The EU AI Act after the 2026 omnibus: what concerns a Moroccan exporter

Regulation (EU) 2024/1689 on artificial intelligence applies beyond the borders of the Union. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, postponed its obligations relating to high-risk systems. It also added new prohibited practices, without amending the transparency obligations of Article 50(1) to (4). The Regulation may concern a Moroccan company as a provider or as a deployer, within the meaning of that text. It may also concern it indirectly, as a service provider to a European client itself subject to the Regulation.

The text: Regulation (EU) 2024/1689

The Regulation lays down harmonised rules for the placing on the market, the putting into service and the use of AI systems in the Union. It proceeds by levels of risk. Thus, it addresses prohibited practices (Article 5) and high-risk systems subject to design, documentation and monitoring requirements (Chapter III). It also lays down transparency obligations for certain systems (Article 50) and rules specific to general-purpose AI models (Chapter V).

Regulation (EU) 2026/1744 of 8 July 2026 appeared in the Official Journal on 24 July 2026. It entered into force on the third day following its publication. It amends the timetable of Regulation (EU) 2024/1689 and lightens several obligations, in particular for small and medium-sized enterprises.

Scope: extraterritorial application of Regulation (EU) 2024/1689

Article 2(1) makes subject to the Regulation providers placing on the market or putting into service AI systems in the Union. This applies whether their place of establishment is in the Union or in a third country. In addition, the provision covers providers and deployers established in a third country where the output produced by the system is used in the Union. Three situations are relevant to a Moroccan exporter:

• the company integrates an AI system into a product, software or service that it markets in the Union: it may have the status of provider;
• using an AI system, the company produces content or results intended for a client established in the Union (translations, marketing content, analyses, customer service): it may have the status of a deployer whose output is used in the Union;
• the company supplies a European client that itself deploys AI systems: it is not directly covered, but the client may contractually pass on to it part of its own requirements.

Purely internal use of an AI tool, whose results are not used in the Union, falls outside that scope. Qualification depends on the facts and therefore requires a check, use by use.

The timetable of Regulation (EU) 2024/1689 after the omnibus

Article 113 of the Regulation sets general application at 2 August 2026. However, the definitions, the AI literacy obligation and the prohibited practices have applied since 2 February 2025. Since 2 August 2025, the rules on notifying authorities and notified bodies (Chapter III, Section 4) and on general-purpose AI models (Chapter V) have applied. Likewise, the rules on governance (Chapter VII) and penalties (Chapter XII, except Article 101) have applied since that date.

Regulation (EU) 2026/1744 postpones to 2 December 2027 the obligations in Sections 1 to 3 of Chapter III for high-risk systems falling under Annex III. Annex III covers, in particular, employment and workers’ management, access to essential services and education. The omnibus also postpones to 2 August 2028 the obligations concerning systems classified as high-risk pursuant to Article 6(1) and Annex I. These systems are, in other words, safety components of products covered by the Union harmonisation legislation listed in Annex I, or those products themselves.

In addition, the omnibus adds to Article 5 two prohibited practices, applicable from 2 December 2026. The first concerns systems that generate or manipulate realistic content depicting the intimate parts of an identifiable person, or that person engaging in sexually explicit activities, without that person’s consent. The second concerns systems that generate or manipulate child sexual abuse material. Finally, the omnibus provides for a transitional period of four months, namely until 2 December 2026, for the marking of synthetic content. That period concerns providers whose systems were on the market before 2 August 2026.

The obligations already applicable

Article 4, as amended by Regulation (EU) 2026/1744, requires providers and deployers to take measures to promote the development of AI literacy. Those measures target their staff and the persons using the systems on their behalf. However, the Article does not oblige them to ensure a specific level of literacy in each individual.

Article 50 of Regulation (EU) 2024/1689 organises transparency. First, providers ensure that the design of systems intended to interact directly with natural persons informs those persons that they are interacting with an AI system. This obligation does not apply where the interaction is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect. That assessment takes into account the circumstances and the context of use. Second, providers of systems generating synthetic content must mark those outputs in a machine-readable format. Finally, deployers must disclose that AI has generated or manipulated a deep fake. This disclosure also covers texts published with the purpose of informing the public on matters of public interest. In each case, the exceptions provided for in the text remain applicable.

Implications for the exporter

For most Moroccan exporters, the immediate issue is not high risk, but transparency and the contractual relationship. Thus, a chatbot open to customers located in the Union must, by design, inform them that it is an AI. That obligation falls on its provider. The company that puts the chatbot into service under its own name or trademark holds that status. Moreover, content produced with AI and delivered to a client may be subject to that client’s obligations. European contracting parties are progressively incorporating these requirements into their contracts and supplier questionnaires.

The postponement of the high-risk obligations provides a period of time, not an exemption. Consequently, a company whose product integrates a system falling under Annex III must prepare now the required documentation, risk management and human oversight. These requirements apply from 2 December 2027.

Points of attention

• Map the uses of AI whose results the company delivers to clients established in the Union.
• Determine, for each use, the company’s role: provider, deployer or mere internal user.
• Inform the persons interacting with a chatbot intended for users located in the Union.
• Examine the AI-related clauses in the contracts and questionnaires of European clients.
• Document the measures taken to train teams under Article 4.
• Check, for any product or software integrating an AI system, whether it may qualify as high-risk. The corresponding deadline is 2 December 2027 (Article 6(2) and Annex III) or 2 August 2028 (Article 6(1) and Annex I).

References

• Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024, Articles 2, 3, 4, 5, 6, 50 and 113.
• Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026, recitals 10, 38 and 40; Articles 4, 5, 111 and 113 of Regulation (EU) 2024/1689 as amended.

See also: Free AI tools: what users pay in data; Checklist – Compliance of AI uses. Information Systems & Digital Transformation and International Trade & Export practices.