EU AI Omnibus Agreement: Extended Deadlines, Narrowed Scope, and New Deepfake Ban

On May 7, 2026, EU governments and the European Parliament reached a provisional political agreement on the "AI Omnibus" package, a set of targeted amendments to the EU AI Act within a broader digital simplification drive. The deal retools the world's most comprehensive AI law: extending deadlines, narrowing obligations, and reshaping enforcement — while keeping the core risk-based logic intact.

Key changes:

• Extended compliance deadlines. High-risk AI systems under Annex 3 (employment, education, health insurance) now face a deadline of December 2, 2027 (delayed from summer 2026). AI embedded in physical products (medical devices, industrial machinery) gets until August 2028.
• Narrowed high-risk scope. Only AI systems whose failure would create genuine health or safety risks face the heaviest obligations. Tools that assist users or optimize performance no longer automatically trigger the full regime.
• Overlap trimming. Where sector-specific legislation regulates AI functions (aviation, medical devices, financial services), companies will no longer face parallel assessments under both regimes.
• Machinery carve-out. Machinery has been entirely carved out of the AI Act and is now governed by its own sector-specific regulation — a change heavily lobbied for by Siemens and ASML. Green MEP Sergey Lagodinsky warned this is a "first step into fragmenting AI regulation."
• New prohibition. A ban on AI tools that generate non-consensual sexually explicit images (including deepfakes), taking effect December 2, 2026.
• SME relief. Simplified technical documentation, extended deadlines, and broader access to regulatory sandboxes for small businesses.

What it means for enterprise risk teams: The extended deadlines buy time, but the compliance trajectory hasn't changed. Multinationals must still build toward the substantive risk-management requirements — they just have 16 more months for Annex 3 systems. The machinery carve-out resolves a major uncertainty for industrial/manufacturing enterprises, though the sector-specific regulation's own AI safety requirements (due via delegated acts by August 2028) remain to be developed. The new deepfake ban, effective December 2026, is an immediate compliance item for any organization operating generative AI tools in the EU.

Formal adoption by EU governments and Parliament is expected in coming months.