Digital Omnibus Deal Reached: Annex III High-Risk Obligations Move to 2 December 2027

How we got here, the political path from November 2025 to 7 May 2026

The Digital Omnibus on AI (file 2025/0359/COD, COM(2025) 836) was proposed by the European Commission on 19 November 2025. The Council of the European Union agreed its negotiating position on 13 March 2026. The European Parliament adopted its position on 26 March 2026 by a plenary vote of 569 in favour, 45 against, with 23 abstentions, with IMCO and LIBE rapporteurs Arba Kokalari (EPP, Sweden) and Michael McNamara (Renew, Ireland) leading the file.

The first political trilogue closed quickly with broad alignment on most of the package. The second political trilogue on 28 April 2026 ended after approximately twelve hours without political agreement, breaking on the conformity assessment architecture for AI systems embedded in products that fall under existing EU sectoral safety law. A follow-up trilogue was anticipated around 13 May, but the Cypriot Presidency reopened negotiations earlier than scheduled. In a decision that surprised some observers, the third political trilogue closed in the early hours of Thursday 7 May 2026, ahead of its expected slot.

Co-rapporteur Kokalari summarised the outcome by saying politics had shown it could move "just as quickly as technology". The hard wall remains 2 August 2026, formal adoption by both institutions and publication in the Official Journal must complete before that date for the deferral to take legal effect. Both institutions have publicly stated their intent to complete adoption in time.

The deal, what changed

Nine substantive elements of the AI Act change under the 7 May provisional agreement. The headline is the postponement; the rest of the package matters operationally.

1. Annex III high-risk obligations: 2 December 2027

Standalone high-risk AI systems listed in Annex III, employment, education, biometrics, critical infrastructure, law enforcement, justice, migration, essential services credit and insurance, now apply from 2 December 2027 instead of the original 2 August 2026. This is a 16-month deferral. All Article 9–15, 17, 27, 43, 49, 72, 73 obligations move with this date.

2. Annex I embedded high-risk obligations: 2 August 2028

AI embedded as safety components in products subject to EU sectoral safety law, the Machinery Regulation, Medical Device Regulation, In Vitro Diagnostic Regulation, Radio Equipment Directive, and others, applies from 2 August 2028 instead of 2 August 2027. This is a 12-month deferral.

3. Article 50(2) watermarking: 2 December 2026

Providers of generative AI systems marking synthetic audio, image, video or text content as machine-readable now have until 2 December 2026, a four-month extension from the original 2 August 2026 date. The Commission originally proposed a six-month extension; the co-legislators settled on three months past the original deadline. All other Article 50 transparency obligations (chatbot disclosure, deepfake disclosure to users) continue to apply from 2 August 2026.

4. New Article 5 prohibition, CSAM and non-consensual intimate imagery

A new prohibited practice was added to Article 5: placing AI systems on the EU market that generate or manipulate non-consensual intimate imagery, or that generate child sexual abuse material, including systems placed without reasonable safety measures to prevent such generation. Compliance deadline: 2 December 2026. This is the first substantive expansion of the prohibited-practices list since the Act's original adoption and affects every generative AI provider.

5. Article 6(3) registration survived

The Commission's original proposal would have removed the obligation for providers to register, in the EU AI database, AI systems operating in Annex III contexts that providers self-assess as not meeting the high-risk threshold under Article 6(3). Both Parliament and Council reinstated this obligation. Self-assessed non-high-risk determinations remain registrable, a transparency discipline for downstream deployers and regulators.

6. New Article 4a, bias detection for non-high-risk systems

A new article allows all providers and deployers (including non-high-risk) to process special categories of personal data for the detection and correction of bias, with appropriate safeguards. The strict-necessity standard is retained. This was an EDPB/EDPS-consensus position and represents a practical win for organisations conducting fairness audits across AI portfolios.

7. AI Office enforcement strengthened

The AI Office gains direct supervisory competence over AI systems based on general-purpose AI models developed by the same provider or group, and over AI systems integrated into very large online platforms or search engines (VLOPs/VLOSEs under the Digital Services Act). National authorities remain competent for law enforcement, border management, judicial authorities, and financial institutions.

8. Sandboxes, national deadline moved, EU-level added

The Member State obligation to have at least one national AI regulatory sandbox operational moves from 2 August 2026 to 2 August 2027. In parallel, a new EU-level sandbox operated by the AI Office is created, with priority access for SMEs, startups, and small mid-caps.

9. SME and small mid-cap simplifications

Regulatory privileges previously available to SMEs in Article 99 are extended to "small mid-cap" enterprises. Penalty modulation rules apply. Simplified documentation pathways are preserved.

The new compliance timeline at a glance

What did not change, and this matters most for compliance teams

The Digital Omnibus does not alter the core regulatory architecture. Every substantive obligation for high-risk AI remains intact, only the date changed. Documentation work done against 2 August 2026 is not wasted; it carries forward to 2 December 2027:

The Article 4 AI literacy uncertainty

What this means for the next 90 days, the operational priorities

The deferral changes the date, not the work. Compliance teams that started in March or April have runway. Teams that paused on the assumption the Omnibus would arrive should restart now, because the Omnibus has arrived but the work it requires has not gotten smaller:

1. For generative AI providers, the 2 December 2026 lift is now the closer deadline. Article 50(2) watermarking and the new Article 5 CSAM/NCII prohibition both hit on 2 December 2026. Seven months out. Build the safety-filter documentation, watermarking technical architecture, and transparency framework now.
2. Complete the AI system inventory. Every AI system built, deployed, or integrated, including third-party AI features embedded in SaaS. Over half of organisations still lack a comprehensive inventory.
3. Classify each system against Annex III, applying the Article 6(3) profiling override exception where legitimate and documenting the rationale in writing. The Omnibus reinstated the obligation to register self-assessed non-high-risk determinations in the EU database.
4. For each high-risk system, complete the Annex IV technical documentation pack , this is the single most time-intensive deliverable and cannot be rushed in the final weeks before 2 December 2027. CEN/CENELEC harmonised standards remain pending; build against the Articles themselves.
5. Conduct the Article 27 FRIA where you are a covered deployer (public-sector, essential services). This obligation is unchanged.
6. Appoint an EU authorised representative if you are a non-EU provider of high-risk AI.
7. Treat Article 4 AI literacy as live, it has been legally applicable since 2 February 2025 regardless of the Omnibus consolidated-text outcome.
8. Plan for Article 50 transparency (most parts) and Article 49 database registration from 2 August 2026. These obligations were not touched by the Omnibus and apply on the original date.

What to monitor in the coming weeks

• Council and Parliament formal adoption votes, both institutions must adopt the consolidated text before the Official Journal publication window closes. Watch for committee scheduling under the Cypriot Presidency and floor votes through May–June.
• Official Journal publication window, to take effect before 2 August 2026, the regulation needs publication by mid-to-late July at the latest. After that the runway disappears and the high-risk obligations apply on the original date as enacted.
• Final Article 4 landing position, the consolidated text will clarify whether the Article 4 direct obligation on providers and deployers was preserved or shifted to a Commission / Member-State-led framework.
• Commission Article 50(2) watermarking technical guidance, expected in summer 2026 ahead of the 2 December 2026 deadline.
• National competent authority designations, several Member States are still finalising authority structures. Check our Member State tracker for current status.

Sources and citations

• European Parliament press release (ref. 20260427IPR42011), 7 May 2026
• Bird & Bird, "Digital Omnibus on AI Provisional Agreement Reached at the May Trilogue", 7 May 2026
• NicFab Blog, "Digital Omnibus on AI: the Provisional Agreement of 7 May 2026"
• Modulos, "EU AI Act Delayed: The Omnibus Deal Closed on 7 May 2026"
• Timelex, "The AI Omnibus deal: what survived the trilogue?", 7 May 2026
• Travers Smith, "EU agrees to delay key AI Act compliance deadlines", 8 May 2026
• Orrick, "EU's Digital Omnibus on AI: 7 Key Changes You Need to Know", 8 May 2026
• Linklaters TechInsights, "Omnibus Agreement: How the EU AI Act changes"
• Lexology, "EU Legislators reach agreement on AI Digital Omnibus Regulation"
• European Parliament Legislative Train Schedule, "Digital Omnibus on AI" file (status: Close to adoption)
• European Commission proposal COM(2025) 836, Digital Omnibus on AI, 19 November 2025
• Council of the EU, press release on general approach, 13 March 2026
• IMCO / LIBE joint report by rapporteurs Kokalari and McNamara, 18 March 2026
• Regulation (EU) 2024/1689, Official Journal of the European Union, 12 July 2024

Originally published 19 April 2026. Updated 6 May 2026 to reflect the 28 April trilogue outcome. Updated 27 June 2026 to reflect the European Parliament's 16 June 2026 adoption of the Digital Omnibus. Further updates will follow formal adoption by Parliament and Council, and Official Journal publication. The agreement remains provisional until both institutions complete formal adoption.