AI Omnibus 2026: What does the new EU regulatory package mean for companies, citizens, and developers?

The buzz around EU artificial intelligence regulations is growing louder. The planned package of amendments and clarifications, sometimes referred to as the AI Omnibus, is set to expand the scope of the existing AI Act and introduce new obligations for businesses as well as additional protections for citizens. What exactly will change, and who will feel the impact of these new regulations the most?

In the EU legal landscape, there is increasing talk of a package of amendments known as the AI Omnibus. This is not an entirely new law, but rather a planned set of changes intended to clarify and expand upon the existing AI Act (EU Regulation 2024/1689) and related acts, such as the GDPR or the Digital Services Act. The goal is to tighten the system: strengthening citizen protection, increasing algorithm transparency, and facilitating business adoption—especially for the SME sector. What specific changes are on the table, and what do companies need to prepare for?

What does the AI Omnibus contain?

The AI Omnibus does not function as a separate legal act, but as a package of modifications supplementing key EU regulations. The most important proposed changes concern the following areas:

• Expansion of high-risk system definitions – the list of areas subject to special oversight is to be supplemented with additional sectors, such as certain recruitment systems, credit scoring, or advanced medical diagnostics. Any AI tool that can realistically influence key life decisions will come under scrutiny.
• New obligations for providers and deployers – companies will be required to register high-risk systems in a public database, conduct detailed conformity assessments, and ensure that users are aware when they are interacting with an algorithm (e.g., in the case of chatbots).
• Ban on the most invasive practices – the regulations categorically prohibit the use of social scoring systems, behavioral manipulation that exploits user vulnerabilities, and—with certain exceptions for security services—real-time biometric identification in public spaces.
• Requirements for foundation models – creators of large language models and content generators will have to ensure transparency, including clear labeling of materials created by artificial intelligence.

An important element of the new regulations is the so-called regulatory sandboxes. These are controlled testing environments designed to allow startups and smaller companies to safely experiment with AI technologies under the supervision of regulators, without fear of immediate, severe penalties.

Implementation timeline: When and what comes into effect?

The new regulations will not come into effect overnight. The EU legislator has provided for a phased implementation of changes, giving the market time to adapt to the new reality. The schedule assumes several key stages:

• Stage one (bans) – first, restrictions regarding prohibited systems, such as behavioral manipulation or illegal biometric identification, will come into effect.
• Stage two (foundation models and registration) – the next step will be to bring general-purpose models under supervision and launch the EU database, where providers of high-risk systems will be required to register their solutions.
• Stage three (full requirements for high-risk systems) – subsequently, full obligations related to conformity assessment, human oversight, and technical documentation for systems classified as high-risk will enter into force.
• Stage four (system integration) – the final phase is the full adaptation of systems already on the market and the integration of regulations with other EU acts.

For smaller entities, facilitations have been provided, including preferential access to the aforementioned sandboxes and advisory support within the framework of EU programs supporting digital transformation.

Main goals of the regulation: Security, innovation, and trust

EU officials point to three main goals of the new regulations:

1. Protection of fundamental rights – AI systems must not become a tool for discrimination or mass surveillance.
2. Supporting responsible innovation – clear rules of the game are intended to help honest creators, and regulatory sandboxes will make it easier for smaller players to get started.
3. Building social trust – users must be sure that the technology they interact with is safe and transparent.

What does this mean in practice?

• For citizens – greater control over how algorithms affect their lives and the right to an explanation for decisions made by AI (e.g., when applying for a loan).
• For business – a level playing field in the European market and lower legal risk thanks to clear guidelines.
• For the public sector – more effective tools for combating disinformation and cyber threats.

Penalties and enforcement: What are the consequences of violations?

The regulations provide for very high financial penalties for non-compliance with the new requirements. Their amount will depend on the scale of the offense and the size of the enterprise:

• Maximum penalty – for using prohibited practices or violating fundamental safety rules, penalties can reach tens of millions of euros or a specific percentage of the company's global annual turnover (whichever is higher).
• Smaller, yet still severe sanctions – for lack of appropriate technical documentation or failure to fulfill information obligations, penalties with a lower threshold are provided, though they remain very significant for business.

Supervision of the implementation of the regulations is to be coordinated at the EU level, with closer cooperation with national authorities of individual member states. In Poland, designated supervisory offices will play a key role in controlling the compliance of systems with the new law.

AI Omnibus vs. global regulations: How does it compare to others?

The EU approach stands out globally for its comprehensiveness. The new regulations are designed to align with other legal acts. Here is how the planned changes compare to solutions from other parts of the world:

• Planned amendments (EU) – clarification of the AI Act and other acts; expansion of the AI definition, obligations for foundation models, facilitations for SMEs.
• AI Act (EU) – the main AI regulation in Europe; the legal foundation upon which further clarifications are based.
• Blueprint for an AI Bill of Rights (USA) – a set of recommendations (non-binding); no sanctions, focus on civil rights.
• Algorithmic Accountability Act (USA) – a federal bill draft; focus on algorithmic audits, no rigid bans.
• Chinese AI regulations – state decrees and regulations; strong state oversight, emphasis on algorithmic security and compliance with the state line.

The new regulations are designed to work in tandem with the GDPR (personal data protection) and the Digital Services Act (responsibility of digital platforms), creating a coherent legal ecosystem.

Which sectors and companies will feel the changes the most?

The changes will be felt primarily by sectors where algorithms make decisions of great importance to people:

• Health – diagnostic systems and medical software will have to undergo rigorous certification.
• Finance – algorithms assessing creditworthiness or customer risk profiles will be strictly controlled.
• Education and recruitment – tools for the automatic evaluation of job applications or student results must guarantee the absence of discrimination.
• Transport – traffic control systems and autonomous technologies will require additional safety guarantees.

Smaller companies and startups can count on dedicated support programs and easier access to testing infrastructure, which is intended to minimize the costs of adapting to the new requirements.

Expert and business reactions: Mixed feelings

The proposals for new regulations are sparking a lively discussion in the technology and legal communities. There are extreme opinions:

Positive opinions

• NGOs: Representatives of organizations fighting for digital rights assess the changes as a step in the right direction. They primarily praise the restriction of the use of biometrics in public spaces, although they simultaneously point out that the devil is in the details and that real enforcement against the biggest players will be key.
• Academic experts: Many researchers and technology ethicists emphasize that Europe is once again setting global standards. The introduction of clear requirements for foundation models is assessed by them as a necessary step toward a safe future.

Criticism and concerns

• Business representatives: Organizations representing technology companies and startup environments do not hide their concerns. They point out that excessive bureaucracy may slow down the development of innovation in Europe and put local companies at a disadvantage compared to competitors from the USA or Asia. The argument is also raised that smaller entities may not be able to bear the costs of legal services for the new requirements.
• Skeptical voices: There are also voices from some law enforcement agencies that fear that overly restrictive bans on biometrics could hinder the fight against crime. Meanwhile, the creative and marketing industries are cautious about the rigid obligations to label all content generated by AI.

Most commentators agree on one thing: while the intentions behind the regulations are sound, the practical implementation of the new procedures will be a huge organizational and financial challenge for the market.

What's next? Practical steps for companies and developers

If your organization creates or deploys solutions based on artificial intelligence, it is worth taking the first preparatory steps now:

1. Identify the risk level – analyze whether your systems qualify as high-risk solutions under EU criteria.
2. Audit your procedures – check how you store data, how you supervise the operation of algorithms, and whether you can explain the decision-making process of your system.
3. Follow calls for regulatory sandboxes – if you run a startup, participating in such programs can significantly facilitate and reduce the cost of the certification process.
4. Focus on team education – employees responsible for implementing technology must understand the legal and ethical framework in which they operate.
5. Prepare for content labeling – if you work with generative AI, start implementing mechanisms that inform users about the origin of materials.

For programmers and system architects, it will be crucial to design solutions with compliance in mind as early as the coding stage (compliance by design). Algorithm transparency is ceasing to be just a best practice and is becoming a legal requirement.

If you want to learn more about the practical aspects of implementing AI in a company, check out our post: 10 questions you must ask before implementing AI in your company – a checklist for the board.

Summary: Are the new regulations a step forward?

The planned changes to the regulations are an ambitious attempt to make Europe a leader in the field of ethical artificial intelligence. The new rules are intended to create a safe environment for users without completely blocking technological potential. The success of this endeavor, however, depends on the flexibility of officials and real support for the SME sector.

For entrepreneurs, it will be crucial to efficiently adapt to the new reality. Those who take action in advance can turn compliance into a branding advantage. Conversely, ignoring the upcoming changes carries the risk of serious financial consequences.

Time will tell if Europe finds the golden mean between protecting citizens and supporting innovation. One thing is certain: we are on the threshold of a new era where responsibility for the operation of algorithms becomes the foundation of technological development.

Sources

• https://digital-strategy.ec.europa.eu/pl/news/ai-omnibus-enters-force
• https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32024R1689
• https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
• https://digital-strategy.ec.europa.eu/en/policies/europes-digital-decade
• https://digital-strategy.ec.europa.eu/en/library/study-comparative-analysis-ai-regulations
• https://digital-strategy.ec.europa.eu/en/policies/ai-smes
• https://www.consilium.europa.eu/pl/policies/artificial-intelligence/