Provisional Agreement on the AI Omnibus: Key Changes at a Glance
Published on 18th May 2026
This article was authored by partner Dr Lina Böcker and trainee Marie Strehlau.
After the Commission, the Parliament and the Council had each published their respective proposals, trilogue negotiations on the AI Omnibus began. The first round of trilogue talks failed to produce a compromise. However, on 7 May 2026, negotiators from the Parliament and the Council were able to agree on a provisional text.
Extended Timelines for High-Risk AI Systems
To allow sufficient time for the necessary standards and support measures to be developed, the obligations for providers and deployers of high-risk AI systems have been deferred. Specifically:
- AI systems listed in Annex III of the AI Act (including systems used in recruitment and critical infrastructure): obligations apply from 2 December 2027.
- AI systems embedded as safety components in products subject to EU harmonisation legislation (such as medical devices or machinery): obligations apply from 2 August 2028.
This represents a meaningful improvement over the original timeline. However, the deferred dates will only take effect if the provisional agreement is formally adopted before 2 August 2026 — the date on which the current high-risk rules would otherwise become applicable. The Co-legislators have indicated their intention to meet this deadline, though the timetable is tight. Compliance planning should not be based solely on the assumption that the deferred obligations will apply.
Industrial AI: A Tailored Approach to Dual Regulation
One of the central disputes in the negotiations concerned AI systems integrated into products already subject to sectoral EU product law – such as machinery, elevators and toys. The agreement addresses the risk of dual regulation through two mechanisms:
- Where sectoral legislation contains specific requirements that are similar to those of the AI Act, the Commission may restrict the application of the AI Act through implementing acts.
- AI systems falling within the scope of the Machinery Regulation are generally exempt from direct application of the AI Act. The Commission is, however, empowered to adopt delegated acts setting out health and safety requirements for machinery AI systems classified as high-risk.
The Commission is also required to issue guidelines to assist operators in complying with the high-risk requirements while minimising the compliance burden.
In practice, significant legal uncertainties remain: It is not yet clear when implementing acts will be adopted, which sectors they will cover, or what the delegated requirements for machinery AI will ultimately entail. Businesses with long product development cycles should factor this regulatory uncertainty into their planning now.
New Prohibition: Non-Consensual Intimate Content and CSAM
The agreement introduces a new prohibition to the AI Act, covering AI systems that generate non-consensual sexual or intimate content or child sexual abuse material. The prohibition applies to:
- placing on the EU market AI systems designed to generate such content;
- placing on the market such systems without adequate safeguards to prevent that generation; and
- the use of such systems by deployers for that purpose.
The prohibition covers images, video, and audio material. Companies have until 2 December 2026 to adapt their systems accordingly.
Further Developments: Transparency, Data Protection and Responsibilities
Watermarking obligations: The application of machine-readable labelling requirements for AI-generated content has been brought forward to 2 December 2026 (from 2 February 2027 under the Commission's proposal). The transition period for providers to implement the relevant transparency solutions has been reduced from six to three months.
Processing of sensitive personal data for bias detection: The provisional agreement restores the "strict necessity" standard for processing special categories of personal data (such as health data or data revealing political opinions) for the purpose of detecting and correcting bias — with appropriate safeguards in place, for both high-risk and non-high-risk AI systems. The Commission's draft had deliberately lowered this threshold to a mere "necessity" standard; Parliament and Council have reinstated the stricter requirement.
Registration obligations: The obligation to register high-risk AI systems under Annex III in the EU database is retained in full, including in cases where providers take the view that the high-risk classification does not apply to their system. The Commission's draft had proposed removing this obligation in such cases; the final text does not follow that approach.
SME relief extended: Exemptions from certain obligations, previously available only to SMEs, are extended to small mid-cap companies to support their growth.
Competences of the AI Office: The agreement clarifies the supervisory competences of the AI Office for AI systems based on general-purpose AI (GPAI) models where the model and the system are developed by the same provider. Carve-outs are provided for specific sectors — including law enforcement, border management, judicial authorities, and financial institutions — where national authorities retain competence.
What to Expect Next
The provisional agreement must now be formally approved by the Council and the European Parliament, following legal-linguistic revision. This is ordinarily a procedural step. The critical constraint, however, is time: the entire process must be completed before 2 August 2026, when the existing high-risk rules under the current AI Act would otherwise take effect.
