Legal tech · Industry brief

Regulation (EU) 2026/1744, the E.U. Digital Omnibus on AI, entered into force on July 27, 2026, amending the EU AI Act with extended compliance deadlines and substantive changes. High-risk AI systems under Annex III now have until December 2, 2027 to comply (extended from August 2026), while AI systems that are products or safety components regulated by EU harmonization legislation have until August 2, 2028. The AI Omnibus narrows the definition of "safety component" to reduce the scope of systems deemed high-risk, expands who can conduct bias testing to include deployers and other AI providers, and extends the watermarking requirement deadline for synthetic content to December 2, 2026. The regulation also reduces compliance burdens for SMEs and small mid-cap enterprises through simplified documentation requirements and proportionality principles, and clarifies conformity assessment procedures to avoid duplication. Experts from Bird & Bird, Freshfields, Gibson Dunn, Orrick and Taylor Wessing note that while extended deadlines provide relief, the fundamental compliance burden remains substantial, particularly for high-risk AI providers, as harmonized standards and final guidelines are still being developed. In July 2026, cybersecurity researchers at Sysdig discovered a two-stage ransomware attack named Jadepuffer targeting AI infrastructure through a known vulnerability in LangFlow, a popular open-source framework for building large language model applications. The attack exploited the May 2025 vulnerability to encrypt files and delete AI model weights, training datasets and vector databases across 180 file categories, causing destruction estimated at $75,000 to $500,000 to retrain affected models. The incident demonstrates how AI middleware—orchestration tools that centralize AI development workflows—has become an attractive ransomware target because such tools hold API keys, cloud credentials and access to enterprise systems. Security experts recommend organizations inventory AI assets and infrastructure, strengthen third-party risk management for AI tools, implement secure backups of AI artifacts, lock down credentials and API keys, patch known vulnerabilities promptly, and establish security gates before experimental AI systems move to production.