On 7 May 2026, the European Parliament and the Council of the European Union reached a provisional political agreement under the European Commission’s “Digital Omnibus” package to amend and streamline aspects of the EU AI Act (the “AI Omnibus”). This follows the European Parliament’s position adopted last month (as discussed in our most recent edition of Neural Network) and previous trilogue discussions on 28 April 2026, which failed to result in a mutual agreement.
While we are yet to see the final text incorporating the changes, and the package still requires formal endorsement and adoption before it can become law, it confirms a roadmap for the AI Omnibus. Key obligations are being re‑timed, alongside targeted amendments in areas such as non‑consensual deepfakes and clearer rules on the interplay between the AI Act and EU product safety laws. The relatively quick process of development and agreement of the AI Omnibus reflects mounting pressure to avoid legal uncertainty ahead of 2 August 2026, which is the current implementation deadline for high-risk AI systems.
Key takeaways are set out below:
Updated Deadlines for High-Risk AI Obligations
The most critical outcome of the trilogue process is the changes to the timeline for compliance obligations applicable to high-risk AI systems under the EU AI Act. The AI Omnibus introduces fixed revised application dates for the AI Act’s core high‑risk regime:
- 2 December 2027 for stand‑alone high‑risk AI systems (Annex III); and
- 2 August 2028 for high‑risk AI embedded in regulated products (Annex I).
These revised dates are intended to provide legal certainty and allow more time for supporting compliance infrastructure (including standards and tools) to be implemented. National authorities in individual EU states will also have until 2 August 2027 to establish AI Act sandboxes (i.e. creating a risk-free environment to beta-test AI products).
New Targeted Prohibition for Non-Consensual “Nudifier” Deepfakes
A second headline change is a new prohibited practice covering AI systems used to generate non‑consensual sexual or intimate content (including child sexual abuse material), which is to apply from 2 December 2026. This is designed to address “nudifier” tools and adjacent forms of intimate deepfake misuse and signals proactive steps by EU institutions to intervene and tighten rules in areas associated with acute online harms, even as other implementation timelines are extended elsewhere.
Sectoral Product Regimes
Following the deadlock on discussions in late April, agreement has been reached on how the AI Act will interact with existing regulation, where overlap with EU product safety regimes already exists. This is an attempt to avoid “double-regulation” by channelling compliance through existing frameworks, rather than adding AI Omnibus high-risk requirements on top. As a result of intense lobbying from the machinery sector, the Machinery Regulation has been singled out in the AI Omnibus as exempt from direct AI Act applicability. Where overlap exists, AI-specific rules and guidance under the existing Machinery Regulation will apply.
New Timeline for Transparency Rules
The AI Omnibus has also moved the application date for new transparency and marking obligations to 2 December 2026, pushing the compliance date back from 2 August 2026. These rules are designed to make AI-generated audio, image, video and text detectable and traceable. The exact scope of these rules will be confirmed once the full AI Omnibus text is published.
We will provide further updates on the final AI Omnibus text, once published, via our monthly Neural Network.
With thanks to Sam Pollock for his contribution to this article.
