EU Digital Omnibus on AI Enters into Force on 27 July 2026: High-Risk AI Obligations for Embedded Products Deferred to 2 August 2028, Medical Devices Included

On 27 July 2026, the EU Digital Omnibus on AI entered into force. Its legal reference is Regulation (EU) 2026/1744; it was adopted by the European Parliament and the Council of the European Union on 8 July 2026 and published in the Official Journal on 24 July 2026. The regulation amends the Artificial Intelligence Act, Regulation (EU) 2024/1689, which was adopted in 2024.

For the medical device sector, the most immediate effect of this amendment is a change to the timetable. A set of high-risk AI obligations originally scheduled to apply from 2 August 2026 has been deferred across the board. Standalone, independently deployed high-risk AI systems — the scenarios listed in Annex III to the Act — apply from 2 December 2027. High-risk AI integrated into physical products, that is, the part covered by Annex I, applies from 2 August 2028.

Medical Devices Fall on the Annex I Side

Under the classification set out in the AI Act, AI systems that are themselves medical devices, or that serve as safety components of medical devices, fall within the Annex I high-risk category. Diagnostic imaging algorithms, software-based diagnostic devices, and decision engines embedded in in vitro diagnostic devices all sit on this line. For them, the new applicable date is 2 August 2028.

One distinction matters here: this adjustment changes only the timing of obligations under the AI Act. It does not alter the requirements of the Medical Devices Regulation (EU) 2017/745 (MDR) or the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR). Pre-market assessment, technical documentation and post-market surveillance for medical devices continue to be governed by the existing medical device regulations.

A Resolution Mechanism for the Overlap Between the Two Regimes

The AI Act and the MDR overlap in the area of high-risk management. A Council of the European Union press release dated 7 May 2026 explains that the co-legislators agreed on a mechanism: where sectoral legislation already imposes comparable requirements in relation to AI, implementing acts may limit the application of the corresponding provisions of the AI Act, so that the same matter is not required twice.

This mechanism covers sectors including medical devices, toys, lifting equipment, machinery and watercraft. The regulation also exempts the Machinery Regulation from the direct application of the AI Act and empowers the European Commission to adopt delegated acts supplementing health and safety requirements for high-risk AI under the Machinery Regulation. The Commission also assumes a new obligation to issue compliance guidance for operators of high-risk AI covered by harmonised sectoral legislation, and that guidance must be framed in a way that minimises the compliance burden.

The Clock Changed, but Other Provisions Have Not Stalled

The Act as a whole continues to advance on its original schedule. Prohibited AI practices and AI literacy obligations have applied since 2 February 2025; obligations for general-purpose AI models have applied since 2 August 2025; and governance and enforcement rules apply from 2 August 2026.

The newly added ninth prohibition targets AI systems that generate non-consensual sexualised content and child sexual abuse material — the so-called “nudification” applications — and takes effect from December 2026. The implementation window for transparency obligations on generated content has been compressed to three months, with the new deadline likewise pointing to 2 December 2026. These changes are of limited relevance to medical devices, but they belong to the same Act and should be marked on a company’s compliance map.

AIMEILI Regulatory Interpretation

A deferral is not a reason to shelve preparation. Notified bodies in the EU are already raising questions under their existing MDR powers about algorithm transparency, training data governance and model change control for AI-enabled devices. These questions do not have to wait for the AI Act obligations to take effect.

The batch of obligations applying from 2 August 2028 touches risk management files, design records, supplier data and post-market processes. A manufacturer that treats that date as an endpoint will face a two-year backlog of concentrated rework. Treating the revised timetable as a preparation window rather than a buffer period is the more cost-effective approach.

At the same time, the overlap mechanism matters for regulatory strategy. Where MDR requirements already achieve an equivalent outcome for a given AI function, the Commission may restrict the parallel application of the AI Act provisions through implementing acts. Until those implementing acts are in place and their scope is clear, manufacturers should assume that both frameworks may apply and should map each requirement in the AI Act against the corresponding MDR or IVDR requirement in their technical documentation. This dual mapping also serves as a defensible position in front of notified bodies, which increasingly expect an explicit statement of how AI-specific risks — data quality, bias, model drift, human oversight — are controlled within the existing quality management system.

Business Impact

The revised dates change the compliance planning horizon for any organisation with AI-enabled devices on the EU market, or preparing to place them there:

• Resource planning: teams that had scheduled AI Act readiness work for 2026 now have additional runway, but the workstream should not be closed. Re-baseline the plan against 2 August 2028 while keeping interim milestones aligned with MDR and IVDR submission timelines.
• Gap assessment: verify whether each AI function in the portfolio is a medical device in its own right, a safety component, or a non-device feature, since this determines whether it is classified under Annex I or Annex III.
• Documentation: strengthen risk management files, algorithm change control procedures, training and validation data records, and human oversight provisions now, so that they serve both MDR conformity and eventual AI Act obligations.
• Supplier and contract management: AI components sourced from third parties carry data provenance and model update risks; secure contractual rights to documentation, change notification and version control.
• Post-market surveillance: extend PMS and vigilance processes to cover model performance monitoring, drift detection and cybersecurity incidents affecting AI components.
• Regulatory watch: track the Commission’s compliance guidance and any implementing acts limiting the parallel application of AI Act provisions, as these will directly shape the eventual conformity route.

Sources and Scope of Verification

• European Commission (Shaping Europe’s digital future) — AI Omnibus enters into force, 27 July 2026: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
• EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus on AI), published 24 July 2026: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
• European Commission — press release IP/26/1024, 7 May 2026: https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_26_1024/IP_26_1024_EN.pdf
• Council of the European Union — press release, 7 May 2026: https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/

Scope of verification and date of access: This review covered the Artificial Intelligence Act information page and the AI Omnibus entry-into-force news item on the European Commission’s digital strategy pages, the Official Journal entry for Regulation (EU) 2026/1744 on EUR-Lex, the European Commission press release of 7 May 2026, and the Council of the European Union press release of the same date. Date of access: 7 October 2026.

Applicability note: This article is an interpretation of publicly available EU regulatory information and does not constitute a conclusion or commitment regarding any specific product, company or registration application. The text of the provisions and the applicable timetable are governed by the official texts, and the information may change with subsequent official updates.