Published May 8, 2026. The EU Digital Omnibus provisional political agreement was reached May 7, 2026. This article covers what changed, what did not change, and what compliance teams should do now.
The EU AI Act Annex III (high-risk AI) deadline is extended to December 2, 2027. Here is the confirmed timeline:
| Item | Old deadline | New deadline | Status |
|---|---|---|---|
| Annex III — high-risk AI (hiring, credit, healthcare, education) | August 2, 2026 | December 2, 2027 | Agreed May 7 — pending OJ publication |
| Annex I — regulated products (medical devices, vehicles, machinery) | August 2026 | August 2, 2028 | Agreed May 7 — pending OJ publication |
| GPAI enforcement (Commission enforcement powers over AI providers) | August 2, 2026 | August 2, 2026 | UNCHANGED — not affected by Omnibus |
| GPAI obligations (rules on frontier model providers) | August 2, 2025 | August 2, 2025 | Already in force — unchanged |
| Prohibited AI (social scoring, subliminal manipulation) | February 2025 | February 2025 | Already in force — unchanged |
| Formal adoption (Parliament + Council) | — | June 2026 | Expected |
| Official Journal publication | — | July 2026 | Targeted |
What this means for your compliance timeline: August 2026 compliance sprints can be deprioritized. December 2, 2027 is your new Annex III target. GPAI enforcement (August 2, 2026) is unchanged — if you use frontier AI models in your product, your vendors face active Commission enforcement from August.
What the Digital Omnibus Changes
1. Annex III deadline: August 2026 → December 2027
The Omnibus extends the compliance deadline for high-risk AI systems by 16 months. High-risk AI includes:
- AI used in hiring and HR decisions (CV screening, scoring, interview tools)
- AI used in credit scoring and lending
- AI in healthcare (clinical decision support, diagnostic tools)
- AI in education (student assessment, admissions screening)
- AI in critical infrastructure (energy, water, transport)
- AI used by law enforcement and border management
- Biometric identification systems
If your team uses or deploys AI in any of these categories, December 2, 2027 is your new compliance deadline for conformity assessment, human oversight, and database registration.
2. Annex I deadline: August 2026 → August 2028
AI embedded in regulated products (CE-marked medical devices, automotive components, industrial machinery) moves to August 2028. This primarily affects product manufacturers, not deployers.
3. SME documentation simplified
The Omnibus reduces conformity assessment documentation requirements for small and medium-sized enterprises and small mid-caps. The specific simplifications are in the legal text pending Official Journal publication, but the direction is less paperwork, not fewer obligations.
What the Digital Omnibus Does NOT Change
- GPAI enforcement August 2, 2026 — unchanged. The Commission's enforcement powers over providers of general-purpose AI models (GPT-4, Claude, Gemini) activate August 2 as planned. Your AI vendors are affected.
- Prohibited AI (February 2025) — social scoring, subliminal manipulation, real-time biometric surveillance in public spaces. These have been in force since February 2025 and are not affected.
- GPAI obligations (August 2, 2025) — already in force. GPAI providers have been subject to transparency, copyright, and documentation obligations since August 2025.
- Transparency requirements for limited-risk AI — chatbot disclosure obligations and AI-generated content labeling are in force and unchanged.
6-Point Action Checklist for Compliance Teams
- 1. Update your compliance roadmap. Replace August 2, 2026 Annex III milestones with December 2, 2027. Do not delete them — extend them.
- 2. Communicate to leadership. Confirm that the August compliance sprint can be deprioritized. Attach the source (EU AI Office statement or Official Journal once published) — do not act on this until OJ publication if your legal team requires formal law.
- 3. Keep GPAI work on schedule. If you integrated frontier AI models into your product, your vendors face active enforcement from August 2, 2026. Verify your vendor agreements are compliant by August.
- 4. Re-engage vendors on documentation. With the December 2027 deadline, vendors who were slow to respond to conformity documentation requests may be more responsive — you have time to do it properly.
- 5. Update your risk register timeline. If you have an existing EU AI Act risk register or compliance project tracker, update deadline fields now.
- 6. Monitor for Official Journal publication. Set a calendar reminder for July 2026 to confirm the Omnibus has been published. Until then, August 2, 2026 remains technically in force.
Timeline for Official Enactment
The agreement is provisional — it requires formal steps before becoming law:
- Legal-linguistic review — approximately 4-6 weeks after provisional agreement (completed by mid-June)
- European Parliament vote — formal vote adopting the agreed text
- Council of the EU adoption — formal ministerial approval
- EU Official Journal publication — the date the new deadlines take legal effect
Based on this process, Official Journal publication in July 2026 is the realistic target. If the process slips, August 2, 2026 could be in force briefly — but the political will to complete the process before August 2 is strong given the agreement has been reached.
Sources: EU AI Office, European Parliament legislative tracker, Digital Omnibus trilogue outcome (May 7, 2026). This article will be updated when the Omnibus is published in the Official Journal.
