Digital Omnibus AI Act May 2026 status: political agreement, deferral and what still applies

The Digital Omnibus is no longer just a Commission proposal. The Council and European Parliament have reached a political deal on the AI Act amendments. That makes the direction much more concrete, especially for organisations working on high-risk AI, AI literacy, supplier assurance and transparency around AI-generated content.

The key nuance: the existing law remains the legal baseline until the amendment formally enters into force. Do not use the agreement as a reason to pause AI Act compliance. Use it as a reason to make your planning smarter.

Short status

For ongoing background, we keep the Digital Omnibus guide as the central reference.

What changes under the deal?

The most concrete change is the timeline for high-risk AI systems. For systems listed in Annex III, the main obligations move to 2 December 2027. This affects AI in areas such as biometrics, education, employment, essential services, law enforcement, migration and justice.

For high-risk AI systems embedded in products covered by existing EU sectoral safety legislation, such as medical devices or machinery, 2 August 2028 becomes the relevant date.

That is not a free pass. An organisation that starts classification, data governance, technical documentation, human oversight and supplier assurance only at the end of 2027 will be too late. The extra time is mainly valuable if it is used well.

Article 4 AI literacy: be careful with conclusions

The original Commission proposal sought to weaken Article 4 AI literacy: less direct obligation for organisations, more encouragement by the Commission and Member States. The EDPB and EDPS strongly advised against that move.

The official communication on the 7 May 2026 political agreement does not spell out Article 4 as a settled amendment. The correct message is therefore:

do not claim that AI literacy has been abolished.

Until the formal amendment is available, the current AI Act remains the legal baseline. AI literacy is also not only a legal question. Without role-based training, organisations get weaker AI adoption, more data risk, more automation bias and weaker internal governance.

For organisations that want to make this demonstrable, the route is clear: start with a baseline assessment, train by role, record results and refresh periodically. You can start with the LearnWize AI literacy assessment.

Watermarking and nudifier apps

The transparency obligation for AI-generated content remains close. Earlier political positions pointed to 2 November 2026, while the Commission proposal used 2 February 2027. The political agreement names 2 December 2026 as the date for compliance with watermarking and AI content transparency.

The deal also introduces an explicit ban on AI systems that generate or manipulate child sexual abuse material or non-consensual intimate images. This is not an abstract compliance point. Providers of generative image, video or multimodal systems need demonstrable safety controls, filters, logging and misuse prevention.

Registration: more transparency after all

One important difference from the original proposal: the registration requirement for providers claiming that a system in a high-risk area is nevertheless not high-risk appears to be restored in the political agreement.

That makes sense. If a provider says: "this is in a sensitive domain, but it does not fall under the high-risk obligations", that assessment needs to be reviewable. For compliance teams, this means risk classification cannot be a loose spreadsheet. It needs to become a traceable decision with reasoning, version control and a link to the AI inventory.

What should organisations do now?

1. Update the AI Act roadmap. Use 2 December 2027, 2 August 2028 and 2 December 2026 as planning assumptions, but label them as dependent on formal entry into force.
2. Classify systems now. Waiting for the final law does not help if you do not yet know which AI systems you use or provide.
3. Keep Article 4 alive. Continue training, testing and documenting AI literacy. It is legally prudent and operationally necessary.
4. Sharpen vendor assurance. Ask suppliers about classification, data use, bias controls, logging, human oversight, incident handling and their future AI Act roadmap.
5. Use the extra time for evidence. The organisations that move fastest later will not be the ones that waited. They will be the ones that already built the basics.

If you want to translate this into a concrete roadmap for your organisation, an AI Act readiness track with Embed AI fits that need. If your main gap is demonstrable AI literacy, start with the LearnWize assessment.

Conclusion

The Digital Omnibus gives organisations more time for high-risk AI, but not a reason to lean back. The core remains the same: know which AI you use, know the risks, train people, hold suppliers to account and collect evidence.

The best use of the political agreement is not delay. The best use is to turn the extra months into better governance.