The AI Act keeps its shape and loses sixteen months: reading the Omnibus deal

In the early hours of 7 May, negotiators for the European Parliament and the Council reached a provisional agreement on the Digital Omnibus on AI, the Commission proposal that amends Regulation (EU) 2024/1689, the AI Act[1]. A second trilogue on 28 April had ended without agreement, and the Cypriot Presidency needed a deal before the end of its term on 30 June[2]. The text now goes to formal adoption, and the co-legislators intend to complete it before 2 August 2026[1]. Until publication in the Official Journal, the original timetable remains the law[2].

Our generation will work under this law for its whole career. Eighteen months after adoption, the Union has decided that the Act was running ahead of its own standards. The deal of 7 May is a deferral, and it should be read as one, with gains and costs counted separately.

What moves

The original Act applied its obligations for high-risk systems listed in Annex III from 2 August 2026, and those for high-risk systems embedded in regulated products under Annex I from 2 August 2027. The Commission proposed on 19 November 2025 to make both dates conditional. Under COM(2025) 836[8], the obligations would have applied only once the Commission had found that harmonised standards were available, with long-stop dates of 2 December 2027 for stand-alone systems and 2 August 2028 for embedded systems[3]. The Council's mandate of 13 March 2026 removed the condition and kept the long-stop dates as fixed dates[3]. Parliament's position, adopted in plenary on 26 March 2026 by 569 votes to 45, also demanded fixed deadlines[2].

The agreed text follows the co-legislators. Obligations for Annex III use cases, which include biometrics, critical infrastructure, education, employment, law enforcement and border management, apply from 2 December 2027. Obligations for AI used as a safety component under sectoral safety legislation apply from 2 August 2028[1]. The conditional trigger is gone. A developer of a recruitment tool now knows the date, and so does the candidate it screens.

The second shift concerns transparency. Article 50 of the Act requires providers to mark AI-generated content in a machine-readable way. The Commission proposed to delay that obligation to 2 February 2027. Parliament sought a three-month transition. The deal sets 2 December 2026 for systems already on the market[1][2]. The other Article 50 duties, including the duty to tell a person that they are talking to a machine, keep the general application date of 2 August 2026 fixed by Article 113 of the Act[4].

The third shift concerns scope. Machinery products with embedded AI will comply with sectoral safety rules alone, subject to an equivalence safeguard, and no longer with both regimes[1]. The definition of safety component is narrowed, so that an AI function that only assists a user or optimises performance leaves the high-risk regime where its failure creates no risk to health or safety[1]. Parliament had wanted that carve-out for every regulated product sector, and the Council refused[2]. Laura Caroli of Tech Policy Press argues that the wider exemption would have broken the horizontal structure of the Act[5]. We agree. One carve-out with a bridging clause is a compromise. Twelve would have been a different law.

The fourth shift concerns governance. The AI Office gains enforcement competence over certain AI systems built on general-purpose models, and over systems embedded in very large online platforms and search engines under the Digital Services Act[1][6]. Privileges available to SMEs extend to small mid-cap companies[1].

What stays, and what is new

Two dates do not move. The prohibitions in Article 5 have applied since 2 February 2025. The obligations for general-purpose AI models have applied since 2 August 2025[4]. The AI literacy duty in Article 4 continues to apply[2]. The risk-based architecture, the governance chain and the core obligations for high-risk systems are intact; the Council says the co-legislators broadly maintained the thrust of the Commission's proposal[7].

The deal adds one prohibition. AI systems that generate child sexual abuse material, or that depict the intimate parts of an identifiable person or that person in sexually explicit activity without consent, are banned. The ban covers placing such systems on the market for that purpose, placing them without reasonable safeguards against such use, and the deployer's use. It extends to images, video and audio, and it applies from 2 December 2026[1]. Michael McNamara, co-rapporteur for the Civil Liberties Committee, called the nudifier ban "a key part of the Parliament's mandate"[1]. The Commission's own press release led with it[6]. The Union has delayed the general protection of fundamental rights in high-risk systems by sixteen months and, in the same text, banned the abuse most visible to our generation. Both choices are defensible. They are not the same choice.

The deal also widens the legal basis for processing special categories of personal data to detect and correct bias. That basis now reaches all providers and deployers, whatever the risk class, under a strict necessity standard[1][2]. Civil society warned that this invites broader data collection, and Caroli reports that the outcome left civil society and industry "frustrated rather than relieved"[5].

What the delay buys and what it costs

The honest case for the deferral is that the harmonised standards on which high-risk compliance depends were not ready[5]. Fixed dates answer that problem better than the Commission's conditional trigger, which would have tied the rights of citizens to a Commission finding about standardisation.

The cost is sixteen months during which an AI system that screens job applicants, scores credit or assists a border guard carries no binding conformity duty under the Act. Nothing in the deal fills that interval. Four things should follow. The Commission should publish, before 2 August 2026, a schedule for each harmonised standard requested from the European standardisation organisations, so that the new dates cannot slip for the same reason. Member States should use the interval to stand up their market surveillance authorities and notified bodies, so that December 2027 does not become another August 2026. Public buyers should write the Annex III obligations into procurement contracts now, because a contract can impose what the Act has deferred. Parliament should attach to the final text a review clause that requires the Commission to report by mid-2027 on the readiness of standards and authorities.