised compliance surface on both tracks simultaneously.

For product counsel and compliance leads at AI-deploying regulated firms, the immediate question is whether the targeted amendments alter any conformity-assessment pathway or documentation requirement already in progress ahead of August. The source does not provide article-level detail on which specific AI Act provisions were amended; teams should treat 27 July as the trigger to pull the amended regulation text and map it against existing conformity-assessment documentation before the high-risk application date arrives.

The AI Office has not published a concrete GPAI-classification enforcement schedule ahead of the August application date. For providers with GPAI designation or systems above the 10^25 FLOPs threshold, the Omnibus's entry into force adds one more instrument to the stack requiring a model-card disclosure calibration check before August closes.