The EU adopted the AI Act in March 2024. Enforcement of banned practices started February 2, 2025. Then in July 2026, the Commission published a "Digital Omnibus" (Regulation 2026/1744) rewriting major sections. The definition of "AI system" narrowed. GPAI obligations shifted. Open-source exemptions expanded. High-risk deadlines moved to December 2027. If you build or deploy AI in Europe, the law you prepared for is no longer the law that applies.
# What Happened
The EU AI Act was adopted in March 2024 after years of negotiation. It created a risk-based framework covering everything from chatbots to facial recognition. Companies started compliance programs immediately. Then the Commission rewrote major parts of it.
The Commission proposed the Omnibus in November 2025, after enforcement had already begun. Companies that spent months building compliance programs around the original definitions found the goalposts moved. The new rules narrow the definition of AI system and push high-risk deadlines to December 2027.
# What Changed
The Omnibus is not a clarification memo. It is a structural rewrite of five core pillars. Every one affects what counts as regulated AI and who bears the compliance burden.
The original definition was broad enough to capture traditional software with if-else logic. The Omnibus narrows it to systems that "infer" from inputs to generate outputs "such as predictions, content, recommendations, or decisions." Rule-based automation, basic statistical models, and conventional database queries are now explicitly excluded.
General-purpose AI model providers still need technical documentation and copyright policies. But the Omnibus reduces the documentation burden for models below the systemic risk threshold (10^25 FLOPs). Smaller model providers get a lighter compliance path focused on transparency rather than exhaustive safety evaluations.
The original Act exempted open-source models from most GPAI obligations only if they had permissive licenses and fewer than 10^25 FLOPs. The Omnibus broadens this: open-source models with any OSI-approved license now qualify for the lighter regime regardless of parameter count, as long as they are not classified as systemic risk. This is a major win for open-weight model releases.
Each EU member state must now establish at least one AI regulatory sandbox by August 2, 2026. The Omnibus adds mandatory provisions: real-world testing of high-risk systems under regulatory supervision, with temporary exemptions from full compliance requirements. Startups and SMEs get priority access.
The Omnibus adds proportionality provisions for SMEs and startups. Conformity assessment fees are capped. National authorities must provide free guidance and simplified documentation templates. The message: you do not need a legal team of 20 to ship a high-risk AI system if you have fewer than 250 employees.
# Before vs After
Each change has a concrete before-and-after. If you already started a compliance program, check whether your assumptions still hold.
"A machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment." Covered everything from neural networks to spreadsheet macros.
Must "infer" from inputs to generate outputs like predictions, content, or decisions. Rule-based systems, basic statistics, and conventional queries excluded. Traditional software no longer in scope.
Exemptions only for permissive licenses (Apache, MIT) and models under 10^25 FLOPs. Large open-weight models like Llama were still caught.
Any OSI-approved license qualifies. No parameter-count restriction. Only systemic-risk models (10^25+ FLOPs) lose the exemption. Llama, Mistral, and most open-weight releases are now in the lighter regime.
All GPAI providers needed full technical documentation, training data summaries, copyright policies, and energy reporting. Same requirements regardless of model size or risk.
Two-tier system. Below systemic risk threshold: lighter transparency obligations. Above threshold: full safety evaluation, red-teaming, incident reporting. Proportional to actual risk, not model size alone.
Member states "encouraged" to create sandboxes. No mandatory timeline. No guaranteed access. In practice, most countries had not established any.
Mandatory: at least one per member state by Aug 2026. Real-world testing allowed under supervision. SMEs and startups get priority access and temporary compliance exemptions during testing.
Same conformity assessment process regardless of company size. Same documentation. Same fees. A 10-person startup faced the same paperwork as Google.
Capped fees. Free guidance from national authorities. Simplified templates for documentation. Proportionality principle: the compliance burden must match the size and resources of the organization.
# What This Means For Engineers
Stop reading this as policy. Read it as engineering constraints that determine what you can ship, where, and when.
Your obligations are significantly lighter post-Omnibus. If the base model uses an OSI-approved license and is not classified as systemic risk, you inherit the lighter GPAI regime. Focus on downstream deployment obligations, not model-level compliance.
The compliance timeline is more forgiving. You have until August 2025 for GPAI transparency, but the full conformity assessment for high-risk systems now targets a later window. Use the extra months to build risk management systems and documentation into your development process rather than bolting them on at the end.
Monitor the Omnibus amendments actively. The EU has proven it will rewrite the rules close to deadlines. Subscribe to the Official Journal. Track the AI Office's guidance documents. Do not assume the version of the Act you read six months ago is still current.
Check whether the Omnibus definition change removes you from scope entirely. If your system uses rule-based logic, conventional statistics, or basic automation without inference capabilities, it likely no longer qualifies as an "AI system" under the Act. Document why. Keep the analysis on file.
# The Timeline
Here is what applies when. Clip this. Reference it quarterly.
The Omnibus proved that this timeline is not fixed. The EU will continue issuing delegated acts, implementing regulations, and guidance documents that modify how these dates apply in practice. Compliance is not a one-time event. It is a continuous monitoring problem.
The EU wrote the most comprehensive AI law in history, then rewrote it before anyone had to comply. This is not instability. This is the EU learning that regulating AI at the speed of legislation does not work. The law will keep changing. The direction will not. Build your compliance architecture to be modular, because the only constant in EU AI regulation is the next amendment.
Photon-1: 18 Years of Screen Recordings Built One World Simulator
Induction Labs trained a world model on 18 years of screen recordings. Photon-1 does not generate video. It simulates environments with physics, object permanence, and cause-effect.
Enjoyed this?
New episodes Mon, Wed, Sat.