Pillar of the week
This week's pillar takes stock of where the EU AI Act actually sits in mid-2026 — three blocks of obligations already in force, four shifts the Digital Omnibus would defer, and five practitioner moves that hold their value regardless of how the Omnibus deal lands.
The Council–Parliament provisional political agreement of 7 May 2026 (PRESS 299/26) does not, by itself, change the law. Until the Omnibus is formally adopted, Regulation (EU) 2024/1689's original dates remain in force. Reading the May 2026 deal as "the AI Act is delayed" misses that the eight prohibited practices, the Article 4 AI literacy obligation, and the GPAI provisions in Articles 53 and 55 have all been live since 2025 — and the Omnibus does not touch any of them. Your programme should not be built on the "pushed to 2027" reading.
Three to watch
- EU Council–Parliament agreement on the Digital Omnibus on AI — Provisional political agreement reached 7 May 2026. Annex III standalone high-risk obligations would defer from 2 August 2026 to 2 December 2027 once formally adopted; Annex I embedded high-risk to 2 August 2028. Source: consilium.europa.eu
- Fed SR 26-2 modernises US bank model risk management — Federal Reserve, OCC, and FDIC interagency guidance issued 17 April 2026 supersedes SR 11-7 (2011) and SR 21-8 (2021). Generative and agentic AI carved out of formal MRM scope. Source: federalreserve.gov
- Article 50 transparency grace period compression — The Omnibus deal would shorten the synthetic-content marking grace period from 6 months to 3, with a new deadline of 2 December 2026. The obligation itself is unchanged; what shrinks is the wind-up window. Source: eur-lex.europa.eu
Sample of the week
This week's sample is the AI Incident Response Playbook — a 9-sheet workbook covering P1–P4 severity classification, the 6-step Detect → Contain → Assess → Notify → Remediate → Review process, a multi-regulator notification matrix (EU AI Act Art. 73, NYDFS 72-hour analogue, OCC operational reporting), and the post-incident review template. Free preview download, no purchase required.
Practitioner takeaway
Treat the Omnibus political agreement as a planning input, not as the law. Until formal adoption, Regulation (EU) 2024/1689's original dates remain in force, and the three blocks already enforceable — eight prohibited practices, Article 4 AI literacy, GPAI obligations under Articles 53 and 55 — do not move regardless of how the deal lands. The deferral window is best used to finish the Annex III inventory while regulatory pressure is lower. The eventual cost of "we have until 2027" if the Omnibus is delayed is much higher than the cost of building the inventory now. Qualified review still recommended before relying on any specific date.
This week's starting point
If you are auditing your AI bias controls before the Annex III window narrows, start with the AI Bias Audit Framework ($39) — a 25-question intake drives a 9-sheet audit workbook with fairness testing protocol, RACI matrix, and a live Dashboard that auto-refreshes as you mark gaps Done.