What just happened
Today, on 2 June 2026, the Digital Omnibus deal on AI was formally adopted. The package contains welcome simplifications: less duplication, interoperable assessments, and proportionality for smaller players. But for anyone running a complex, multi-jurisdictional governance programme, the more important shift is structural: it sharpens who supervises what, when obligations bite, and where accountability sits. That clarity raises the bar and turns AI governance from a compliance function into a strategic asset.
The bigger picture
The Omnibus is neither a simplification triumph nor a regulatory retreat. It is a recalibration of how Europe's first horizontal AI law will actually work in practice, in light of implementation experience, not one stepping back from its ambitions. Some changes sharpen the Act's effectiveness: the unified notified-body procedure, FRIA-DPIA interoperability, Small Mid-Cap (SMC) recognition for scale-ups, and two new prohibitions on the most abusive generative uses. Others lower the regulatory floor: a narrowed safety-component definition, a softened AI literacy obligation, and a new delegated-act power to limit high-risk requirements where sectoral legislation already provides equivalent protection. And the centralisation of supervisory competence in the AI Office raises the ceiling sharply for the largest providers and platforms, reshaping the enforcement landscape. The net effect is a regime that clarifies what it requires, and from whom.
Three implications follow for anyone covered by the Act.
- Multi-regime governance becomes essential. AI Act compliance cannot be separated from GDPR, the Cyber Resilience Act, the Digital Services Act, and sectoral product safety law. Build evidence once and reuse it across supervisory relationships, rather than running parallel compliance processes that duplicate work and create inconsistencies.
- Evidence-based safeguards become the new compliance currency. Particularly for generative AI providers, the expected safeguards are a governance specification, not a legal-opinion exercise. Each one needs to live as a documented, auditable, continuously-monitored control.
- Governance becomes a strategic asset, not just a compliance function. Intended-purpose analysis, conformity assessment route, post-market monitoring design, and the determination of what counts as reasonable safeguards are all decisions now pushed to providers themselves. Each is exposure if undocumented, and competitive advantage if done well. The 2027 and 2028 deadlines are the floor for building competent governance and robust evidence, not the horizon. When a national authority, or increasingly the AI Office, comes asking, the evidence you have built is what will define the conversation.
How we got here
By late 2025, three problems with the EU AI Act had become visible. Harmonised standards were running late. National competent authorities and conformity assessment bodies were not consistently stood up across Member States. And the interplay between the AI Act and surrounding legislation was generating duplication and divergent interpretation that the expected guidance and standards had not arrived in time to resolve. Recital 2 of the Omnibus text frames the diagnosis plainly: delayed standards, delayed governance, a compliance burden heavier than expected; while Recital 3 sets the corrective ambition: targeted amendments aimed at the effective, simple, and uniform application of the rules.
What actually changed
Three changes define the Omnibus:
1. A timeline reset. The high-risk regime now applies from 2 December 2027 for Annex III systems (biometrics, employment, education, essential services, law enforcement, migration, justice, democratic processes) and from 2 August 2028 for Annex I safety-component systems (instead of the original 2 August 2026 date). Public-authority systems remain bound by the separate 2 August 2030 deadline.
2. Two new prohibitions beginning 2 December 2026. Article 5 now prohibits AI systems that generate or manipulate realistic non-consensual intimate material (NCII) of identifiable persons, and AI systems that generate child sexual abuse material (CSAM). They do not require removing generative capabilities, but they do require documented, continuously demonstrated safeguards against foreseeable misuse. Provider liability is narrowed to intended-purpose systems or to those producing reasonably foreseeable, reproducible misuse outcomes without adequate safeguards.
3. A new supervisor for the largest actors. The AI Office gains exclusive competence to enforce the AI Act over vertically-integrated GPAI providers and DSA-designated VLOPs and VLOSEs with embedded AI. The enforcement toolkit is closer to competition law than to product safety: market-surveillance powers under Regulation 2019/1020, information requests by decision, on-site inspections with the power to seal premises, binding commitments, and periodic penalties capped at 5% of average daily worldwide turnover per day.
4. Underneath these sit a series of smaller but consequential moves. A legal basis for bias-detection processing of special-category data, extended to deployers. Formal interoperability between the Fundamental Rights Impact Assessment (FRIA) and the GDPR or LED data protection impact assessment. SMC SME-style proportionality to scale-ups. Strengthened sandboxes, a streamlined cross-regime conformity assessment route, and a unified notified-body designation procedure. Genuine simplifications, alongside two changes that quietly lower the floor: a narrowed safety-component definition (excluding non-safety uses such as assistance, optimisation, convenience, or quality control) and a softened AI literacy obligation (from ‘ensure’ to ‘take measures to support’). A new Article 2(13) also empowers the Commission, by 2 August 2027, to limit high-risk requirements where Section A legislation already provides equivalent protection.
What this means for you
If you provide a high-risk AI system, your deadline(s) is likely moved out by 18 to 24 months, but the work has not shrunk. Three priorities matter. First, re-classify your portfolio against the narrowed safety-component definition. Some products fall out of scope, but the classification analysis is yours to defend. Second, plan your conformity assessment route carefully. Article 43(3) now confirms that high-risk status does not automatically force third-party assessment where sectoral law permits a harmonised-standards self-assessment route. Third, do not defer governance work.
If you provide generative AI, the NCII and CSAM prohibitions hit in December 2026. Recital 6b sets out the expected measures: data cleaning, refusal training, prompt-safe design, output controls, runtime guardrails, content classification and filtering, usage restrictions, abuse detection, and notice-and-action mechanisms. Each needs to live as a documented, auditable, continuously-monitored control. Providers releasing such systems via platforms or web interfaces are particularly exposed, because ongoing monitoring and corrective action are expected from those who retain effective control.
If you provide GPAI or run a major platform, your supervisory relationship has changed. The AI Office is now your exclusive supervisor under Article 75, with pre-market conformity assessment running through the Commission via notified bodies acting on its behalf. Compliance documentation needs to be Commission-ready, not just nationally-ready, and procedural standards will look closer to competition enforcement than to traditional product safety.
If you deploy AI in regulated sectors, three changes matter most. New Article 4a gives you a legal basis to process special-category personal data for bias detection and correction, subject to stringent conditions (strict necessity, pseudonymisation, access controls, deletion). The provision permits bias detection under safeguards. Article 27 makes FRIA formally interoperable with the GDPR or LED DPIA; design them together from the outset and operational cost drops sharply. And while the Article 4 literacy obligation has softened, the practical case for training your people has not changed.
If you are an SME, start-up, or SMC, the package is friendlier in net terms: simplified technical documentation, a streamlined Article 63 quality management regime, priority sandbox access, and fine caps. The trap is mistaking proportionality of form for proportionality of substance. The simplified route is permission to do the same work more efficiently, not less work.
For organisations that want to demonstrate responsible AI use, the gap between what the law requires on paper and what good governance requires in practice has grown. The Omnibus has changed the terms of the conversation. The direction of travel is clear: more decisions pushed to providers, higher procedural standards for the largest actors, and tighter integration across EU digital regulation. Organisations that build evidence-based governance now will not just be compliant in 2027 and 2028; they will be ahead of the curve. The work itself of making AI systems accountable, demonstrable, and trustworthy is more important than ever.
DISCLAIMER. The information we provide here is for informational purposes only and is not intended in any way to represent legal advice or a legal opinion that you can rely on. It is your sole responsibility to consult an attorney to resolve any legal issues related to this information.
