EU AI Act Digital Omnibus: high-risk deferred to 2027

01 · THE TRILOGUE

The 2026-05-07 trilogue · what was agreed.

On the evening of 2026-05-07, in Brussels, Council Presidency negotiators and European Parliament rapporteurs reached a provisional political agreement on the Digital Omnibus on AI. The Commission tabled the Omnibus on 19 November 2025 as part of the broader Digital Omnibus package, which sweeps in revisions to the AI Act, the Data Act, the Data Governance Act, and adjacent digital files. The headline outcome on the AI Act file, in the Council's own framing in press release 299/26, is to simplify and streamline the rules, with two operative effects: a deferral of the application calendar, and a tightening of the transparency calendar.

The Council press release dated 2026-05-07 carries the working summary: Annex III standalone high-risk obligations move from 2 August 2026 to 2 December 2027; Annex I high-risk embedded in regulated products moves from 2 August 2027 to 2 August 2028; AI regulatory sandboxes at national level move to 2 August 2027; the Article 50 transparency grace period falls from six months to three months, putting the operative cut-over at 2 December 2026. A new prohibition is added: AI generation of non-consensual sexual or intimate content and child sexual abuse material.

Provisional agreements in the Union legislative process are political, not legal. They reflect the position of the negotiators in the room. They do not yet reflect the position of the Council as a whole, the Parliament as a whole, or the regulation as enacted. The four downstream steps from provisional agreement to binding law are explicit and sequential. Until those four steps complete, the AI Act as published on 12 July 2024 in the Official Journal continues to govern.

"The deferral is a window, not a reprieve. The substantive obligations of Articles 11, 12, 13, 14, and Annex IV are unchanged. Only the application calendar moved."Warrant Editorial · 2026-05-08

02 · FIVE OPERATIVE CHANGES

The five operative changes in the provisional text.

The Council press release of 2026-05-07 sets out five operative changes inside the AI Act file. Each is paraphrased verbatim where the text permits. The political character of the document cautions against quoting language that has not yet completed legal-linguistic revision, but the substantive shape is unambiguous.

§ 1

Annex III standalone high-risk · application date moves from 2 August 2026 to 2 December 2027. READING · the eight Annex III use cases, biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, administration of justice, all see a 16-month deferral on the application of Articles 9, 10, 11, 12, 13, 14, 15, 17, 26, 47, and 72.

§ 2

Annex I embedded high-risk · application date moves from 2 August 2027 to 2 August 2028. READING · AI systems that are safety components of products covered by the New Legislative Framework (MDR, Machinery, Toy Safety successor, and the rest of Annex I) get an additional 12 months of grace before the AI Act's high-risk requirements layer onto the existing sectoral file.

§ 3

National AI regulatory sandboxes · operative date pushed to 2 August 2027. READING · Article 57 obliges Member States to establish at least one AI regulatory sandbox at national level. The original Article 113 timeline put this at 2 August 2026. The Omnibus moves it to 2 August 2027, recognising the operational reality that several Member States have not yet stood up the supervisory infrastructure.

§ 4

Article 50 transparency · grace period reduced from six months to three months. New deadline 2 December 2026. READING · the substantive obligation, that providers and deployers of generative AI mark synthetic content as artificially generated or manipulated, is unchanged. The grace clock is shortened. The operative cut-over for generative-AI labelling moves earlier, to 2 December 2026, from the originally enacted 2 February 2027.

§ 5

New prohibition · AI generation of non-consensual sexual or intimate content, and AI generation of child sexual abuse material (CSAM). READING · added to the Article 5 list of prohibited practices. The original Article 5 list, in force since 2 February 2025, covers manipulation, exploitation of vulnerabilities, social scoring, predictive policing in narrow circumstances, untargeted facial-image scraping, emotion recognition in workplace and education, biometric categorisation by sensitive attributes, and real-time remote biometric identification in public spaces for law-enforcement purposes. The Omnibus adds a sixth class to that list.

03 · WHAT DID NOT CHANGE

What did not change · the in-force layer.

The Omnibus is a deferral instrument. It moves application dates forward in time and reshapes one transparency clock. It does not unwind the parts of the regulation already in force. Three layers of obligation are unaffected by the 2026-05-07 agreement, and any reading of the Omnibus that suggests a wider reset is misreading the political text.

The first layer in force is the 2 February 2025 perimeter. The Article 5 prohibited-practices list applies. The Article 4 AI literacy obligation applies to providers and deployers. Neither moves. The Omnibus adds to the Article 5 list, it does not subtract.

The second layer in force is the 2 August 2025 perimeter. The Articles 53 and 55 obligations on general-purpose AI model providers apply. Article 53(1)(a) technical documentation, Article 53(1)(b) downstream-provider documentation, Article 53(1)(c) copyright policy, Article 53(1)(d) sufficiently detailed training-data summary, and the Article 55 systemic-risk obligations for the largest models, all of these continue to bind. The governance architecture (Article 64 AI Office, Article 65 European Artificial Intelligence Board, Article 67 Advisory Forum, Article 70 national competent authorities) is operative. The penalty regime in Article 99 is operative for breaches of these provisions.

The third layer is Article 6(1). Article 6(1) treats an AI system as high-risk when it is a safety component of a product covered by Union harmonisation legislation listed in Annex I, or is itself such a product subject to third-party conformity assessment. The original timeline for paragraph 1 application was 2 August 2027. The Omnibus moves it to 2 August 2028. Article 6(1) itself, the classification rule, is unchanged.

04 · WHY THE DEFERRAL

Why the deferral happened · three operative reasons.

The Commission tabled the Digital Omnibus on AI on 19 November 2025. The political case for a deferral, reading both the Commission's tabling memorandum and the Council and Parliament position papers in the run-up to the 2026-05-07 trilogue, rests on three operative reasons.

First, the Commission missed the 2 February 2025 deadline for the Article 96(1) guidance on the practical implementation of the regulation, including the application of the Article 6 high-risk classification. The original Article 96 timeline anticipated guidance in place a clear eighteen months before the Annex III application date. That cushion was lost. Providers preparing for 2 August 2026 had been working from draft guidance and aggregator paraphrase, not from the Commission's authoritative reading.

Second, the harmonised standards mandated under Article 40 and developed by CEN-CENELEC JTC 21 under standardisation request M/593 are running behind the original publication calendar. As of May 2026, several Type-A and Type-B horizontal deliverables remained in draft. The provider wishing to avail itself of the Article 40(1) presumption of conformity through a harmonised standard could not do so for parts of the Annex IV documentation surface, because the harmonised standards were not in the Official Journal yet.

Third, SME readiness. Article 11(1) explicitly contemplates simplified technical documentation for small and medium-sized enterprises and start-ups, and Article 62 obliges Member States to take SMEs and start-ups into special account. The Council and Parliament received material industry input arguing that the 2 August 2026 date, in the absence of complete Commission guidance and complete harmonised standards, would impose a disproportionate compliance load on smaller providers. The Omnibus's deferral is, in part, a response to that input.

05 · WHAT "PROVISIONAL" MEANS

What "provisional" actually means · four steps to binding law.

The provisional agreement reached on 2026-05-07 is a political document. The European Union legislative process turns a political agreement into binding law through four operative steps, in sequence. None of the four steps is mechanical. Each is a separate institutional decision.

step 1

Council formal endorsement. READING · the Council, voting under qualified majority on the AI Act file, formally endorses the provisional text. This converts the negotiator-level agreement into a Council position. The vote is calendared by the Presidency.

step 2

Parliament formal endorsement. READING · Parliament, in plenary, formally endorses the provisional text. This converts the rapporteur-level agreement into a Parliament position. Calendared through the committee responsible (IMCO and LIBE on the AI Act file) and the plenary agenda.

step 3

Legal-linguistic revision. READING · the lawyer-linguists at Council and Parliament finalise the text in all 24 official languages. This step catches drafting inconsistencies and ensures legal coherence with the rest of the acquis. Substantive amendments at this stage are rare but not unprecedented.

step 4

Co-legislator adoption + publication in the Official Journal. READING · once both institutions have formally adopted the legally-linguistically revised text, it is published in the Official Journal of the European Union. The amending regulation enters into force on the day specified in its final provisions, which is typically the twentieth day after publication.

The Council and Parliament have signalled intent to complete all four steps before 2 August 2026, the original Annex III application date. Intent is not certainty. Until step 4 completes, the AI Act as enacted in Regulation (EU) 2024/1689, with its Article 113 application calendar, is the binding instrument. The 2 December 2027 date is the provisional intention. The 2 August 2026 date is the enacted reality.

06 · THE ASYMMETRY

The asymmetry · timing moved, content did not.

The single sharpest reading of the Omnibus is the asymmetry between what moved and what did not. What moved is the application calendar. What did not move is the substantive content of the obligations. Article 12 still binds the provider to technically allow for the automatic recording of events over the lifetime of the high-risk AI system. Article 13 still binds the same provider to ship instructions for use sufficient to enable the deployer to interpret outputs. Article 11 still binds the provider to draw up the Annex IV technical documentation file before placing the system on the market. Annex IV still specifies, in nine sections, what that file must contain.

The asymmetry has a practical implication for any provider that has been preparing for the 2 August 2026 date. The deferral pushes when the obligations bite, not what the obligations require. A provider whose Annex IV file is complete, whose Article 12 logging pipeline is automatic and lifetime, whose Article 13 instructions for use cover all seven mandatory elements, and whose Article 14 human-oversight measures are documented and operative, is ready under any deferred date. The work done against 2026-08-02 is not wasted work. It is work-in-place against 2027-12-02.

The reverse implication is also true. A provider that uses the deferral as a reason to slow Annex IV preparation is gambling on the four-step adoption process completing on schedule. If formal adoption slips past 2 August 2026, the regulation as enacted governs, and the deferral the provider was relying on does not exist as binding law on that date.

07 · FOR WARRANT CUSTOMERS

What this means for Warrant customers · the evidence pattern is unchanged.

Warrant produces evidence packages from AI agent execution traces, each one a record mapped to a specific EU AI Act obligation and independently verifiable without contacting Warrant. The package emits structured fields mapped to specific articles of the AI Act, including Article 12 logging fields, Article 13 instruction-for-use fields, and Annex IV section-by-section field mapping. None of those mappings change as a function of the 2026-05-07 provisional agreement. The Omnibus does not amend Article 11, Article 12, Article 13, Article 14, Article 15, Article 47, or Annex IV. It moves the date on which they begin to apply to Annex III standalone systems.

For a customer running an Annex III high-risk AI system in production today, the operational guidance is unchanged from the pre-Omnibus position. Build to the substantive obligations as if 2 August 2026 binds, because in the absence of formal Omnibus adoption, it does. If the four-step adoption process completes before 2 August 2026, the date moves to 2 December 2027 and the customer arrives at that date with an evidence package already produced. If the adoption process slips, the customer arrives at 2 August 2026 ready.

Sample EU evidence package · Warrant registerA RECORD MAPPED TO A SPECIFIC EU AI ACT OBLIGATION · INDEPENDENTLY VERIFIABLE

→ /v/7de85ceaeac42a47

The same logic applies to the Article 50 transparency obligation, which the Omnibus actually accelerates. Generative-AI providers and deployers should treat the operative cut-over as the earlier of 2 August 2026 (the as-enacted date) and 2 December 2026 (the provisional Omnibus date). The earlier date is the binding date until adoption changes that.

08 · FAQ

Questions a compliance officer asks first.

Did the EU AI Act high-risk deadline move from 2 August 2026?

Provisionally, yes. On 2026-05-07 Council and Parliament negotiators reached a provisional political agreement on the Digital Omnibus on AI that defers the Annex III standalone high-risk application date from 2 August 2026 to 2 December 2027, and the Annex I embedded high-risk date from 2 August 2027 to 2 August 2028. The agreement is not yet binding law. Until it is formally endorsed by Council and Parliament, finalised through legal-linguistic revision, and published in the Official Journal of the European Union, the dates in Regulation (EU) 2024/1689 as enacted continue to govern, including 2 August 2026 for Annex III.

Is the 2026-12-02 date legally binding today?

No. The 2 December 2027 date sits inside a provisional agreement reached on 2026-05-07. It becomes legally binding only after Council formal endorsement, Parliament formal endorsement, legal-linguistic revision, and publication in the Official Journal. The co-legislators have signalled intent to complete the process before 2 August 2026, but completion is not guaranteed. Any compliance plan that treats 2026-12-02 as a binding date today is reading the provisional text as enacted text.

What happens if the provisional agreement is not formally adopted before 2 August 2026?

If formal adoption does not happen before 2 August 2026, the application date in the AI Act as enacted (Article 113) governs. Annex III standalone high-risk obligations apply on 2 August 2026 and the penalty regime in Article 99 attaches. The Commission and the co-legislators would then need to consider transitional measures, but the regulation as enacted does not pause itself for ongoing political negotiations. A provider preparing for the originally enacted date is preparing for the legally certain outcome.

Did the GPAI obligations move?

No. The 2 February 2025 prohibitions, the 2 February 2025 AI literacy obligation, the 2 August 2025 general-purpose AI obligations under Articles 53 and 55, and the 2 August 2025 governance and notified-body provisions are already in force. The Digital Omnibus does not move them. Providers placing general-purpose AI models on the Union market remain bound by the Article 53 technical documentation, Article 53(1)(c) copyright policy, Article 53(1)(d) training-data summary, and the Article 55 obligations for systemic-risk models.

Does the deferral change Article 12 / Article 13 / Annex IV substantive requirements?

No. The provisional agreement moves application dates. It does not rewrite the substantive obligations. Article 12 still binds the provider to automatic event recording over the lifetime of the high-risk system. Article 13 still binds the provider to ship instructions for use sufficient for the deployer to interpret outputs. Annex IV still specifies the nine-section technical documentation file under Article 11. A provider ready by 2 August 2026 against the as-enacted timeline is also ready against any deferred date.

What is the new Article 50 transparency deadline?

The provisional agreement reduces the original six-month grace period for Article 50 transparency obligations to three months. Coupled with the revised application architecture, the operative deadline for Article 50 generative-AI labelling is 2 December 2026. The substantive obligation, that providers and deployers of generative AI systems mark synthetic content as artificially generated or manipulated, is unchanged. Only the cut-over date moves. Until the Omnibus is formally adopted, the Article 50 deadline in the AI Act as enacted (2 August 2026) remains binding.

09 · READ THE SOURCE

Read the source directly.

Authored by Warrant Editorial. [email protected]. Velocity reading on a fast-moving regulatory file. Not legal advice. The 2026-05-07 agreement is provisional and subject to Council formal endorsement, Parliament formal endorsement, legal-linguistic revision, and publication in the Official Journal of the European Union. Until those four steps complete, the AI Act as enacted in Regulation (EU) 2024/1689 continues to govern. We will update this entry as the formal-adoption process proceeds.

EU AI Act, Digital Omnibus, 2026-05-07.