EU Digital Omnibus: what the simplification package changes in the AI Act, who gains relief as a small mid-cap and why waiting is still risky

The short answer first: the AI part of the Digital Omnibus is no longer a proposal. It has been law since 27 July 2026, as Regulation (EU) 2026/1744 of 8 July 2026. For mid-market companies it changes two things above all. The AI Act’s high-risk duties start later, but on fixed dates: from 2 December 2027 for systems under Annex III and from 2 August 2028 for AI in products under Annex I. And the simplified documentation that used to be reserved for SMEs now also covers small mid-caps: companies with fewer than 750 employees and an annual turnover not exceeding 150 million euros or a balance sheet total not exceeding 129 million euros. Everything that already applied still applies: the bans on unacceptable AI practices, the duties for general-purpose models and the transparency duties under Article 50.

This piece is written for the managing director who read about Brussels easing AI rules and now wonders whether the compliance project can be shelved. The honest answer is no, and the details explain why.

What Regulation (EU) 2026/1744 actually changes

The Commission tabled the omnibus on 19 November 2025 as COM(2025) 836 final. The reasoning was practical: harmonised standards, guidance and national supervisory structures were arriving slower than the AI Act’s application dates, so companies would have faced obligations without the instruments to meet them. The proposal therefore wanted to tie the start of the high-risk rules to the availability of those instruments. Parliament and Council did not adopt that mechanism and set fixed dates instead. For a company that is the better news: a date can be planned, a Commission confirmation at an unknown point in time cannot.

The new size class that decides who wins

The more structural change sits in the size categories. Commission Recommendation (EU) 2025/1099 of 21 May 2025 created a new tier: small mid-cap enterprises are companies that have outgrown the SME definition, employ fewer than 750 people and have an annual turnover not exceeding 150 million euros or a balance sheet total not exceeding 129 million euros. The Commission counts roughly 38,000 of them in the EU. Before the Omnibus, the moment a company passed 250 employees it fell off a cliff into the full large-enterprise regime. The omnibus uses the new category to carry the simplified technical documentation of SMEs upward.

For the German Mittelstand this is the concrete question worth checking: companies between 250 and 749 employees sit exactly in this band, precisely where the classic Mittelstand grows out of the small-enterprise bracket. The relief concerns providers, though, meaning companies that develop a high-risk system themselves or place it on the market under their own name. A company that only uses a purchased system has deployer duties, and those are set out in our AI Act deployer obligations guide.

What changes for machine builders

One change hits a core sector of the Mittelstand directly and barely appears in the summaries. Regulation (EU) 2026/1744 takes AI-enabled machinery out of the direct application of the AI Act’s high-risk regime: the Machinery Regulation moves from Section A to Section B of Annex I of the AI Act. Such products therefore follow the sectoral route of the Machinery Regulation. The Commission has to supplement its Annex III by delegated act with health and safety requirements for high-risk AI systems that are safety components of machinery or machinery themselves. What the Machinery Regulation already demands of software from 20 January 2027 is covered in our piece on the Machinery Regulation and software updates.

The wider package beyond the AI Act

The AI omnibus was one part of a broader digital package the Commission presented the same day, summarised in its official press release. Its second omnibus, proposal COM(2025) 837 on data and cybersecurity rules, is a separate legislative procedure and had not been adopted as of 9 October 2026. For operations the most relevant piece in it is a single entry point for cybersecurity incident reporting: until it exists, the same incident can trigger duties under NIS2, the Cyber Resilience Act and GDPR at once, a burden we documented in our pieces on the NIS2 reporting deadlines and the CRA duty that is live since September 2026. It also touches GDPR in targeted ways and modernises cookie rules toward browser-level consent. The package further includes a Data Union strategy and a proposal for European Business Wallets; the Commission estimates the simplifications could save five billion euros in administrative costs by 2029. Unlike the AI part, the rule here is still: until Parliament and Council agree, nothing changes.

The honest risk calculation

Three qualifications keep this sober. First, deferral is not abolition: for Annex III systems 2 December 2027 is only a little over a year away, and risk management, technical documentation and data quality cannot be caught up in the last quarter. Second, relief is not exemption: small mid-caps keep the same obligations, they just meet them with less paperwork. Third, the parts already in force were not postponed, Article 4 was only weakened, and 2 December 2026 adds new bans and ends the marking transition (details in our article on the labelling duty for chatbots). A company that paused its AI inventory work on headline news has gained nothing. The practical stance is the same one we take in the AI Act deployer obligations guide: map which systems qualify, prepare the documentation path, and read the time gained as borrowed time rather than abolished duty.

Whoever takes one sentence from this piece: the Digital Omnibus has stretched the clock and lowered the paperwork burden for part of the Mittelstand, but it changes the calendar, not the destination.

Frequently asked questions about the Digital Omnibus