Brussels found its sweet spot last month and the practical effect lands now: most of the EU AI Act’s high-risk compliance regime got pushed sixteen months into the future, while one of the few new prohibitions added to the law keeps its original December enforcement date. The Council, Parliament, and Commission reached provisional agreement on the Digital Omnibus on AI on May 7. The package is on track for formal adoption this month, with publication expected in July.

The delay is the headline if you sell AI software into Europe. The Annex III high-risk obligations covering use-based AI systems (biometric identification, employment decisions, credit scoring, education admissions, and friends) were supposed to bite on August 2, 2026. They are now pushed to December 2, 2027. The Annex I product-regulated obligations (medical devices, radio equipment, lifts) slip a year, to August 2, 2028. National regulatory sandboxes get an extra year as well. The pitch in Brussels was that this is timeline relief while the standards bodies catch up, not a weakening of the framework. Whether that holds depends on whether the Commission ships the harmonized standards and guidance documents during the borrowed time.

The piece that did not get pushed is the new prohibition on AI systems generating non-consensual intimate imagery or CSAM. That ban takes effect December 2, 2026, with fines up to 35 million euros or 7 percent of worldwide turnover, whichever hurts more. The legislation explicitly captures “nudifier” apps, the category of consumer AI tools that has been making local news everywhere a school district figures out a sophomore used one. There is also a new 3 percent / 15 million euro fine schedule for breaching information-sharing obligations, which closes a previous gap where transparency violations were cheaper than substantive ones.

The framing matters. Brussels can credibly say the AI Act is still happening, just slower on the boring parts and faster on the visceral ones. Whether that survives contact with US trade negotiators who would prefer the whole thing not happen at all is a separate question, and it is the one to watch for the rest of 2026.

eu-ai-actdigital-omnibuseuropean-commissiondeepfakescsamregulationcompliancehigh-risk-ai