On 7 May 2026 the Council and Parliament reached a provisional political agreement on the Digital Omnibus on AI. Headlines have read the deal as "the AI Act gets pushed to 2027". That is partly true and partly misleading. This is the eight-minute read for compliance, security, and legal leads briefing a leadership team — written to amplify your in-house expertise.
What was announced on 7 May 2026
The 7 May agreement — captured in Council press release PRESS 299/26 — is a provisional political agreement between the co-legislators on the Commission's Digital Omnibus on AI package. The Omnibus itself was proposed on 19 November 2025 as part of the wider Digital Rulebook simplification effort.
Provisional matters. The Council and Parliament still have to translate the political deal into adopted legal text. Until that happens, Regulation (EU) 2024/1689 — the original AI Act — remains the law in force, with its original dates. Reading the May 2026 deal as "settled law" is the most common mistake in the current commentary cycle.
The deal is also a targeted amendment. It modifies certain deadlines and adds a specific new prohibition. It does not reopen the substantive obligations on prohibited practices, AI literacy, GPAI providers, or Annex III high-risk system requirements. Those continue to apply on the substantive terms set out in Regulation 2024/1689.
What's deferred
Four changes do the heavy lifting if and when the Omnibus is formally adopted.
- Annex III standalone high-risk obligations — application moves from 2 August 2026 to 2 December 2027. This is the biggest single deferral. Annex III covers standalone high-risk use cases — recruitment AI, credit scoring, educational-access decisions, parts of law enforcement, migration and asylum, and certain critical-infrastructure systems.
- Annex I embedded high-risk obligations — application moves from 2 August 2027 to 2 August 2028. Annex I covers AI used as a safety component of products already regulated under EU harmonised product legislation — medical devices, machinery, lifts, toys, and similar.
- Article 50 transparency and watermarking grace period — compressed from six months to three months, with the new deadline landing on 2 December 2026. The obligation itself is unchanged; what shortens is the wind-up window.
- National AI regulatory sandboxes — Member States' deadline to operationalise at least one sandbox moves to 2 August 2027.
The Omnibus deal also signals a new prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material — taking the Article 5 prohibitions list from eight to nine if formally adopted.
What's not deferred — the bear trap
This is where teams get caught. The Omnibus does not touch obligations already in force. From the European Commission AI Act timeline:
- Prohibited practices — live since 2 February 2025. Still live. Eight practices, with a probable ninth on the way.
- Article 4 AI literacy obligation — live since 2 February 2025. Still live. The deferral of high-risk obligations does not change the staff-literacy duty.
- GPAI model obligations under Articles 53 and 55 — live since 2 August 2025, with the voluntary General-Purpose AI Code of Practice as the endorsed compliance pathway. Still live.
There is also a more subtle trap. Even on the obligations the Omnibus would defer, the original Regulation deadlines are the law until the Omnibus is formally adopted. A team that pauses Annex III work today on the assumption "we have until December 2027" is making a bet on the legislative calendar — not following current law.
For organisations wanting a voluntary commitment signal before any of these dates resolve, the AI Pact remains the lowest-friction option — see the European Commission AI Pact page.
Three moves to make this fortnight
The right posture is "continue execution, adjust pace where appropriate". Three moves cover most teams.
- Re-run your Annex III inventory now. If you have one, refresh it against the current Annex III text. If you do not, build it. The deferral changes the when, not the what, and the inventory is the input for every subsequent decision. The AI Risk Register is the natural home for that work.
- Brief your leadership in writing. A short memo that names the eight prohibited practices (live), Article 4 literacy (live), GPAI obligations (live), and the Omnibus deferral status (provisional) is worth more than a verbal "we should probably look at this". Use the AI Governance Dashboard format to keep it board-readable.
- Pull the Article 50 watermarking work forward. If the grace period drops to three months with a 2 December 2026 deadline, October becomes too late to start the engineering. Move it into this quarter's planning, not next.
Where to read the source material
- Council press release PRESS 299/26 — 7 May 2026 agreement — the political deal itself.
- European Commission Digital Rulebook policy page — the Omnibus framing.
- European Commission AI Act policy page — the canonical timeline of what is currently in force.
Generate your AI policy → /tools/policy-generator
Qualified review still required. Outputs are AI-generated starting-point documents — not a substitute for qualified legal or compliance advice.