EU AI Act Digital Omnibus: high-risk deferred to 2027

01 · THE TRILOGUE

The 2026-05-07 trilogue · what was agreed.

On the evening of 2026-05-07, in Brussels, Council Presidency negotiators and European Parliament rapporteurs reached a provisional political agreement on the Digital Omnibus on AI. The Commission tabled the Omnibus on 19 November 2025 as part of the broader Digital Omnibus package, which sweeps in revisions to the AI Act, the Data Act, the Data Governance Act, and adjacent digital files. The headline outcome on the AI Act file, in the Council's own framing in press release 299/26, is to simplify and streamline the rules, with two operative effects: a deferral of the application calendar, and a tightening of the transparency calendar.

The Council press release dated 2026-05-07 carries the working summary: Annex III standalone high-risk obligations move from 2 August 2026 to 2 December 2027; Annex I high-risk embedded in regulated products moves from 2 August 2027 to 2 August 2028, subject to Article 2(13); AI regulatory sandboxes at national level move to 2 August 2027; and a narrow transitional period is added for the Article 50(2) synthetic-content marking obligation, running to 2 December 2026. A new prohibition is added: AI generation of non-consensual intimate material and child sexual abuse material.

Two things to keep straight about that Article 50 date, because the political summaries blur them. First, the enacted transitional is an addition, not a reduction. Recital 38 of the Omnibus states the purpose in terms: "it is appropriate to introduce a transitional period of four months for providers who have already placed their systems on the market before the 2 August 2026." Four months, introduced — the six-month figure circulated in commentary on the Commission's proposal and never became law. Second, the transitional is narrow, and no operative duty in Article 50 is deferred: paragraphs (1) to (6) stand as enacted, and the Omnibus's only change to the article itself is Article 1(20), which replaced paragraph 7. Article 50 sits in Chapter IV, which appears in none of the Article 113 carve-outs, so it applies from 2 August 2026.

The new Article 5 prohibitions do not bite on 2 August 2026 either. Amended Article 113, third paragraph, point (a) carries Chapters I and II from 2 February 2025 "with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026". Same calendar date as the Article 50(2) transitional, different provision, different addressee — do not merge them.

Provisional agreements in the Union legislative process are political, not legal. They reflect the position of the negotiators in the room. They do not yet reflect the position of the Council as a whole, the Parliament as a whole, or the regulation as enacted. The four downstream steps from provisional agreement to binding law are explicit and sequential. Until those steps completed, the AI Act as published on 12 July 2024 continued to govern; with adoption complete in June 2026, the amended calendar is the operative one.

"The deferral is a window, not a reprieve. The substantive obligations of Articles 11, 12, 13, 14, and Annex IV are unchanged. Only the application calendar moved."Warrant Editorial · 2026-05-08

02 · FIVE OPERATIVE CHANGES

The five operative changes in the agreed text.

The Council press release of 2026-05-07 sets out five operative changes inside the AI Act file. Each is paraphrased verbatim where the text permits. The political character of the document cautions against quoting language that has not yet completed legal-linguistic revision, but the substantive shape is unambiguous.

§ 1

Annex III standalone high-risk · application date moves from 2 August 2026 to 2 December 2027. READING · the amendment is drafted by chapter and section, not by article list. Replaced Article 113, third paragraph, point (c) reads: "Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I". Sections 1 to 3 of Chapter III are Articles 6 to 27 — the classification rules, the Article 8 to 15 requirements, and the Article 16 to 27 obligations on providers and deployers, Article 26 included. Provisions outside those three sections keep their own dates: Article 47 (EU declaration of conformity) is in Chapter III Section 5, and Article 72 (post-market monitoring) is in Chapter IX. Neither is deferred by point (c). The Annex I limb in point (c)(ii) does not stand alone: it is read with the new Article 2(13), inserted by Article 1(3) of the same Regulation, under which Articles 9 to 15 and 17 to 25 may be limited where the Annex I Section A legislation gives equivalent or higher protection. Every compact statement of the 2 August 2028 date on this site carries that qualifier for that reason.

§ 2

Annex I embedded high-risk · application date moves from 2 August 2027 to 2 August 2028, subject to Article 2(13). READING · AI systems that are safety components of products covered by the New Legislative Framework (MDR, Machinery, Toy Safety successor, and the rest of Annex I) get an additional 12 months of grace before the AI Act's high-risk requirements layer onto the existing sectoral file. The date is qualified: under the new Article 2(13), Articles 9 to 15 and 17 to 25 may be limited where the Annex I Section A legislation already gives equivalent or higher protection, so for some products the AI Act layer is narrower than the calendar suggests.

§ 3

National AI regulatory sandboxes · operative date pushed to 2 August 2027. READING · Article 57(1) obliges Member States to ensure their competent authorities establish at least one AI regulatory sandbox at national level. The date sat in Article 57(1) itself, not in Article 113: as enacted it read "operational by 2 August 2026". Article 1(22)(a) of the Omnibus replaces that first subparagraph and moves the date to 2 August 2027, recognising the operational reality that several Member States have not yet stood up the supervisory infrastructure.

§ 4

Article 50(2) marking · a new four-month transitional for systems already on the market, expiring 2 December 2026. Article 50 otherwise applies 2 August 2026. READING · the Omnibus defers no operative duty in Article 50 — paragraphs (1) to (6) stand as enacted and apply from 2 August 2026. Its only change to the article itself is Article 1(20), which replaced paragraph 7. What it adds is a paragraph to the transitional article: new Article 111(4) reads "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026." Three limiters, all on the face of the text — providers only, not deployers; systems generating synthetic content only; Article 50(2) only. A fourth condition gates entry: the system must already have been placed on the market before 2 August 2026.

§ 5

New prohibition · AI generation of non-consensual intimate material, and AI generation of child sexual abuse material (CSAM). Applies from 2 December 2026, not from entry into force. READING · added to the Article 5 list of prohibited practices as points (ba) and (bb) of the first subparagraph of Article 5(1), with new Article 5(1a) and (1b). Amended Article 113, third paragraph, point (a) gives all four of those a start date of 2 December 2026 — the rest of Chapters I and II keep 2 February 2025. The original Article 5 list, in force since 2 February 2025, covers manipulation, exploitation of vulnerabilities, social scoring, predictive policing in narrow circumstances, untargeted facial-image scraping, emotion recognition in workplace and education, biometric categorisation by sensitive attributes, and real-time remote biometric identification in public spaces for law-enforcement purposes. The Omnibus adds a sixth class to that list.

03 · WHAT DID NOT CHANGE

What did not change · the in-force layer.

The Omnibus is a deferral instrument. It moves application dates forward in time and reshapes one transparency clock. It does not unwind the parts of the regulation already in force. Three layers of obligation are unaffected by the 2026-05-07 agreement, and any reading of the Omnibus that suggests a wider reset is misreading the political text.

The first layer in force is the 2 February 2025 perimeter. The Article 5 prohibited-practices list applies. The Article 4 AI literacy obligation applies to providers and deployers. Neither moves. The Omnibus adds to the Article 5 list, it does not subtract.

The second layer in force is the 2 August 2025 perimeter. The Articles 53 and 55 obligations on general-purpose AI model providers apply. Article 53(1)(a) technical documentation, Article 53(1)(b) downstream-provider documentation, Article 53(1)(c) copyright policy, Article 53(1)(d) sufficiently detailed training-data summary, and the Article 55 systemic-risk obligations for the largest models, all of these continue to bind. The governance architecture (Article 64 AI Office, Article 65 European Artificial Intelligence Board, Article 67 Advisory Forum, Article 70 national competent authorities) is operative. The penalty regime in Article 99 is operative for breaches of these provisions.

The third layer is Article 6(1). Article 6(1) treats an AI system as high-risk when it is a safety component of a product covered by Union harmonisation legislation listed in Annex I, or is itself such a product subject to third-party conformity assessment. The original timeline for paragraph 1 application was 2 August 2027. The Omnibus moves it to 2 August 2028, subject to Article 2(13). Article 6(1) itself, the classification rule, is unchanged.

04 · WHY THE DEFERRAL

Why the deferral happened · three operative reasons.

The Commission tabled the Digital Omnibus on AI on 19 November 2025. The political case for a deferral, reading both the Commission's tabling memorandum and the Council and Parliament position papers in the run-up to the 2026-05-07 trilogue, rests on three operative reasons.

First, the guidance on high-risk classification arrived late and arrived in draft. Article 6(5) required the Commission, after consulting the AI Board, to provide guidelines specifying the practical implementation of Article 6 "no later than 2 February 2026", together with a comprehensive list of practical examples of use cases that are and are not high-risk — leaving six months before the original 2 August 2026 Annex III application date. What the Commission published on 19 May 2026 was a draft for stakeholder consultation, which ran to 23 July 2026. Providers preparing for 2 August 2026 were therefore working from draft guidance and aggregator paraphrase, not from a final authoritative reading. (Article 96(1) separately empowers the Commission to develop implementation guidelines across a wider list of topics, but it fixes no deadline.)

Second, the harmonised standards mandated under Article 40 and developed by CEN-CENELEC JTC 21 under standardisation request M/593 are running behind the original publication calendar. As of May 2026, several Type-A and Type-B horizontal deliverables remained in draft. The provider wishing to avail itself of the Article 40(1) presumption of conformity through a harmonised standard could not do so for parts of the Annex IV documentation surface, because the harmonised standards were not in the Official Journal yet.

Third, SME readiness. Article 11(1) explicitly contemplates simplified technical documentation for small and medium-sized enterprises and start-ups, and Article 62 obliges Member States to take SMEs and start-ups into special account. The Council and Parliament received material industry input arguing that the 2 August 2026 date, in the absence of complete Commission guidance and complete harmonised standards, would impose a disproportionate compliance load on smaller providers. The Omnibus's deferral is, in part, a response to that input.

05 · FROM PROVISIONAL TO ADOPTED

From provisional to enacted · four steps to binding law, all four complete.

The provisional agreement reached on 2026-05-07 was a political document. The European Union legislative process turns a political agreement into binding law through four operative steps, in sequence. Three completed in June 2026; the fourth, publication in the Official Journal as Regulation (EU) 2026/1744, landed on 24 July 2026.

step 1

Council formal endorsement — complete, 29 June 2026. READING · the Council, voting under qualified majority on the AI Act file, formally endorsed the text on 29 June 2026, converting the negotiator-level agreement into a Council position.

step 2

Parliament formal endorsement — complete, 16 June 2026. READING · Parliament endorsed the text in plenary on 16 June 2026 by 423 votes to 57 with 174 abstentions, converting the rapporteur-level agreement into a Parliament position.

step 3

Legal-linguistic revision — complete with adoption. READING · the lawyer-linguists at Council and Parliament finalised the text in all 24 official languages ahead of the June votes. The adopted text is the revised text.

step 4

Publication in the Official Journal — complete, 24 July 2026. READING · the amending act was signed at Strasbourg on 8 July 2026 and published in the Official Journal, L series, on 24 July 2026 as Regulation (EU) 2026/1744. Its Article 4 sets entry into force on the third day following publication: 27 July 2026. From that date the status is "in force", not merely "adopted".

The co-legislators completed the endorsement steps well before 2 August 2026, the original Annex III application date. The Digital Omnibus moves the Annex III standalone high-risk application date to 2 December 2027, by replacing point (c) of the third paragraph of Article 113 with a two-limb provision keyed to Article 6(2) and Annex III on the one hand and Article 6(1) and Annex I on the other. The Annex III high-risk application date is 2 December 2027, deferred from 2 August 2026 by the Digital Omnibus; Regulation (EU) 2026/1744, OJ 24 July 2026.

06 · THE ASYMMETRY

The asymmetry · timing moved, content did not.

The single sharpest reading of the Omnibus is the asymmetry between what moved and what did not. What moved is the application calendar. What did not move is the substantive content of the obligations. Article 12 still binds the provider to technically allow for the automatic recording of events over the lifetime of the high-risk AI system. Article 13 still binds the same provider to ship instructions for use sufficient to enable the deployer to interpret outputs. Article 11 still binds the provider to draw up the Annex IV technical documentation file before placing the system on the market. Annex IV still specifies, in nine sections, what that file must contain.

The asymmetry has a practical implication for any provider that has been preparing for the 2 August 2026 date. The deferral pushes when the obligations bite, not what the obligations require. A provider whose Annex IV file is complete, whose Article 12 logging path records automatically rather than on a developer's call and whose retention meets the Article 19(1) floor, whose Article 13(3) instructions for use cover all six mandatory items in points (a) to (f), including the seven sub-points of point (b), and whose Article 14 human-oversight measures are documented and operative, is ready under any deferred date. The work done against 2026-08-02 is not wasted work. It is work-in-place against 2027-12-02.

The reverse implication is also true. A provider that reads the deferral as a reprieve is misreading it. The Annex III standalone high-risk application date is 2 December 2027 (deferred from 2 August 2026 by the adopted Digital Omnibus), the substantive work is the same either way, and the firm that designs its records early meets the date with evidence that has already run in production.

07 · FOR WARRANT CUSTOMERS

What this means for Warrant customers · the evidence pattern is unchanged.

Warrant produces evidence packages from AI agent execution traces, each one a record mapped to a specific EU AI Act obligation and independently verifiable without contacting Warrant. The package emits structured fields mapped to specific articles of the AI Act, including Article 12 logging fields, Article 13 instruction-for-use fields, and Annex IV section-by-section field mapping. None of those mappings change as a function of the Omnibus. It does not amend Article 11, Article 12, Article 13, Article 14, Article 15, Article 47, or Annex IV. It moves the date on which they begin to apply to Annex III standalone systems.

For a customer running an Annex III high-risk AI system in production today, the substantive obligations are unchanged from the pre-Omnibus position; only the application date moves. The Annex III standalone high-risk application date is now 2 December 2027 (deferred from 2 August 2026 by the Digital Omnibus; Regulation (EU) 2026/1744, OJ 24 July 2026). Build to the substantive obligations regardless: the customer that has an evidence package already produced arrives at 2 December 2027 ready, and is also covered should publication framing shift before then.

Sample EU evidence package · Warrant registerA RECORD MAPPED TO A SPECIFIC EU AI ACT OBLIGATION · INDEPENDENTLY VERIFIABLE

→ /v/7de85ceaeac42a47

Article 50 is the near-term one, and it is the one the political summaries get wrong. The Omnibus defers nothing in Article 50: the operative duties in paragraphs (1) to (6) apply from 2 August 2026, and the only change to the article itself is Article 1(20), which replaced paragraph 7. This entry was last checked against the Official Journal text on 28 July 2026. The only relief is new Article 111(4), and it is narrow — a provider, of a system that generates synthetic content, that was already on the market before 2 August 2026, gets until 2 December 2026 to comply with Article 50(2) marking. Nothing else moves. If you are a deployer, your Article 50(4) duty to disclose a deepfake is live on 2 August 2026 and Article 111(4) does not touch it. If your system interacts with people, Article 50(1) is live on 2 August 2026 too. Read the three limiters before you plan around the December date.

08 · FAQ

Questions a compliance officer asks first.

Did the EU AI Act high-risk deadline move from 2 August 2026?

Yes. The Digital Omnibus on AI defers the Annex III standalone high-risk application date from 2 August 2026 to 2 December 2027, and the Annex I embedded high-risk date from 2 August 2027 to 2 August 2028, subject to Article 2(13), by replacing point (c) of the third paragraph of Article 113 with a two-limb provision keyed to Article 6(2) and Annex III on the one hand and Article 6(1) and Annex I on the other. The Omnibus is adopted: the European Parliament endorsed it in plenary on 16 June 2026 (423 to 57, 174 abstentions) and the Council on 29 June 2026. The Annex III standalone high-risk application date is 2 December 2027.

Is the 2026-12-02 date legally binding today?

The deferral now sits in the Official Journal rather than in a political agreement. Regulation (EU) 2026/1744 was signed on 8 July 2026 and published on 24 July 2026. Article 4 of the Omnibus, headed Entry into force and application, provides that "This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union" — 27 July 2026. (Article 114 TFEU is the legal basis recited in the Omnibus preamble, not an article of the instrument.) From 27 July 2026 the 2 December 2027 calendar is the enacted one, and a compliance plan built to it is building to law.

What happens if the provisional agreement is not formally adopted before 2 August 2026?

That question is closed. The Omnibus was adopted before the date arrived — European Parliament 16 June 2026, Council 29 June 2026 — and published as Regulation (EU) 2026/1744 in the Official Journal on 24 July 2026. The deferral to 2 December 2027 holds. A provider that built the substantive obligations early is ready for 2 December 2027 regardless.

Did the GPAI obligations move?

No. The 2 February 2025 prohibitions, the 2 February 2025 AI literacy obligation, the 2 August 2025 general-purpose AI obligations under Articles 53 and 55, and the 2 August 2025 governance and notified-body provisions are already in force. The Digital Omnibus does not move them. Providers placing general-purpose AI models on the Union market remain bound by the Article 53 technical documentation, Article 53(1)(c) copyright policy, Article 53(1)(d) training-data summary, and the Article 55 obligations for systemic-risk models.

Does the deferral change Article 12 / Article 13 / Annex IV substantive requirements?

No. The Digital Omnibus moves application dates. It does not rewrite the substantive obligations. Article 12 still binds the provider to technically allow for the automatic recording of events over the lifetime of the high-risk system, and still fixes no retention period of its own. Article 13 still binds the provider to ship instructions for use sufficient for the deployer to interpret outputs. Annex IV still specifies the nine-section technical documentation file under Article 11. The Annex III application date moves to 2 December 2027 (deferred from 2 August 2026; Regulation (EU) 2026/1744, OJ 24 July 2026), but a provider that builds to the substantive obligations early is ready against the deferred date.

What is the Article 50 transparency deadline?

The operative transparency duties in Article 50(1) to (6) apply from 2 August 2026. Article 50 sits in Chapter IV of Regulation (EU) 2024/1689, and Chapter IV appears in none of the carve-outs in the third paragraph of Article 113, so it takes the general application date.

The Digital Omnibus defers none of those paragraphs. Its only change to the article itself is Article 1(20) of Regulation (EU) 2026/1744, which replaced Article 50(7). What it adds is one narrow transitional, new Article 111(4): "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026." That transitional reaches providers only, systems generating synthetic content only, and Article 50(2) only. It does not defer Article 50(1), informing a person they are interacting with an AI system, and it does not defer the Article 50(4) deepfake disclosure duty on deployers. Both apply from 2 August 2026.

Recital 38 describes the transitional as four months. The six-month figure appeared in commentary on the Commission's proposal and was never enacted.

09 · READ THE SOURCE

Read the source directly.

Authored by Warrant Editorial. [email protected]. Velocity reading on a fast-moving regulatory file. Not legal advice. The 2026-05-07 agreement was adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026, and published as Regulation (EU) 2026/1744 in the Official Journal of the European Union on 24 July 2026. Its Article 4 sets entry into force on the third day following publication: 27 July 2026.

EU AI Act, Digital Omnibus, 2026-05-07.