The EU AI Act timeline shift gives firms more time, but not a different rulebook

On 7 May 2026, negotiators from the Council of the European Union, the European Parliament and the European Commission reached a provisional agreement on the Digital Omnibus on AI, according to Inside Global Tech. The package is the first set of amendments to the EU AI Act since its adoption in June 2024, and it changes the implementation calendar before key compliance deadlines arrive.

The most visible change is time. For some AI systems generating or manipulating synthetic content that were placed on the EU market or put into service before 2 August 2026, the Article 50(2) obligation to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated moves from 2 August 2026 to 2 December 2026, according to Inside Global Tech. That is a four-month delay, not a cancellation.

The high-risk AI deadlines move more substantially. Inside Global Tech says obligations for Annex III use-based high-risk AI systems are postponed from 2 August 2026 to 2 December 2027, a 16-month deferral. Annex I product-regulated high-risk systems, including areas such as radio equipment, lifts and medical devices, move from 2 August 2027 to 2 August 2028, a one-year deferral.

Mishcon describes the agreement as part of the EU’s Digital Omnibus simplification agenda and says the text still requires formal adoption by Parliament and Council and publication in the Official Journal before becoming law. It is expected before 2 August 2026. That caveat matters: firms can plan around the political agreement, but the final legal text still has to complete the formal process.

The underlying framework remains. Mishcon says the EU AI Act entered into force in August 2024 as the world’s most comprehensive cross-sector AI legislation, and that the Omnibus is a targeted recalibration rather than a change of heart. The risk-based framework and core obligations remain intact, but businesses now have more time to prepare and a somewhat narrower compliance perimeter.

The practical effect is operational. Companies do not comply with AI rules by issuing a press release. They have to classify systems, document risk, redesign product workflows, build labeling or detection mechanisms, adjust governance, train staff, update contracts and make engineering choices. Moving a deadline can change budgets, product roadmaps and legal exposure across markets, especially for firms selling into the EU.

The European Commission’s guidance process shows why timing matters. IAPP reports that the Commission released draft guidelines on 19 May to help providers, deployers and other actors determine whether an AI system falls within the high-risk category. The draft guide covers general classification principles and the two high-risk categories under Article 6, with the comment period open through 23 June. It is not yet clear when the guidance will be finalized.

That creates a capacity bottleneck. Firms need to know whether their systems are high-risk before they can decide what obligations apply. Regulators need guidance to be usable before enforcement can be predictable. Smaller firms need enough time to translate legal categories into product and compliance work. The delay gives breathing space, but it also extends a period in which companies may be waiting for final detail.

The agreement is not only deregulatory. Mishcon says it adds new prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material. It also reduces regulatory duplication for AI embedded in industrial products, clarifies the supervisory role of the AI Office, and introduces tailored accommodations for SMEs and small mid-cap enterprises. The package is therefore a mix of delay, simplification and substantive policy change.

The source framing is broadly consistent but emphasizes different audiences. Inside Global Tech gives a compliance calendar and highlights staggered deadline relief. Mishcon frames the Omnibus as targeted recalibration driven partly by competitiveness concerns and industry pressure. IAPP focuses on the delayed but emerging high-risk guidance that privacy and AI governance professionals need for implementation.

The global relevance comes from the EU’s market size and rule-setting role. Mishcon notes that UK businesses offering AI systems for use in the EU will still need to comply. The same logic applies more widely: firms outside Europe often adjust products, documentation and governance for EU access. A deadline shift in Brussels can therefore change product planning and compliance schedules well beyond the bloc.

What remains uncertain is the final legal wording, the adoption timeline, the finalized high-risk guidance and how enforcement bodies will treat the transition. The supplied evidence supports the changed dates and broad direction of the Omnibus, but not every implementation detail. The clear reading is that the EU has slowed parts of the compliance clock without abandoning the AI Act’s basic structure.