The Digital Omnibus file: what shifts, what stands, and what remains to be done

No AI regulation topic causes as much confusion in 2026 as the Digital Omnibus. One reader sees "delay" and halts their preparation; another points out that legally nothing has changed yet. Both have a point — and whoever has this file straight knows exactly which work continues and which work gets breathing room.

What was agreed on 7 May 2026

The Council and the European Parliament reached a provisional political agreement on the AI part of the Digital Omnibus, the Commission's simplification agenda. The core:

Subject	Applicable text	Political agreement
High-risk, Annex III	2 August 2026	2 December 2027
High-risk, Annex I (products)	2 August 2027	2 August 2028
Transparency, Article 50	2 August 2026	2 December 2026
New ban, Article 5 (nudifiers/CSAM)	—	2 December 2026

Besides shifting dates, the Omnibus also adds a new prohibition to Article 5: AI systems that generate or manipulate non-consensual intimate imagery ("nudifiers") or child sexual abuse material (CSAM). That ban applies from 2 December 2026 (see the prohibited practices). In addition, the wording of several provisions is softened — including Article 4 (AI literacy), whose obligation itself and date of application remain untouched.

What expressly does not shift

The agreement does not touch the provisions that already apply: the prohibited practices and the literacy obligation (since 2 February 2025), the GPAI regime (since 2 August 2025) and the AI Office's enforcement powers from 2 August 2026. The national supervisory structures also become operational on 2 August 2026 as planned. Whoever says "the AI Act has been delayed" is saying it too broadly: only the high-risk block and the transparency layer shift.

The road from agreement to law

A provisional political agreement is the last substantive step, but not the last step. The file has since moved: Member States' ambassadors (Coreper) endorsed the text on 13 May 2026, and on 16 June 2026 the European Parliament adopted it in plenary by 423 votes to 57, with 174 abstentions. That closes the substantive parliamentary stage. Still to come: formal adoption by the Council, signature by the two presidents, and publication in the Official Journal — widely expected in July 2026, ahead of the 2 August 2026 date. Until that publication, Regulation (EU) 2024/1689 in its current form remains the applicable norm — with 2 August 2026 as the date for the high-risk block. That is not a formality: organisations that halt their preparation entirely take a legal risk for as long as the amendment has not been published, however likely the outcome may be.

The adopted text confirms the dates in the table above and refines a few points the Parliament insisted on: the new Article 5 ban is worded to cover AI that generates child sexual abuse material or depicts an identifiable person's intimate parts or sexual activity without consent; overlapping machinery-product requirements are removed; the "safety component" notion is clarified; and the lighter-touch exemptions are extended from SMEs to small mid-cap enterprises.

How organisations handle this sensibly

Three rules of thumb. One: plan on the new dates, but document the decision and its premise ("political agreement, publication expected") so the trade-off remains explainable. Two: use the time gained for the building blocks that already apply or never go away — the AI register, literacy, the prohibition screening, data quality. Three: anchor both timelines in contracts with suppliers and customers, with publication in the Official Journal as the pivot point. This knowledge base tracks the file; the day the amended regulation appears, the timeline, the status board and this file will be updated.