On 7 May 2026, the European Parliament and Council reached a political agreement on the EU AI Act Omnibus package. If your compliance plan still says "August 2026" anywhere — it's wrong.

The headline: high-risk deadlines extended

The compliance deadline for high-risk AI systems under Annex III moved from 2 August 2026 to 2 December 2027 — an additional sixteen months. The Annex I deadline (AI in products covered by existing EU safety legislation) moved to 2 August 2028.

This is not an invitation to relax. The work hasn't changed — just the calendar.

A ninth prohibited practice

AI-generated non-consensual intimate imagery of real people is now explicitly banned at the highest penalty tier — up to €35 million or 7% of global turnover. Takes effect 2 December 2026.

Watermarking obligations confirmed

AI-generated content — text, images, audio, video — must carry machine-readable watermarks. Also takes effect 2 December 2026. If your product generates synthetic content, technical implementation needs to start now.

What didn't change

The original eight prohibited practices (in force since February 2025) — unchanged. GPAI model obligations (from August 2025) — unchanged. The four-tier risk classification — unchanged. Deployer obligations — unchanged. The penalty structure — unchanged. Only the high-risk timeline moved.

The updated timeline

Already in force: AI Act entered into force (August 2024), AI literacy obligations (February 2025), prohibited practices (February 2025), GPAI model obligations (August 2025).

Coming next: 9th prohibition and watermarking (2 December 2026), Annex III high-risk obligations (2 December 2027), Annex I product safety obligations (2 August 2028).

The two dangerous reactions

"Great, we have more time." The compliance requirements are substantial — risk management systems, data governance, conformity assessments. None of that gets built in a quarter. Same panic, eighteen months later.

"Nothing really changed." Wrong. If your compliance plan, board slides, or training materials reference August 2026 for Annex III — they're now incorrect. Regulatory credibility depends on accuracy.

The Omnibus is pragmatic, not permissive. Europe still intends to be the most regulated AI market in the world. They've just acknowledged that building compliance infrastructure takes time — and given companies a bit more of it. Use it wisely.