The headline from the May 7 Omnibus deal was the delay: Annex III high-risk AI obligations pushed back 16 months, from August 2, 2026 to December 2, 2027. Compliance teams exhaled. Then they looked at the rest of the agreement.
The delay applies to one track. Two others are still running.
Legal analysis by Covington & Burling attorneys published May 18, 2026 confirms the three-track structure emerging from the Omnibus provisional agreement. Understanding which track applies to your organization isn’t optional, the three deadlines impose different obligations on different entity types, and the consequences of misclassifying your track range from missed preparation windows to active non-compliance.
Here’s the map.
Track 1: Chatbot Disclosure, August 2, 2026
This deadline didn’t change. Article 50 of the EU AI Act requires providers of AI systems intended to interact with natural persons, chatbots, conversational AI, AI-generated text systems, to ensure those systems are transparent about their AI nature. Per legal analysis of the Omnibus agreement, the August 2026 disclosure obligations are expected to take effect on schedule.
Who this applies to: any organization deploying a customer-facing chatbot, automated customer service system, or conversational AI tool in the EU market. That’s not a narrow category. If your product has a chat interface powered by an LLM, Article 50 almost certainly touches it.
What “disclosure” means in practice isn’t fully resolved. The EU AI Office hasn’t published binding implementation guidance on what constitutes “clear and conspicuous” AI disclosure for chatbot interactions. The provision is real. The compliance pathway is partially underspecified. That’s a planning problem, not a reason to wait, organizations that haven’t started building their disclosure approach are now building under time pressure.
Ten weeks is not a long runway for a UI change that touches every customer interaction point.
Track 2: Watermarking, December 2, 2026
This deadline is new, and it’s the one most compliance teams haven’t fully absorbed. Per legal analysis of the Omnibus agreement, the watermarking obligations under Article 50, requiring AI-generated content to carry machine-readable signals indicating its AI origin, carry a reported four-month deferral from the August baseline, landing at December 2, 2026.
What the Omnibus Changed for Annex III Deployers
Unanswered Questions
- What technical standard will the EU AI Office approve for Article 50 watermarking, and when will it be published relative to the December 2026 deadline?
- Does the nudifier ban extend to general-purpose GenAI platforms whose tools could be misused to generate NCII, or only to tools designed for that purpose?
- Will the provisional Omnibus agreement be modified before the European Parliament formal vote, and is there a vote date set?
Who this applies to: providers of AI systems that generate synthetic content at scale, images, audio, video, text in certain contexts. GenAI product teams building image generators, voice synthesis tools, and video generation features are the primary audience.
The catch is technical. There’s no harmonized EU standard for AI watermarking yet. The AI Office hasn’t published an approved methodology. Organizations building toward a December 2026 deadline are doing so without a confirmed technical specification to build against. Some will build against provisional standards from ETSI or ISO/IEC working groups; others will wait for the AI Office to move. Neither approach is risk-free.
Don’t expect the standard to arrive with enough runway to implement. Plan for a scenario where technical specifications arrive in October or November 2026 and implementation time is compressed to weeks.
Track 3: Annex III High-Risk Systems, December 2, 2027
This is the delayed track. The Omnibus agreement confirmed that Annex III use-based high-risk obligations – employment screening, biometric identification, critical infrastructure management, access to essential services, are deferred from August 2, 2026 to December 2, 2027. The 16-month relief is real.
Who this applies to: deployers of AI systems in the enumerated high-risk categories. Notably, this is use-based classification, a system becomes high-risk based on what it does, not what it’s called. An HR screening tool built on a general-purpose LLM still falls under Annex III if it’s used to make consequential employment decisions.
What to do now, even with 18 months of runway: the Annex III obligations include conformity assessments, technical documentation, human oversight requirements, and registration in the EU database. These aren’t activities that can be compressed into the final quarter of 2027. Organizations that used the relief period to defer all compliance work will face the same compressed-timeline problem in late 2027 that Article 50 organizations face today. Start the gap analysis now.
Track 4: The Nudifier Ban, December 2, 2026
A fourth compliance category emerged from the Omnibus. Per legal analysis of the agreement, the provisional text reportedly adds an explicit prohibition on “nudifier” applications, AI tools that generate non-consensual intimate imagery by digitally removing clothing from images of real people. The reported enforcement date is December 2, 2026.
This provision matters beyond the narrow class of applications it explicitly bans. It signals the EU’s intent to treat AI-generated NCII as a distinct compliance category, separate from the general Annex III high-risk framework, and on an accelerated December 2026 timeline. For GenAI providers whose platforms could be used to generate NCII, even if that’s not the intended use case, the nudifier ban raises product governance questions that go beyond the explicit prohibition.
Who This Affects
What to Watch
The US parallel runs simultaneously. The FTC began enforcing the Take It Down Act today, May 19, 2026, establishing a 48-hour removal obligation for NCII including AI-generated “digital forgeries” on covered US platforms. This is the first moment both jurisdictions have active or imminent enforcement obligations on AI-generated NCII simultaneously. Compliance teams operating across the Atlantic are managing two distinct legal frameworks, but they’re converging on the same underlying content category.
The Decision Matrix
Three questions determine your compliance track:
| Question | If Yes | Your Deadline |
|---|---|---|
| Does your system interact with natural persons as a chatbot or conversational AI? | Article 50 disclosure applies | August 2, 2026 |
| Does your system generate synthetic content (images, audio, video, text)? | Article 50 watermarking applies | December 2, 2026 |
| Does your system perform a use-based high-risk function (employment, biometrics, critical infra)? | Annex III obligations apply | December 2, 2027 |
An organization can sit on multiple tracks simultaneously. A GenAI platform that deploys a customer-facing chatbot, generates synthetic images, and offers an employment screening feature faces all three deadlines.
A note on what “provisional agreement” means.
The May 7, 2026 Omnibus deal is a provisional political agreement among the Council, Parliament, and Commission. It hasn’t been formally voted on by the European Parliament. Until that vote occurs, the agreement is not enacted law. The compliance dates discussed throughout this brief reflect the terms of the provisional agreement, which legal analysts are treating as the operative framework for planning purposes, but organizations should track the Parliament vote date and confirm no material changes emerge before treating any deadline as fully settled.
TJS synthesis. Most coverage of the Omnibus has focused on what got delayed. That framing buried the real planning problem: the August deadline for Article 50 chatbot disclosure hasn’t moved, and the December 2026 watermarking obligation is running toward an unresolved technical standard. Organizations that spent the last two weeks recalibrating their Annex III timelines may have simultaneously let their Article 50 preparation window compress to ten weeks. The compliance teams that will be best positioned by end of year aren’t the ones who celebrated the Annex III delay, they’re the ones who immediately asked which of their other obligations didn’t change. The Parliament vote is the next hard signal to watch: any modification to the provisional agreement’s deadline structure would reset these calculations entirely.