EU AI Act Omnibus Amendment of 7 May 2026: New Deadlines, New Scope

1. TL;DR — The Five Material Changes

• High-risk Annex III postponed: 2 August 2026 → 2 December 2027. Covers biometrics, critical infrastructure, education, employment, law enforcement, border management.
• High-risk Annex I (products): separate, later compliance date of 2 August 2028 for AI systems embedded in regulated products.
• Machinery exempted: full carve-out from direct AI Act applicability where the Machinery Regulation already applies. Commission gains delegated-act power to add AI-specific health and safety requirements through the Machinery Regulation itself.
• Nudifier ban: AI systems generating child sexual abuse material or non-consensual sexually explicit content are explicitly prohibited from 2 December 2026.
• Transparency grace period shortened: from 6 months to 3 months. New deadline for AI-generated content disclosure obligations: 2 December 2026. AI sandbox establishment deadline moved to 2 August 2027.

2. The New Timeline (Old vs New)

3. High-Risk Postponement: Annex III and Annex I

The headline change is the split of high-risk enforcement into two distinct compliance dates. Under the original AI Act, Annex III high-risk systems (the standalone categories: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential public and private services, law enforcement, migration/asylum/border control, administration of justice) were due to comply by 2 August 2026. The Omnibus moves that date to 2 December 2027.

Annex I high-risk systems — AI embedded in products already regulated under existing EU product safety legislation (medical devices, machinery, automotive, toys, lifts, radio equipment, cableways, etc.) — receive an additional eight months on top, with a 2 August 2028 deadline. The split reflects the operational reality that conformity assessment for AI in regulated products requires alignment with sectoral notified bodies and existing CE-marking pipelines, which take longer to adapt than standalone software systems.

Notably, the Omnibus also brings back the obligation for providers to register AI systems in the EU's high-risk systems database — a provision that had been narrowed in earlier drafts. The database becomes a more central enforcement instrument, particularly given the longer preparation window before substantive obligations bite.

4. Machinery Regulation Exemption

For AI-powered machinery, the Omnibus is unambiguously good news. Machinery is now fully exempted from direct AI Act applicability where overlap with the Machinery Regulation exists. The European Commission gains the power to adopt delegated acts under the Machinery Regulation that add health and safety requirements for AI systems classified as high-risk under the AI Act. In other words: one regulation, one set of rules, one compliance pathway.

For other sectoral overlaps — medical devices, connected cars, toys — the Commission is charged with creating implementing acts to clarify how AI Act requirements interact with existing sectoral regimes. This is a slightly weaker instrument than delegated acts, but provides the same procedural channel for harmonising obligations rather than stacking them.

5. Nudifier Ban & Transparency Grace Period

The Omnibus introduces a new explicit prohibition: AI systems that create child sexual abuse material, or that use identifiable aspects of a person engaged in sexually explicit activities without consent — commonly called “nudifier” apps — are banned. The compliance start date is 2 December 2026.

Article 50 transparency obligations for AI-generated synthetic content also tighten on this front: the grace period providers had to implement disclosure mechanisms is shortened from six months to three months. The new effective date is 2 December 2026. Combined, this makes 2 December 2026 the first hard, binding new deadline produced by the Omnibus deal.

The reform also explicitly permits organisations to process personal data “where strictly necessary to detect and correct biases, with proper safeguards” in both high-risk and non-high-risk AI systems — a quietly significant clarification that addresses a long-standing GDPR/AI Act tension. See our existing analysis on bias detection under Article 10.

6. AI Sandboxes Deadline Pushed

Under Article 57 of the AI Act, every Member State must establish at least one national AI regulatory sandbox — a controlled environment for testing AI systems under regulator supervision before market deployment. The original deadline was 2 August 2026. The Omnibus pushes it back by exactly one year, to 2 August 2027. This aligns sandbox availability with the new high-risk Annex III enforcement date (2 December 2027), giving Member States time to operationalise the sandboxes before they become useful as a compliance staging ground.

7. What Did Not Change

• Article 5 prohibitions remain in force unchanged (in effect since 2 February 2025).
• GPAI core obligations remain in force (in effect since 2 August 2025).
• Penalties under Article 99 are unchanged: up to €35M or 7% of global annual turnover for prohibited practice violations; up to €15M or 3% for other infringements.
• Risk classification logic under Article 6 and Annex III categories — the substance of what makes a system high-risk — is unchanged.
• Documentation requirements under Articles 9, 10, 11, 13, 14, 15 remain. The bar is the same; the date is later.
• Article 50 transparency obligations themselves are not removed — only the grace period and the effective date shift.

8. What This Means for Your Compliance Programme

The Omnibus is a postponement, not a cancellation. The substantive obligations — risk management, documentation, human oversight, post-market monitoring, conformity assessment — are unchanged. What changes is the runway.

The 2 December 2026 deadline (nudifier ban + Article 50 transparency) is now your first binding new deadline. Organisations producing or distributing AI-generated content — in marketing, media, customer service, or product surfaces — should treat this as the operational priority for 2026.

For the redrawn complete picture, see our updated EU AI Act Key Dates & Deadlines article. For implementation planning, the implementation guide walks through the new milestones in operational detail.

9. Sources

All dates and provisions in this article are cross-referenced across the following primary and secondary sources, all reporting consistent terms:

• Council of the EU — Artificial Intelligence: Council and Parliament agree to simplify and streamline rules (consilium.europa.eu, 7 May 2026, primary).
• European Parliament — press release on the provisional agreement (7 May 2026).
• IAPP — EU agrees to amend AI Act, clarifies overlap with machinery rules (iapp.org, 7 May 2026).
• Politico Europe — EU clinches deal to roll back AI restrictions (politico.eu, 7 May 2026).
• Hogan Lovells — EU legislators agree to delay for high-risk AI rules (legal analysis).
• Lewis Silkin — The Council and Parliament agree to slim down and delay parts of the EU AI Act.
• Linklaters TechInsights — Omnibus Agreement: How the EU AI Act changes.
• Proskauer — EU AI Act Update: Provisional Deal Would Delay High-Risk AI Rules.

10. FAQ