Changes between two versions
What changed between the plenary report and the adopted text
From · plenary report· 19 Mar 2026
on the proposal for a regulation of the European Parliament and of the Council amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)
To · adopted text· 26 Mar 2026
Simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)
AI:What changed, in short
The main substantive change adds a new condition for high-risk AI systems requiring third-party conformity assessment.3 Other changes are formal or wording: correcting references, punctuation, and formatting.1245
1 change of substance · 8 formal · 1 of wording only
Written by AI from the two texts only · read the changes before relying on it · 4 Sept 2026 · Report a problem
+4 added · −20 removed · 12 changed paragraphs, packaging included.
Part 2 of 4: Paragraphs 61–120
Removed:(Regulation (EU) 2024/1689)
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 5 c (new), Article 6 – paragraph 1 a (new): (5c) In Article 6, paragraph 1a is added: / ‘1a. For the purposes of this Regulation, functionalities intended solely for user assistance, performance optimisation, service efficiency, automation, convenience, or quality control of non-safety-related aspects shall not be regarded as safety functions under this Regulation, where their failure would not directly create risks to health or safety.’
Regulation (EU) 2024/1689
Change 4
Changed:Article 1 – paragraph 1 – point 6, Article 6 – paragraph 4: deleted / (deleted) / (deleted) / (deleted)
Regulation (EU) 2024/1689
Changed:Article 1 – paragraph 1 – point 9 a (new), Article 25 – paragraph 2: (9a) Article 25(2) is replaced by the following: / "2. Where the circumstances referred to in paragraph 1 occur, the provider that initially placed the AI system on the market or put it into service shall no longer be considered to be a provider of that specific AI system for the purposes of this Regulation. / That initial provider, as well as providers of general-purpose AI models whose models are integrated into high-risk AI systems, shall closely cooperate with new providers and shall make available the necessary information and provide the reasonably expected technical access and other assistance that are required for the fulfilment of the obligations set out in this Regulation, in particular regarding the compliance with the conformity assessment of high-risk AI systems. / This obligation shall include: / (a) the provision of technical documentation sufficient to assess compliance with Article 16 requirements; / (b) the disclosure of known limitations and failure modes that could affect high-risk applications; / (c) the provision of reasonable technical access for testing and validation purposes. / This paragraph shall not apply in cases where the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system and therefore does not fall under the obligation to hand over the documentation.’ / "
Removed:(Regulation (EU) 2024/1689)
Regulation (EU) 2024/1689
Change 5
Changed:Article 1 – paragraph 1 – point 9 b (new), Article 27 – paragraph 4: (9b) in Article 27, paragraph 4 is replaced by the following: / "4. If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the deployer shall, when conducting the fundamental rights impact assessment referred to in paragraph 1 of this Article include cross references to the relevant sections of that data protection impact assessment or include relevant parts of that data protection impact assessment into the fundamental rights impact assessment. / "assessment."
Removed:(Regulation 2024/1689)
11 unchanged paragraphs
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 10, Article 28 – paragraph 8 (new): deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 10, Article 28 – paragraph 8 (new) – subparagraph 1: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 10, Article 28 – paragraph 8 (new) – subparagraph 2: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 11, Article 29 – paragraph 4 – second subparagraph: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 12 a (new), Article 42 – paragraph 2 a (new): (12a) In Article 42, the following paragraph is inserted: / '2a. Where an AI system is subject to the requirements of Regulation (EU) 2024/2847 as well as requirements set out in Article 15, and where those high-risk AI systems fulfil the essential cybersecurity requirements set out in Regulation (EU) 2024/2847, they shall be presumed to comply with the cybersecurity requirements set out in Article 15 in so far as those requirements are covered by the EU declaration of conformity or parts thereof issued pursuant to Regulation (EU) 2024/2847.';
Regulation (EU) 2024/1689
Change 6
Changed:Article 1 – paragraph 1 – point 13, Article 43 – paragraph 3: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)
9 unchanged paragraphs
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 13, Article 43 – paragraph 4 – subparagraph 3: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 14, Article 49 – paragraph 2: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 15, Article 50 – paragraph 7: 7. The Commission shall encourage and facilitate the drawing up of codes of practice at Union level to facilitate the effective implementation of the obligations regarding the detection, marking and labelling of artificially generated or manipulated content. The Commission shall assess whether adherence to those codes of practice is adequate to ensure compliance with the obligation laid down in paragraph 2, in accordance with the procedure laid down in Article 56(6), first subparagraph. If it deems the code is not adequate, the Commission may adopt an implementing act specifying common rules for the implementation of those obligations in accordance with the examination procedure laid down in Article 98(2).;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 16, Article 56 – paragraph 6: 6. The Commission and the Board shall regularly monitor and evaluate the achievement of the objectives of the codes of practice by the participants and their contribution to the proper application of this Regulation. The Commission, taking utmost account of the opinion of the Board and other relevant competent authorities, shall assess whether the codes of practice cover the obligations provided for in Articles 53 and 55, and shall regularly monitor and evaluate the achievement of their objectives. The Commission shall publish its assessment of the adequacy of the codes of practice.;
Regulation (EU) 2024/1689
Change 7
Changed:Article 1 – paragraph 1 – point 17 – point a, Article 57 – paragraph 3 a (new): (3a) The AI Office may also establish an AI regulatory sandbox at Union level for AI systems covered by Article 75(1). Such an AI regulatory sandbox shall be implemented in close cooperation with relevant competent authorities, in particular when Union legislation other than this Regulation is supervised in the AI regulatory sandbox, and shall provide priority access to SMEs, including startups.; / The AI Office shall ensure that, to the extent innovative AI systems referred to in paragraph 5 involve the processing of personal data or otherwise fall under the supervisory remit of other national authorities or competent authorities providing or supporting access to data, the national data protection authorities, the EDPB and those other national or competent authorities are associated with the operation of the AI regulatory sandbox established at Union level and involved in the supervision of those aspects to the extent that they relate to their respective tasks and powers, in accordance with Regulation (EU) 2016/679, Regulation (EU) 2018/1725 and Directive (EU)2018/680.;(EU) 2018/680.;
25 unchanged paragraphs
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 17 – point b, Article 57 – paragraph 5: 5. AI regulatory sandboxes established under this Article shall provide for a controlled environment that fosters innovation and facilitates the development, training, testing and validation of innovative AI systems for a limited time before their being placed on the market or put into service pursuant to a specific sandbox plan agreed between the providers or prospective providers and the competent authorities, ensuring that appropriate safeguards are in place. Such sandboxes may include testing in real world conditions supervised therein. When applicable, the sandbox plan shall incorporate in a single document the real-world testing plan.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 17 – point e, Article 57 – paragraph 14: When discussions are held within the framework of the Board, the European Data Protection Supervisor and the AI office shall, as part of their roles within the Board, also provide their feedback and exchange best practices on matters related to the establishment and operation of AI regulatory sandboxes established under their respective competences.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 18, Article 58 – paragraph 1 – point d (new): (d) the detailed rules applicable to the governance of AI regulatory sandboxes covered under Article 57, including as regards the exercise of the tasks of the competent authorities, the involvement and supervision by the competent data protection authorities and the coordination and cooperation at national and EU level.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 19 – point a, Article 60 – paragraph 1: 1. Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes may be conducted by providers or prospective providers of high-risk AI systems listed in Annex III, in accordance with this Article and the real-world testing plan referred to in this Article, without prejudice to the prohibitions under Article 5.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 19 – point b, Article 60 – paragraph 2: 2. Providers or prospective providers may conduct testing of high-risk AI systems referred to in Annex III in real world conditions at any time before the placing on the market or the putting into service of the AI system on their own or in partnership with one or more deployers or prospective deployers.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 20, Article 60 a (new) – paragraph 3: 3. Member States, the Commission, and national competent authorities such as market surveillance authorities and public authorities responsible for the management and operation of infrastructure and products covered by Union harmonisation legislation listed in Section B of Annex I shall cooperate closely with each other and in good faith, and shall remove any practical obstacles, including on procedural rules providing access to physical public infrastructure, where this is necessary, to successfully implement the voluntary real-world testing agreement and test AI-enabled products covered by Union harmonisation legislation listed in Section B of Annex.
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 21, Article 63 – paragraph 1: 1. SMEs, including start-ups, and micro enterprises may comply with certain elements of the quality management system required by Article 17 in a simplified manner. For that purpose, the Commission shall develop guidelines on the elements of the quality management system which may be complied with in a simplified manner considering the needs of SMEs and micro enterprises, without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 21 a (new), Article 64 – paragraph 2a (new): (21a) In Article 64, paragraph 2a is added: / ‘(2a) Without prejudice to the budgetary procedure and through existing financial instruments, the AI Office shall be allocated with adequate human, financial and technical resources, and with infrastructure to fulfil their tasks, to effectively perform its duties and exercise its powers in respect of the enforcement of Regulation (EU) 2024/1689. In particular, the AI Office shall have a sufficient number of personnel permanently available with in-depth competences and technical expertise. The AI Board shall assess competence and resource requirements.’
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 22 – point b, Article 69 – paragraph 3: deleted
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 24, Article 72 – paragraph 3: 3. The post-market monitoring system shall be based on a post-market monitoring plan. The post-market monitoring plan shall be part of the technical documentation referred to in Annex IV. The Commission shall adopt guidance on the post-market monitoring plan, including a template with elements to be included by 2 February 2027.;
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 25 – point b, Article 75 – paragraph 1: 1. Where an AI system is based on a general-purpose AI model, with the exclusion of AI systems related to products covered by the Union harmonisation legislation listed in Annex I and AI systems referred to in Annex III, point 2, and that model and that system are developed by the same provider or by providers belonging to the same group of undertakings, the AI Office shall have powers to supervise and enforce the obligations of this Regulation in accordance with the tasks and responsibilities assigned by it to market surveillance authorities. The AI Office shall also have powers to supervise and enforce the obligations under this Regulation in relation to AI systems that constitute or that are integrated into a designated very large online platform or very large online search engine within the meaning of Regulation (EU) 2022/2065. Where the Commission has not initiated proceedings for the same infringement, the competent authority of a Member State in which the main establishment of the provider of very large online platform or of very large online search engine is located, or where their legal representative is established, may have the powers to supervise and enforce the obligations under this Regulation. Notwithstanding the first subparagraph, the supervision and enforcement powers of the AI Office, do not include AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies, which are under the supervision of the European Da…
Regulation (EU) 2024/1689
Article 1 – paragraph 1 – point 25 – point b, Article 75 – paragraph 1 – subparagraph 2: When exercising its tasks of supervision and enforcement under the first subparagraph, the AI Office shall have all the powers of a market surveillance authority provided for in this Section and in Regulation (EU) 2019/1020. The AI Office shall take appropriate measures and decisions to adequately exercise its supervisory and enforcement powers. Article 14 of Regulation (EU) 2019/1020 shall apply mutatis mutandis.
Regulation (EU) 2024/1689
Change 8
Changed:Article 1 – paragraph 1 – point 25 – point b a (new), Article 75 – paragraph –1a (new): (ba) in Article 75, paragraph -1a is inserted: / ‘-1a. In the implementation and enforcement of this Regulation, the AI Office shall promote innovation, competitiveness and the protection of fundamental rights, taking them into consideration in the exercise of their functions. The AI Office shall coordinate closely with the competent data protection authorities designated pursuant to Regulation (EU) 2016/16792016/679 in matters involving the processing of personal data falling within the scope of that Regulation.’
Regulation (EU) 2024/1689