AI Act: what the ‘Digital Omnibus’ reveals about the economics of regulation

On 27 July 2026, the Digital Omnibus on AI entered into force, amending select implementation deadlines of the EU's AI Regulation (2024/1689) and simplifying part of the compliance regime, while introducing new legal protections against non-consensual intimate deepfakes. Article 50 transparency obligations — applicable since 2 August 2026 — are unaffected.

This is the first substantive amendment to the text since it entered into force on 1 August 2024. The original calendar was designed as a predictable, linear phase-in over three years: a ban on prohibited practices in February 2025, general-purpose AI model obligations (governance, penalties) in August 2025, high-risk system rules under Annex III and transparency duties in August 2026, then regulated products under Annex I in August 2027. The chart below restores that official calendar and places the Omnibus within the sequence.

The notable fact is not so much the precise content of the revision — still being unpacked instrument by instrument — as its very existence. Just two years after a text presented as the world's reference framework for AI regulation entered into force, Brussels is adjusting its own calendar. This is a textbook case of what the regulatory literature calls 'responsive regulation' (Ayres & Braithwaite, 1992): the regulator observes implementation friction reported by operators and member states, and corrects the instrument rather than holding it rigid.

For an economist, the interesting question is not whether the Omnibus loosens or tightens the constraint — it appears to do both at once, simplifying compliance on one hand while extending protection for individuals on the other. It is what the mere revisability of a regulatory calendar does at the system level. Dixit & Pindyck (1994) show that an irreversible investment under uncertainty carries an option value to wait: the more volatile the environment surrounding a decision, the more rational it is to delay committing capital. A regulatory calendar that turns out to be revisable adds a source of volatility that was absent from initial compliance models — regardless of which direction the revision goes.

This mechanism bears directly on the sectors Cardan-AI tracks. An airline, a critical energy infrastructure operator, or a defence equipment manufacturer that had budgeted compliance against the August 2026 / August 2027 calendar must now price in an additional parameter: the probability that a future revision shifts the deadline again, or changes its scope. Large groups, with dedicated legal teams, absorb this calendar risk at lower marginal cost; mid-sized firms and tier-2/tier-3 suppliers — many of Cardan-AI's clients among them — absorb it less well, echoing the 20 August analysis of fixed compliance costs as a barrier to entry (Stigler, 1971), with one added dimension: it is no longer just the level of the cost that weighs on them, but its uncertainty.

The addition of protections against intimate deepfakes, within the same text that otherwise simplifies corporate compliance, illustrates a logic of regulation differentiated by harm intensity (Sunstein, on cost-benefit regulation): easing the administrative burden where implementation cost exceeded expected benefit, while strengthening protection where individual harm is direct and severe. This is not general deregulation but a selective recalibration — an important nuance for firms tempted to read the Omnibus as a blanket signal of loosening.

The strategic reading for compliance and public affairs functions in regulated sectors is therefore not to wait for the framework to stabilise before investing — the AI Act is only two years old and has already been amended, a revision cadence that could repeat. It is to build modular compliance architectures able to absorb calendar or scope adjustments without a full reset — and to treat regulatory risk as a variable to be actively managed, on the same footing as market risk or technology risk.