The Omnibus Is Signed. The OJEU Publishes This Week.
Two signatures. The President of the European Parliament and the President of the Council, at the foot of the AI Omnibus, on July 8, 2026. With that, the text stops being a political agreement and becomes a signed legal act. What remains — and it is the only thing that remains — is a page in the Official Journal of the European Union. And that page must be published before August 2.
When it appears, the Omnibus enters into force three days later. Annex III high-risk obligations officially defer to 2 December 2027. Annex I to 2 August 2028. The nudifier and CSAM prohibitions activate on 2 December 2026. And everything we have said in the conditional for months — “would move,” “if adopted,” “envisages deferring” — becomes present tense.
But August 2 does not empty out. And that is what this note is here to remind you.
What takes effect on August 2, with or without the Omnibus published
Art. 50(1), (3), and (4) transparency obligations are not deferred. They enter on August 2. If your company deploys a chatbot, a virtual assistant, an emotion recognition system, or generates deepfakes or informational content with AI, you must inform users. No size exemption. Fines: up to €15 million or 3% of turnover (Art. 99(4)). For SMEs, the lower amount applies (Art. 99(6)).
Regulatory sandboxes (Art. 57) activate. Commission enforcement powers over GPAI models enter into force — with fines up to €15 million or 3% of turnover for GPAI providers (Art. 99(4)). And Art. 4 AI literacy has been in force since February 2025.
The final Art. 50 guidelines remain unpublished. The Code of Practice on watermarking has not arrived either. The law enters without its manual. We said it two weeks ago. It holds. Check your classification.
Pay Transparency: three countries, six with movement, twenty-one still
Malta has joined Slovakia and Italy as the third Member State to complete transposition of the Pay Transparency Directive. Lithuania, Poland, and Czechia have partial transpositions. The other 21 countries — including Spain — have not moved. Sweden remains with the legislative process suspended.
Commissioner Lahbib has confirmed that infringement proceedings (Art. 258 TFEU) may follow. As of today, no letters of formal notice have been published. The clear provisions of the Directive — salary ranges in postings (Art. 5), pay history prohibition (Art. 6), gender pay information rights (Art. 7) — have had direct effect since June 8. Check your obligations.
September: what waits when you return
On September 11, the CRA activates vulnerability notification to ENISA — 24 hours for actively exploited vulnerabilities, 72 hours for the initial report, 14 days for the final report (Art. 14 of Reg. 2024/2847). Fines: up to €10 million or 2% of global turnover (Art. 64(3)). The following day, the Data Act requires access by design for new connected products (Art. 3(1) of Reg. 2023/2854).
If you manufacture IoT hardware, September demands two things simultaneously: an operational vulnerability notification process and firmware that allows data access by default. Both are due before the summer ends. Check your product.
What nobody is covering: Toy Safety has a new regulation
Regulation (EU) 2025/2509 on Toy Safety entered into force on January 1, 2026. It replaces Directive 2009/48/EC. It is a regulation — not a directive — which means it applies directly without national transposition. The transition period gives manufacturers time, but the clock is running.
We mention this because the pattern repeats: a regulation enters, media coverage is minimal, and when enforcement arrives, the companies that did not notice are the first to receive it. If you manufacture or import toys, verify what has changed from the previous directive. Toys were the second most notified category in Safety Gate 2025 (16%), behind only cosmetics.
What we do not know
We do not know the exact day of OJEU publication. We know it must happen before August 2. We do not know when the Commission will send the first letters of formal notice for Pay Transparency. And we do not know when the final Art. 50 guidelines or the watermarking Code of Practice will be published — two documents that should have arrived weeks ago and that companies need for precise implementation.
What we do know is that the Omnibus is signed. That the OJEU publishes this week or next. And that by the time we publish our next note, Art. 50 will be enforceable law.