EU AI Act Omnibus: Two Compliance Deadlines, Two Different Programs, Here's the Planning Split

Two deadlines. One agreement. Different responses required.

When EU legislative bodies reached the Omnibus political agreement on May 7, 2026, the dominant headline was delay: the Annex III high-risk system compliance deadline moved from August 2, 2026, to December 2, 2027, under the political agreement text. Compliance teams exhaled. Some paused their programs.

That pause may be a mistake, depending on which obligations their systems actually carry.

The Omnibus creates two structurally distinct compliance tracks. They share a political agreement and a legislative package. They share almost nothing else: not the deadline, not the affected population, not the required deliverables, and not the urgency. Treating them as one unified delay is a planning error with a seven-month consequence.

Track One: December 2, 2026

GenAI providers face the earlier deadline. The Omnibus places two obligations in this track: synthetic content watermarking and the new Article 5 prohibition on AI-generated intimate imagery.

The watermarking obligation requires GenAI systems to label AI-generated audio, image, video, and text content in a machine-readable format. The Omnibus compressed the implementation grace period from six months to three, according to Latham & Watkins’ Omnibus analysis. That compression matters because no harmonized technical standard for watermarking currently exists at the EU level. GenAI providers are being asked to build toward a specification that hasn’t been finalized.

The Article 5 prohibition is different in character. It doesn’t require building anything. It requires stopping something — specifically, the generation of non-consensual intimate imagery, a category the Omnibus now explicitly names in the prohibited practices list. Per Baker Botts’ reading of the Omnibus provisions, this prohibition takes effect on the December 2, 2026 track, not the 2027 HRAIS deadline. For any GenAI provider whose model can produce such content, removal or capability restriction is the required response, and three months isn’t much runway to audit, modify, and document a model’s generative boundaries.

One operational note on fines: the Omnibus package stipulates penalties for prohibited practice violations that may reach up to €35 million or 7% of global annual turnover, according to the agreement’s terms, though these figures haven’t been verified against the official text.

Track Two: December 2, 2027

Annex III teams have eighteen months from today. That’s the good news. The catch is that eighteen months from a standing start is different from eighteen months with a running program.

The Omnibus defers the full Annex III high-risk system compliance requirements — covering biometrics, employment screening, critical infrastructure, education, and law enforcement applications — to December 2, 2027. For organizations that had been building toward the August 2026 deadline, this extension raises an immediate question: what do you keep, what do you cut, and what do you reschedule?

The answer isn’t “pause everything.” Risk assessments completed for August 2026 don’t expire, they form the documentation foundation that the December 2027 submission will require. Technical documentation in progress should continue, because the underlying conformity assessment requirements haven’t changed; only the deadline has. Compliance programs that disband their working groups now will spend Q3 2027 rebuilding institutional knowledge under time pressure.

What legitimately shifts is implementation sequencing. Organizations that had been racing to complete third-party conformity assessments before August 2026 now have room to prioritize internal capability building first — establishing the risk management, transparency, and human oversight frameworks that auditors will examine — before engaging external assessment bodies. That’s a meaningful sequencing change. It’s not a reason to stop.

The Authorization Question

Both tracks carry the same underlying uncertainty: the Omnibus is a political agreement, not enacted law. Formal Council adoption and publication in the EU Official Journal are required before any of these deadlines become legally binding. That process typically takes several months after a political agreement. Until the Official Journal publication date is confirmed, compliance teams are building toward a deadline that is structurally secure but not yet formally in force.

This doesn’t mean waiting. It means documenting that your program is designed against the political agreement terms, and building in a review checkpoint for the date of Official Journal publication. The Article 5 prohibition and the watermarking obligation are well-enough defined in the agreement text that responsible GenAI providers should build toward them now.

The Sandbox Obligation

A third track sits in the background. Member States would be required to establish regulatory sandboxes by August 2027, according to the political agreement terms — an obligation on governments, not companies. For organizations developing novel AI applications that might benefit from sandbox engagement before full market deployment, the August 2027 date is a planning horizon.

What Prior Programs Keep

Compliance teams that had been preparing for August 2026 have built assets that carry forward. High-risk system inventories and Annex III classification analyses remain valid — the classification criteria haven’t changed. Risk assessments completed or in progress retain their evidentiary value. Technical documentation in progress can continue on its current cadence. Human oversight and logging infrastructure being built now will be required in 2027.

What changes: the urgency calculation for external conformity assessment body engagement. Organizations that had been seeking scarce slots with notified bodies under time pressure now have room to be more deliberate about which body they select and how they sequence the assessment.

What to Watch

Three milestones matter in sequence. First, Official Journal publication, which converts the political agreement into binding law and confirms the specific dates. Second, the EU AI Office’s technical specifications for watermarking, expected before December 2026 — the three-month window becomes real only when providers know what format they’re building toward. Third, Member State transposition of sandbox obligations by August 2027.

The real question is whether EU AI Office guidance on watermarking arrives with enough lead time for providers to build compliant systems before December 2. Three months is tight for any organization without a head start. Organizations that haven’t begun watermarking architecture work are already behind the reasonable schedule.

TJS Synthesis

The Omnibus doesn’t simplify compliance planning, it bifurcates it. GenAI providers now carry a shorter, operationally harder deadline than Annex III deployers. The Article 5 prohibition requires model changes, not documentation. The watermarking standard requires technical delivery against a specification that doesn’t fully exist yet. Organizations that read “delay” into the Omnibus headlines and stood down their GenAI compliance work will discover in Q4 2026 that the delay applied to a different track entirely. The compliance teams that come out of the Omnibus period ahead are the ones that mapped their obligations to the specific track before making a single resource decision.