On May 7, 2026, the European Parliament and Council reached a political agreement on a package of amendments to the EU AI Act, formally part of the EU’s broader Omnibus simplification initiative. The headline change: compliance deadlines for high-risk AI systems have been pushed back significantly — more than a year for standalone systems, and nearly two years for AI embedded in regulated products.

For compliance teams that have been racing toward the original August 2026 application date, this is material relief. But the Omnibus deal does not pause all AI Act obligations, and it introduces new requirements that companies need to absorb. Getting the timeline right — which deadlines moved, which did not, and by how much — is the immediate priority.

The Original AI Act Timeline

The EU AI Act entered into force on August 1, 2024. It set a phased application schedule:

  • February 2, 2025 — Prohibited AI practices prohibited
  • August 2, 2025 — GPAI model rules and governance obligations applicable
  • August 2, 2026 — High-risk AI systems under Annex III applicable
  • August 2, 2027 — High-risk AI in regulated products under Annex I applicable

The August 2, 2026 deadline for Annex III high-risk systems was the pressure point for most enterprises. That deadline has now moved.

What the Omnibus Deal Changes

High-Risk AI Under Annex III — New Deadline: December 2, 2027

Annex III covers standalone AI systems classified as high-risk because of their use case, including:

  • Biometric identification and categorization systems
  • AI used in critical infrastructure management
  • Educational or vocational training systems that determine access or evaluate outcomes
  • Employment-related AI (recruiting, promotion, task allocation, monitoring)
  • AI for essential services access (credit scoring, insurance, benefits)
  • Law enforcement applications
  • Migration and border management systems
  • Administration of justice and democratic processes

These systems had an August 2, 2026 compliance deadline under the original Act. Under the Omnibus deal, that deadline shifts to December 2, 2027 — an extension of 16 months.

High-Risk AI in Regulated Products Under Annex I — New Deadline: August 2, 2028

Annex I covers AI systems embedded in regulated products subject to existing EU product safety law — medical devices, machinery, toys, automotive systems, aviation equipment, and others. These already face compliance obligations under their sector-specific frameworks.

The original AI Act deadline for these systems was August 2, 2027. The Omnibus deal extends this to August 2, 2028 — an additional 12 months.

Watermarking and AI-Generated Content Transparency — Deadline Shortened

Counterintuitively, the Omnibus deal tightened one deadline. The requirement to mark AI-generated content with machine-readable watermarks or metadata — the transparency obligation targeting synthetic text, images, audio, and video — has its grace period cut from six months to three months, placing the compliance deadline at December 2, 2026.

This affects any provider or deployer of AI systems that generate or manipulate content at scale, including image generation tools, text generators, video synthesis systems, and AI-powered marketing platforms.

What the Deal Does Not Change

The political agreement is targeted. Several AI Act obligations remain on their original timeline:

Prohibited practices (February 2025) — Already in force. No change. AI systems that deploy subliminal manipulation, exploit vulnerabilities, engage in social scoring, or conduct real-time biometric surveillance in public spaces for purposes not explicitly permitted remain prohibited.

GPAI model rules (August 2025) — Already in force. No change. General-purpose AI model providers must maintain technical documentation, comply with copyright transparency requirements, and — for systemic risk models above 10^25 FLOPs — conduct adversarial testing and report serious incidents to the AI Office.

AI literacy obligations — The requirement that deployers ensure their staff have sufficient AI literacy to understand and oversee AI systems is in effect. No extension has been granted.

Conformity assessment infrastructure — Notified body designations, standard-setting timelines, and the supervisory framework are proceeding. The deadline extensions do not pause the standards development process.

Why the Extensions Were Granted

The stated rationale from the Council and Parliament is that organizations need more time to implement the technical standards that underpin AI Act compliance. The harmonized standards — developed by CEN and CENELEC under AI Act mandate M/570 — are not yet finalized. Requiring conformity assessments against standards that do not yet exist is not operationally workable.

The broader Omnibus simplification initiative also reflects a political judgment that the cumulative compliance burden on businesses — AI Act, DORA, NIS2, GDPR, product liability updates — risks deterring investment in EU AI development. The deadline extensions are partly a relief measure for that concern.

What the extensions do not reflect is any softening of the underlying substantive requirements. The high-risk AI obligations — conformity assessment, technical documentation, risk management system, data governance, transparency, human oversight, accuracy and robustness — remain as written. Only the application dates have moved.

New Provisions on AI-Generated Intimate Content

The Omnibus deal adds new specific requirements for AI systems that generate synthetic intimate imagery, timed to interact with the broader NCII regulatory landscape emerging in member states and at the federal level in the US. These provisions require:

  • Systems capable of generating realistic intimate imagery to implement safeguards against non-consensual use
  • Providers of such systems to disclose the capability in technical documentation
  • Deployers in consumer-facing contexts to implement access controls appropriate to the sensitivity of the output

The precise technical standards for these requirements are to be developed, but the political agreement establishes the obligation clearly. Organizations developing or deploying AI image generation, video synthesis, or avatar creation tools should treat this as a near-term compliance planning item regardless of the Annex III deadline extension.

What Compliance Teams Should Do Now

Revise Your Timeline, Not Your Scope

The extensions change when you must comply, not what you must comply with. Organizations that have already completed risk classification, technical documentation gap analyses, or data governance audits for their high-risk systems should not shelve that work. The same requirements apply; the schedule has more room.

Use the extended runway to do the work properly rather than rushing to a deadline compliance posture that will need to be rebuilt later.

Audit Your Classification

The Annex III extension applies to systems classified as high-risk. If you have not completed a systematic classification of your AI systems, the 16-month extension is the opportunity to do so carefully.

Common misclassification errors:

  • Treating AI systems that support high-risk decisions as not themselves high-risk
  • Failing to classify AI used in HR processes (hiring, performance evaluation, termination support) as Annex III high-risk
  • Assuming that light-touch AI assistance in regulated products falls outside Annex I

The AI Office and national competent authorities have signaled that classification audits will be a focus of initial enforcement attention.

Build Toward the GPAI Standards Now

GPAI model obligations are already in force. If your organization develops or provides general-purpose AI models — including fine-tuned versions of foundation models for specific applications — the documentation, copyright transparency, and incident reporting requirements apply today. Organizations that have not yet assessed GPAI applicability to their models should do so immediately.

Plan for December 2026 Watermarking

The shortened watermarking deadline — December 2, 2026 — is now six months away. This obligation applies broadly to AI content generation. It is technically non-trivial and will require coordination between AI providers, deployers, and platform operators about which layer of the stack is responsible for embedding and reading watermarks. Start that conversation now.

Monitor Formal Adoption

The May 7 political agreement is provisional. Formal adoption requires a European Parliament plenary vote and a Council decision. This typically follows within months of a political agreement, but until formal adoption, the original deadlines technically remain in place. Most practitioners are treating the extended deadlines as operative for planning purposes, given the political weight of the agreement — but watch for the official publication in the EU Official Journal.

Practical Implications for Common Use Cases

HR and Talent Platforms — Recruiting AI, performance assessment tools, and workforce monitoring systems fall squarely in Annex III. The December 2027 deadline gives these platforms more time, but the employment sector has been a named priority for AI Act enforcement. Expect close scrutiny of HR AI once enforcement begins.

Financial Services — Credit scoring, insurance underwriting, and lending decision support AI are Annex III high-risk. Banks and insurers operating under DORA already have overlapping technical documentation and testing obligations — align AI Act compliance work with DORA deliverables to reduce duplication.

Medical Device Manufacturers — Annex I systems embedded in medical devices now have until August 2028. This aligns more closely with the typical medical device regulatory cycle. MDR and AI Act compliance documentation should be built as an integrated program, not in parallel silos.

Content Generation Platforms — The watermarking deadline (December 2026) is the most urgent AI Act obligation for this sector. Assess now whether your platform is the provider, the deployer, or both under the Act’s framework, since responsibility for watermarking implementation varies by role.

Conclusion

The EU AI Act Omnibus deal is a significant development for organizations operating AI systems in or targeting the EU market. The extensions for high-risk AI — 16 months for standalone systems, 12 months for product-embedded systems — provide meaningful additional runway for compliance programs that were under pressure. The tightened watermarking deadline and the new synthetic intimate imagery provisions confirm that the deal is not a rollback of the Act’s substance.

Compliance teams should revise their project timelines, maintain the scope of their compliance programs, and use the extended runway to complete risk classification, technical documentation, and conformity assessment preparation in a way that will hold up under enforcement scrutiny beginning in late 2027.

This article is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel regarding their obligations under the EU AI Act and the Omnibus amendments.