AI Act Omnibus: What just happened and what comes next?

With a delay in reforms to the AI Act, and a looming compliance deadline in August, is now the moment to stop planning against an assumed extension and start treating the original deadline as reality? Well, the answer is complicated.

Contributors:
Ashley Casovan
Managing Director, AI Governance Center
IAPP
I have been holding off on writing about the European Commission's Digital Omnibus on AI proposals as there have been numerous twists and turns over the past several months, which many more deeply involved in the process than me have been doing great work reporting on. See links at the end.
However, after 12 hours of negotiations in Brussels fell apart 28 April, it's useful for AI governance professionals to be aware of the potential implications to their work.
With significant issues in the balance, such as the timing of enforcing requirements for high-risk AI systems, acceptable use of personal data for training, and potential changes to oversight, the proposed reforms to the AI Act are significant.
While a follow-up trilogue is anticipated in two weeks with a new mandate, many wonder if this is enough time for EU institutions to agree on a path forward before enforcement of high-risk systems is set to begin 2 Aug.
Is now the moment to stop planning against an assumed extension and start treating the original deadline as reality? Well, the answer is complicated.
What happened
What was expected to be relatively straightforward deliberations instead marked yet another significant turn in an increasingly windy road to the final stages of AI Act reform.
The 28 April trilogue was the second and final session scheduled to negotiate the Omnibus package, first introduced by the European Commission in November 2025. The European Parliament, Council of the European Union and European Commission had already aligned on the broad direction, including new fixed deadlines of 2 Dec. 2027 for standalone Annex III high-risk systems and 2 Aug. 2028 for AI embedded in regulated products.
The session ultimately broke down over something we have been focused on as well, the increasing intersectionality of existing digital rules.
As the enforcement deadline nears, questions are mounting over whether AI systems embedded in products already governed by existing EU sectoral safety legislation — such as medical devices, industrial machinery, toys and connected cars — should be exempted from the AI Act's additional requirements or governed solely by sectoral rules.
The parliament pushed hard for such a carve-out. However, the council and commission did not support these changes. Many have reported on the politics at play in the deliberation process and question if there will be an "alternative majority" created to pass the proposed changes in time for the 2 Aug. deadline.
One sticking point with significant implications
The debate over Annex I — the list of products covered by harmonized EU safety legislation — is not a minor issue. It goes to the heart of the AI Act's regulatory architecture.
The parliament's position would effectively move a significant category of high-risk AI systems out from under the AI Act's direct scope and into sectoral laws like the Machinery Regulation, the Medical Device Regulation, and the In-Vitro Diagnostics Regulation.
The rapporteur on the AI file under the European Commission's AI Omnibus package, MEP Michael McNamara, acknowledged the logic of reducing overlapping obligations, but also warned that routing AI governance through sectoral legislation could end up being "deregulatory rather than simplifying." This has also been flagged by more than 40 civil society organizations.
The council's reluctance to grant these carve-outs — particularly for sensitive sectors like financial supervision, law enforcement and border management — is understood to be an effort to preserve the AI Act's horizontal framework. Dismantling it for product-embedded systems could be a significant course correction.
Sebastian Hallensleben, chair of CEN-CENELEC AI standards development, shared in a LinkedIn post that he hopes "there will not be any structural changes to the AI Act (specifically the parts relevant to high-risk applications) since this would invalidate some of the foundations we have been working on for the past few years." With standards at the heart of the delayed timeline debate, the outcome of these deliberations could significantly change how and which standards are prioritized to be developed in support of the AI Act.
Now what?
Deliberations are not over. There is a potentially clear path toward a simplified agreement leading to the next trilogue in mid-May. It's also important to note that Ireland is set to take over the EU presidency 30 June. If negotiations continue until then, we may see yet another direction taken.
It is tough to see this happening, since prior to yesterday, there were many points of agreement on the next steps for the AI Act, including delaying high-risk system implementation until 2 Dec. 2027.
Until then, it's status quo. The AI Act was already passed into law and enforcement of high-risk systems starting 2 Aug. 2026 still stands. It is also important to recognize there are many aspects of the act that were not included in the Omnibus, which are important for AI governance professionals to work on now.
For example, getting prepared for Article 50, if you aren’t already. The act's transparency requirements for new generative AI systems — including user-facing disclosure and machine-readable marking of AI-generated content — still apply from 2 Aug. for systems launched on or after that date. Content marking and watermarking capabilities need to be production-ready.
For more information on the AI Act Omnibus and the future of the AI Act:
- AI Omnibus: Where Are We and Where Are We Headed? Part 1 of 2 & Part 2 of 2
- The AI Omnibus: what is settled and what is still in play
- Tech Law Blog EU AI Act – Timeline Update
- Notes from the IAPP Europe: Digital Omnibus package developments, end to voluntary CSAM detection and more
- EU countries, lawmakers fail to reach deal on watered-down AI rules
- EU Digital Omnibus: What the proposed changes to the concept of personal data mean in practice
- The AI Act Omnibus: Timeline, Key Players, and Documents (April Update)
- The EU's Digital Omnibus Package is out, and carries significant implications for AI
- AI Omnibus: Trilogue Underway…What to Expect as Negotiations Progress
- The EU Digital Omnibus with Dr. Gabriela Zanfir-Fortuna
- EU Digital Omnibus on AI: What is In It and What Is Not?

This content is eligible for Continuing Professional Education credits. Please self-submit according to CPE policy guidelines.
Submit for CPEsContributors:
Ashley Casovan
Managing Director, AI Governance Center
IAPP
Tags:



