The AI Omnibus deal: what survived the trilogue?

In the early hours of 7 May 2026, after months of negotiation and a first trilogue that collapsed on 28 April, the European Parliament and the Council reached a provisional agreement on the Digital Omnibus on AI. The deal was announced jointly by the co-legislators and confirmed in press releases of the European Parliament and the Council. The deal still needs formal adoption, but both institutions have indicated they intended to do so before 2 August 2026, the date on which the bulk of the AI Act's high-risk obligations would otherwise become applicable. 

New deadlines for high-risk AI systems 

The most consequential change is the shift in the application date of the obligations applicable to high-risk AI systems. Under the AI Act as currently adopted, those obligations would have started to apply on 2 August 2026 already. The political reality is that the supporting framework (harmonised standards, designated notified bodies, guidance documents, conformity assessment procedures) will not be ready by then. 

Rather than relying on a vague "to-be-determined" extension, the co-legislators have agreed on fixed dates: 

• 2 December 2027 for stand-alone high-risk AI systems listed in Annex III (covering biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border management, and the administration of justice). 
• 2 August 2028 for AI systems used as safety components in products or AI systems that are products themselves covered by the Union's sectoral safety and market surveillance legislation (Annex I). 

The fixed-date approach should provide welcome predictability. The Commission's original proposal (see our previous blogpost) had been less reassuring on this point: it would have allowed the Commission to bring the application date forward by way of a decision confirming that sufficient compliance tools were available. 

Organisations that had been preparing for an August 2026 deadline now have a longer runway, but the direction of travel has not changed. The risk-based architecture of the AI Act remains intact, and the underlying obligations on high-risk systems are not being softened. The clock has been moved back. It has not been switched off. Worth noting is that the application of the marking obligations under Article 50(2) of the AI Act has been postponed to 2 December 2026, which is shorter than the timeline originally proposed by the Commission (2 February 2027). For providers of generative AI systems, this is the most immediate operational deadline coming out of the deal: production-ready marking capabilities are needed within roughly seven months. 

A new prohibited practice: nudifiers and AI-generated CSAM 

Article 5 of the AI Act, which lists prohibited AI practices, is being expanded to include a new prohibition targeting AI systems that generate AI systems that create child sexual abuse material (CSAM), or that depict the intimate parts of an identifiable person or such a person engaged in sexually explicit activities, without that person's consent. 

The prohibition is broadly framed in the press releases and applies to: 

• placing such AI systems on the EU market with the purpose of generating that content; 
• placing such systems on the EU market without reasonable safety measures to prevent their use for that purpose; 
• deployers using such systems to generate that content. 

The prohibition covers images, video and audio. Companies will have until 2 December 2026 to bring their systems into line. 

This is more than a symbolic gesture. The prohibition targets not only intentional deployment ("nudifier" apps as such), but also the failure of providers of more general-purpose generative AI tools to put in place reasonable safeguards against this type of misuse. In practical terms, providers of generative image, video and audio models will need to revisit their safety measures, including training data filtering, prompt and output classifiers, and content moderation at the output stage. 

No more double regime for AI in machinery products 

Removal of overlapping requirements for AI machinery products: these will only need to comply with sectoral safety rules rather than both the AI Act and sectoral rules, subject to safeguards ensuring an equivalent level of health and safety. This was the single most contested point in the negotiations and the reason the first trilogue collapsed on 28 April. Under the AI Act as currently adopted, AI systems used as safety components in products covered by Annex I, Section A faced a combined regime: the sectoral conformity assessment under the relevant product legislation, with the AI Act's high-risk requirements layered on top. Based on the Parliament's press release, the carve-out agreed in the AI Omnibus is specific to machinery products. Other Section A products, including medical devices, in vitro diagnostic medical devices, lifts and radio equipment, remain subject to the combined regime. For manufacturers of AI-enabled machinery, this is a meaningful simplification and removes the most cumbersome aspect of the dual regime. Manufacturers in the other Section A sectors do not benefit from this change.

 A narrower notion of "safety component" 

Based on the Parliament's press release, the concept of "safety component" has been narrowed, so that AI features that merely assist users or optimise performance will no longer automatically trigger high-risk obligations where their failure or malfunction does not create health or safety risks. 

This is a welcome clarification. In practice, we have encountered cases where the question whether AI functionality qualified as a safety component triggering the high-risk regime under Article 6(1) gave rise to genuine doubt. The narrowing of the concept introduces a clearer health and safety filter: where the failure of an AI feature does not give rise to health or safety risks for persons, it falls outside the high-risk regime via Article 6(1), regardless of how it might be classified under the sectoral product safety legislation. 

The carve-out appears to be narrower than it may seem at first reading: AI features whose failure could plausibly cause harm remain within scope. For products with non-critical AI functionality, however, the risk of being pulled into the high-risk regime is reduced. As with the machinery carve-out, the precise scope of the narrowed concept will only become clear once the consolidated text is published. 

Additional changes 

A number of further amendments were also agreed: 

• The deal also opens the possibility to process personal data where strictly necessary to detect and correct biases, with proper safeguards, in both high-risk and non-high-risk AI systems. 
• The simplifications and proportionality measures originally designed for SMEs are extended to small mid-cap enterprises (SMCs) to support their growth. 
• And finally, the enforcement of certain general-purpose AI systems is streamlined within the EU's AI Office. 

Taken together, these changes do not amount to a structural overhaul of the AI Act, but they do reduce some of its rougher edges, particularly for manufacturers of regulated products and for smaller players scaling up. 

The Commission had originally proposed to remove the registration obligation in the EU database for AI systems self-assessed by their providers as non-high-risk. Both co-legislators rejected this in their negotiating positions, following the EDPB/EDPS joint opinion. It is plausible that this convergence has been preserved in the final compromise, although this will need to be confirmed in the consolidated text. 

What now? 

The deal still needs formal adoption by both institutions, who have indicated they intend to do so before 2 August 2026, the date on which the bulk of the AI Act's high-risk obligations would otherwise become applicable. Until the agreed Regulation is formally adopted and published in the Official Journal, the original deadlines remain legally in force. In practice, however, enforcement action against organisations preparing for the new deadlines seems unlikely if the formal adoption process slips beyond 2 August 2026.

 Timelex advises on AI Act compliance, including the interaction with the GDPR and relevant sectoral frameworks. Get in touch to discuss what the AI Omnibus deal means for your organisation.