EU AI Act Omnibus: What Compliance Teams Can Plan Now vs. What Must Wait for Final Text

Three deadlines. Two of them new. None of them backed by final published text yet.

That’s the compliance reality following the EU AI Act Digital Omnibus provisional agreement of May 7, 2026. The deal restructures when different categories of AI systems must meet full compliance requirements, and for many organizations, it looks like welcome breathing room. It isn’t that simple.

What the Omnibus Confirms

Per the European Commission’s press release, the Omnibus agreement establishes three distinct compliance tracks, each tied to a different category of AI system and a different deadline.

Annex III systems, high-risk AI deployed in biometrics, employment screening, education, and critical infrastructure, must reach full compliance by December 2, 2027. The 16-month extension from the original August 2026 deadline reflects negotiators’ acknowledgment that harmonized technical standards aren’t ready. They still aren’t.

Annex I systems, AI embedded in regulated products already subject to EU conformity assessment regimes, including medical devices, toys, and machinery, carry a deadline of August 2, 2028, per the provisional agreement. This category has been contested. As recently as May 5, the Annex I conformity assessment procedure dispute was still identified as a blocker in trilogue negotiations. Whether that dispute is genuinely resolved in the Omnibus text, or papered over in the political agreement, is something compliance teams won’t know until the final text is published.

The third track covers generative AI obligations, content labeling, watermarking, and the ban on AI systems designed to produce non-consensual intimate imagery. Under the provisional Omnibus agreement, these obligations are set for December 2, 2026. That’s seven months away.

What “Provisional Agreement” Actually Means for Your Planning Calendar

Compliance teams have been burned by this before. A provisional political agreement is a statement of intent by the three EU institutions, Parliament, Council, and Commission. It’s binding on the negotiating parties in the sense that they’ve agreed to it. It isn’t law until it’s published in the Official Journal of the European Union. Between now and publication, legal language gets finalized, recitals get drafted, and the translation process across 24 official EU languages can introduce interpretive variance.

The practical implication: provisions that read as settled in a press release can look different in the final text. The August 2, 2028 date for Annex I systems is currently supported by secondary analysis, law firm summaries explicitly state this date, but its relationship to the contested conformity assessment procedure is unclear from available sources. Compliance teams in medical device manufacturing, industrial automation, and consumer product sectors should treat this deadline as directionally confirmed but structurally uncertain until the Official Journal publication.

The Three Things You Can Act On Now

Not everything is uncertain. Some obligations are grounded enough in the provisional agreement to support planning action today.

First, generative AI providers need to be on a December 2, 2026 schedule for content labeling and watermarking. Secondary analysis confirms this date for watermarking obligations per the Parliament’s Omnibus draft. Seven months isn’t long when you’re building content authentication infrastructure against technical specifications that don’t yet exist in harmonized standard form. The EU AI Office has not published implementation guidance. The European Telecommunications Standards Institute (ETSI) and CEN/CENELEC working groups on watermarking are still developing relevant standards. Providers in this space should be building to their best current understanding of Article 50 requirements and documenting that they’re doing so, not waiting for guidance that may arrive two months before the deadline.

Second, any organization that has already begun Annex III compliance work shouldn’t stop. The December 2, 2027 deadline is the most corroborated of the three tracks, with explicit secondary confirmation from multiple law firm analyses. Organizations using AI in high-risk applications, biometric verification, CV screening, student assessment, should continue risk classification, internal governance documentation, and technical file preparation. The extended timeline makes the work more manageable; it doesn’t make it optional.

Third, the nudification ban and related prohibitions on AI systems generating CSAM fall within the December 2, 2026 track under the provisional Omnibus agreement. Under the provisional agreement, the EU would prohibit AI systems designed to produce non-consensual intimate images. This is a hard prohibition, not a compliance obligation with a technical assessment path. Providers should treat this as a product decision, not a documentation exercise.

What Must Wait

The Annex I conformity assessment question is unresolved in any source available for this analysis. The May 5 brief [“Who’s Blocking the EU AI Act Omnibus”](https://techjacksolutions.com/ai-brief/whos-blocking-the-eu-ai-act-omnibus-and-what-each-stakeholde/) identified the Annex I conformity procedure dispute as an active blocker. The Omnibus political agreement may have resolved it. Until the final text is published, compliance teams at medical device companies, automotive suppliers, and industrial machinery manufacturers can’t know whether the August 2028 deadline comes with a third-party assessment requirement, a self-assessment path, or a hybrid procedure. Building for one and discovering the other in the final text is an expensive mistake.

Harmonized standards are also missing. The European Commission has issued standardization requests, but the standards themselves, the technical specifications that tell engineers exactly what a compliant AI system looks like, aren’t final across most Annex III categories. The deadline extension buys time that doesn’t exist if organizations wait for standards before starting.

The Annex I Uncertainty Is the Real Planning Problem

Don’t expect the August 2, 2028 window to simplify planning for regulated-product manufacturers. The timeline looks long. The conformity assessment uncertainty means that organizations building AI into medical devices or industrial equipment can’t lock in their compliance architecture until they know what assessment procedure applies.

For compliance teams in those sectors, the practical move is to run a parallel-path analysis: document what a self-assessment path would require, document what a third-party assessment would require, and identify which elements are common to both. That work is valuable regardless of which path the final text mandates, and it keeps programs moving rather than stalling on an unanswered legal question.

TJS Synthesis

The Omnibus deal is real progress. Compliance teams who’ve been planning for an August 2026 Annex III crunch now have 16 months they didn’t have. But the gap between a provisional political agreement and a published Official Journal entry is where compliance programs go wrong, not because organizations ignore the deal, but because they plan to precision that the agreement doesn’t yet support. The December 2, 2026 generative AI deadline is close enough and stable enough to drive investment decisions now. The Annex I deadline is directionally useful but structurally unresolved. When the final text arrives in the Official Journal, the conformity assessment question will be answered, and organizations that built dual-path analyses will be positioned to move; those that waited will have less time than the headline deadline suggests.