EU Delays High-Risk AI Compliance to 2027 in Sweeping 'Omnibus' Amendment

On June 16, 2026, the European Parliament voted to approve the "Digital Omnibus on AI," fundamentally altering the enforcement timeline of the world's most comprehensive artificial intelligence law.[1][3]

The legislative package presses the pause button on the EU AI Act's most stringent requirements, delaying the compliance deadline for "high-risk" AI systems by over a year.[2][8]

However, the Omnibus is not purely a deregulatory measure; it simultaneously introduces an immediate, severe ban on AI systems designed to generate non-consensual intimate imagery, commonly known as "nudifiers."[1][3]

The primary driver behind the delay is widespread industry unreadiness and a severe bottleneck in regulatory standards. Under the original statutory timeline, the bulk of the AI Act—including the rigorous Article 8-15 obligations for high-risk systems—was set to become enforceable on August 2, 2026.[5][8]

By late 2025, evidence mounted that neither the European Commission nor private enterprises were prepared for the transition. Harmonized technical standards remained incomplete, and companies struggled to map their sprawling AI deployments against the Act's broad definitions.[2][7]

In response, the Omnibus agreement defers the high-risk obligations for standalone systems (Annex III) to December 2, 2027. For AI embedded in regulated physical products (Annex I), the deadline is pushed even further to August 2, 2028.[2][8]

Despite the relief for high-risk systems, legal advisors warn that the August 2026 deadline remains a critical compliance milestone for transparency and general-purpose AI. The Omnibus is a deferral, not a dismantling of the regulatory architecture.[2][5]

The August 2, 2026 date remains active for Article 50 transparency obligations, which require providers to ensure that humans are aware they are interacting with an AI and that AI-generated content is identifiable.[2][8]

The new legislation does grant a brief four-month grace period for machine-readable watermarking obligations, pushing that specific technical requirement to December 2, 2026, for systems that are already on the market.[1][2]

Alongside the delays, the Omnibus introduces a strict new prohibition on deepfake "nudifiers," reflecting intense political pressure to address consumer harms. Article 5 of the AI Act has been amended to explicitly ban AI systems that generate child sexual abuse material or create sexually explicit images of identifiable individuals without consent.[1][3]

Providers are strictly prohibited from placing these systems on the EU market, and the ban takes effect on December 2, 2026. Breaching these prohibitions carries the Act's maximum penalties: fines of up to €35 million or 7% of a company's global annual turnover.[3][5]

However, there is transparent uncertainty regarding how these new prohibitions will be enforced at the national level. While lawmakers have championed the nudifier ban, national regulatory authorities report that they lack the legal powers and practical arrangements to police it effectively.[3]

Regulators in member states like Lithuania have publicly stated that the division of responsibilities between national market surveillance authorities and the centralized European AI Office remains entirely undefined ahead of the December 2026 enforcement date.[3][6]

For engineering teams, the delay does not mean they can pause compliance efforts, as draft guidelines clarify that complex and multi-agent AI systems will be regulated stringently to prevent loophole exploitation.[4][5]

Guidelines issued by the European Commission in June 2026 state that if multiple AI models form a complex pipeline that influences a high-risk decision, the entire interconnected architecture is classified as a single high-risk system.[4]

This interpretation prevents developers from bypassing Annex III requirements by splitting a high-risk task across several minimal-risk agents. Furthermore, the guidelines note that human oversight does not remove a system's high-risk status; it is merely a prerequisite for compliance.[4][5]

The Omnibus package also accelerates the centralization of regulatory power within the European AI Office. If adopted in its current form, the Office will directly supervise the compliance of AI systems integrated into very large online platforms (VLOPs) and very large search engines.[6][8]

This centralization aims to prevent uneven enforcement across the EU's 27 member states, a persistent challenge observed in the rollout of the General Data Protection Regulation (GDPR).[6]

The Omnibus package now moves to the European Council for formal adoption. It must be published in the Official Journal in the coming weeks to take legal effect before the original August 2026 deadline triggers.[2][3]

Until that formal publication occurs, the original statutory timeline technically remains the baseline for enterprise planning, though the political agreement provides near-certainty that the high-risk extensions will be realized.[2][7]