What happened
EU institutions reached a provisional political agreement on the Digital Omnibus on AI, deferring high-risk AI compliance obligations for stand-alone Annex III systems to 2 December 2027 (from August 2026) and for Annex I product-embedded AI to 2 August 2028. Simultaneously, the agreement introduces a new Article 5 prohibition on AI that generates non-consensual intimate imagery or CSAM, effective 2 December 2026. The Article 50 transparency obligations (synthetic content marking) remain largely on the original August 2026 schedule.
Why it matters
Security and compliance teams get additional runway for high-risk system controls in employment, biometrics, law enforcement, and education AI, but the synthetic-content transparency and NCII prohibitions remain near-term obligations. The provisional agreement does not take legal effect until formal adoption and Official Journal publication, expected before 2 August 2026.
Action needed
Revise your EU AI Act compliance roadmap to reflect the revised tiered deadlines; continue August 2026 preparation for Article 50 transparency requirements and NCII content governance obligations, which are not deferred.