EU agrees Digital Omnibus deal: high-risk AI duties pushed to December 2027

What this is about

In the early hours of 7 May 2026 the Belgian Council Presidency reached a provisional compromise with European Parliament negotiators on the Digital Omnibus on AI. For the first time the concrete contents of the package — much speculated about in the preceding weeks — are now public. Key points: high-risk AI obligations under Article 6(1) of the AI Act now apply from 2 December 2027 instead of 2 August 2026. Relief for small and medium-size enterprises is extended to so-called Small Mid-Caps with up to 500 employees. The text adds an explicit ban on apps that generate non-consensual sexual or intimate imagery — so-called "nudification" apps — and on the creation of child sexual abuse material.

What the deal actually does

Three building blocks define the package. First, the delay. High-risk applications in biometrics, critical infrastructure, education, employment, migration and border control gain 16 additional months to put their conformity assessments, risk analyses and data quality duties in place. AI embedded in physical products such as lifts and toys gets even more time, with the deadline pushed to 2 August 2028.

Second, the SME track. Until now, simplified documentation requirements applied only to companies with fewer than 250 employees. The omnibus extends these reliefs, including simplified technical documentation, to Small Mid-Caps with up to 500 employees. That is a tangible relief for the German Mittelstand and similar structures in France and Italy.

Third, the new prohibitions. The explicit ban on AI practices that generate non-consensual intimate imagery and child sexual abuse material applies already from 2 December 2026. The transition period for transparency obligations on AI-generated content is shortened from six months to three, also with a deadline of 2 December 2026.

Why it matters

The deal is the largest substantive correction to the AI Act since its entry into force on 1 August 2024. For companies, the compliance roadmap shifts. Anyone in a 2026 preparation phase now has more time but must use it well, because the obligations will hit hard in 2027. Mid-market companies with between 250 and 500 employees gain real relief for the first time, particularly on technical documentation and on logging duties for high-risk AI. Politically, the agreement is the product of months of industry pushback and a clear signal to civil rights groups that abusive generative AI — especially synthetic sexual content — will not be left unregulated.

The deal still needs formal endorsement by Council and Parliament, followed by legal-linguistic finalisation. According to Lewis Silkin and IAPP, formal adoption is expected within weeks rather than months.

In plain language

Imagine a city has passed a strict new building code. Architects and contractors say: we cannot hit the deadline. The city replies: fine, we push the deadline by about 16 months. In exchange the city says: anyone who knowingly builds dangerous houses will be punished immediately. That same logic — more time for honest builders, a harder line on clearly harmful actions — sits inside the Digital Omnibus.

A practical example

A southern German machinery maker with 380 employees plans to deploy an AI vision-inspection system on its assembly line in 2026. Previously, it fell outside the SME bracket because it has more than 250 employees. After the omnibus enters into force, it counts as a Small Mid-Cap. The compliance team can file simplified technical documentation instead of the full high-risk dossier. At the same time, the company has 16 additional months to complete its Article 6(1) acceptance. The practical advice: do not waste that time, but spend it on clean data quality audits, logging concepts and the selection of notified bodies.

Scope and limits

• The deal is provisional. It only becomes binding law after formal adoption by Council and Parliament and the legal-linguistic finalisation. Until then, companies should not change their roadmap without a reserve buffer.
• High risk remains high risk. The duties have not vanished — they have moved. Anyone who relaxes now will face the same compliance problem in 2027.
• There are international tensions. U.S. commentators frame the delay as proof of European industrial weakness. That perception can play out unfavourably in transatlantic negotiations, including on trade.

SEO and GEO keywords

EU AI Act, Digital Omnibus, high-risk AI, Article 6(1), 2 December 2027, Small Mid-Cap, SME, nudification, compliance, Council of the EU, European Parliament, AI Office, 2026