The political agreement is done. The law is not.
EU legislators have agreed on the Digital Omnibus package amending the EU AI Act, according to legal analysis from Wilson Sonsini Goodrich & Rosati and DLA Piper. The deal restructures compliance timelines for two categories of high-risk AI systems and confirms explicit prohibitions on AI nudification applications and tools that generate child sexual abuse material. But the agreement is a political one. The binding legal trigger is publication in the EU Official Journal, and that publication has not been confirmed as of this reporting date.
That distinction matters. Compliance teams who treat the political agreement as enacted law may mistime their programs. Those who ignore it entirely face the same risk from the opposite direction.
What the agreement reportedly changes:
Stand-alone high-risk AI systems, Annex III systems covering recruitment tools, biometric identification, access to essential services, critical infrastructure, and law enforcement applications – reportedly move to a compliance deadline of December 2, 2027, according to analysis from Wilson Sonsini and isms.online’s compliance guidance. The prior operative deadline was August 2, 2026. If confirmed, that’s roughly 16 additional months for organizations deploying standalone high-risk systems.
Who This Affects
AI systems embedded in regulated products, Annex I systems covering medical devices, machinery, civil aviation equipment, and similar hardware-integrated applications, reportedly move to August 2, 2028, per DLA Piper’s analysis. Embedded systems have always had the longest runway given their hardware certification dependencies. This deadline reflects that complexity.
The nudification prohibition and the CSAM generation ban were previously covered here on May 7. The Omnibus agreement confirms those prohibitions. They are not new introductions in this cycle.
The transparency deadline question:
Some analyses suggest the transparency and watermarking deadline, governing AI-generated content labeling, may have been shortened to December 2, 2026. This could not be independently confirmed against primary EU text. The claim derives from secondary analysis that could not be verified for this report. Compliance teams should treat the previously published August 2026 watermarking provisions as operative until Official Journal publication is confirmed. If the December 2026 date proves accurate, GenAI providers in EU scope will have less runway than previously assumed, not more.
The compute pressure context:
Epoch AI’s compute tracking as of May 8 shows more than 30 models now exceed the 10^25 FLOP threshold the EU AI Act uses to define systemic risk for general-purpose AI. That count was approximately 12 as recently as late April. The extended Annex III deadline gives compliance teams more time on high-risk system certification. It gives the EU AI Office less time to administer a GPAI registry that is growing faster than the original timeline anticipated.
What to watch:
Official Journal publication is the event that matters. That’s when these deadlines become law. Watch for the EU Commission’s press release confirming OJ publication and the accompanying entry into force date. Compliance teams should not restructure programs around reported deadline dates until that confirmation arrives. The second thing to watch: the transparency deadline direction. If primary EU text confirms a shortened watermarking window, GenAI providers face a tighter near-term obligation than the Annex III extension suggests.
TJS synthesis:
The Omnibus deal gives most compliance teams the runway extension they needed for high-risk certification, but it does so in a political-agreement form that creates its own compliance risk. Acting too early on unconfirmed deadlines is almost as costly as acting too late. The useful question isn’t “what are the new deadlines?” It’s “what can we complete before OJ publication that holds value regardless of which deadline proves accurate?” Risk assessments, technical documentation drafts, and vendor questionnaires all qualify. Conformity assessment scheduling does not.