Source: Tech Policy Press

At 4:30 a.m. on May 7, EU legislators reached agreement on the AI Omnibus, the regulation amending the EU AI Act, concluding a six-month negotiation conducted on an exceptionally tight schedule aimed at replacing the August 2, 2026 deadline. The Omnibus postpones the application dates for many high-risk AI requirements: systems affecting fundamental rights must comply by December 2, 2027, while AI embedded in regulated products will have until August 2, 2028; transparency and watermarking obligations remain due this August, with market incumbents granted leeway until December 2 of this year. The text confirms a sensitive expansion allowing use of sensitive personal data for bias detection and correction across providers and deployers, subject to safeguards, a change that drew civil society opposition and which legislators justified as bias mitigation serving a legitimate public interest.

Negotiations also softened AI literacy obligations into an obligation of means supported by Commission and Member State assistance, and introduced a new ban on “nudifier tools” — prompted by a wave of sexual deepfakes attributed to Grok last winter — extending to child sexual abuse material and applying from December of this year. The industrial AI dispute nearly derailed the deal; Parliament had sought broad exemptions for regulated sectors, but the final compromise carved out only the machinery sector while keeping it tethered via bridging standards and requiring the Commission to incorporate AI-related requirements before the August 2, 2028 deadline. Additional changes include streamlined obligations and certification, further centralisation in the AI Office, an EU-level regulatory sandbox, and SME privileges extended to small mid-cap firms. Negotiators finished in time to adjust deadlines, but stakeholders on both sides remain frustrated, the dossier notes, and the AI Omnibus precedes the more consequential Data Omnibus and potential GDPR-related relaxations.