AI Act Omnibus: High-Risk Rules Delayed to December 2027
EU co-legislators struck a provisional political agreement in the early hours of Thursday 7 May 2026 on the so-called Digital Omnibus on AI — a regulation amending the AI Act that postpones key compliance deadlines and adds a new prohibition on AI “nudification” apps.
The high-risk delay: 16 months
The single most consequential change is the deferral of the AI Act’s high-risk obligations. Under the original Regulation (EU) 2024/1689, these were set to apply from 2 August 2026. Under the Omnibus, the new dates are:
- 2 December 2027 for stand-alone high-risk AI systems under Annex III — biometrics, critical infrastructure, education, employment, law enforcement, and border management;
- 2 August 2028 for AI systems embedded in products covered by EU sectoral safety legislation (Annex I) — medical devices, machinery, toys, lifts, watercraft.
The nudification ban
The deal adds — at the trilogue stage — a new prohibition on AI systems that generate non-consensual sexually explicit content as well as AI-generated child sexual abuse material. Companies offering such systems will have until 2 December 2026 to bring their products into compliance, meaning these tools must be removed from the European market entirely by that date.
Co-rapporteur Arba Kokalari (EPP, Sweden) framed the broader deal in defensive terms: “We are not weakening any safety rules; we are clarifying the rules for companies in Europe. Companies should not be regulated twice for one thing.” Co-rapporteur Michael McNamara (Renew, Ireland) emphasised the fundamental-rights dimension: “Alongside simplification measures, we are banning nudification apps, a key part of the Parliament’s mandate, and, of course, the creation of child sexual abuse material using AI systems.”
SME and watermarking changes
The deal extends a series of regulatory privileges previously available only to SMEs to small mid-cap companies (SMCs). The grace period for watermarking AI-generated content has been reduced from six to three months, with the new deadline set on 2 December 2026. AI regulatory sandboxes at national level have been postponed to 2 August 2027.
The political stakes
The Digital Omnibus on AI is the first deliverable under the “One Europe, One Market” roadmap. The deal was politically significant because it was reached just nine days after a failed trilogue on 28 April. The provisional agreement must now be formally adopted by both the Parliament and the Council before 2 August 2026.
Beyond the AI Omnibus, the next chapter is the Data Omnibus — a separate proposal published on 19 November 2025 amending the GDPR and the ePrivacy Directive. With no imminent deadline, that process will unfold more slowly, but the substantive changes it proposes — including a narrower definition of personal data — are expected to be far more disruptive than the AI Omnibus itself.
