The Digital Omnibus on AI is an EU Commission package designed to simplify and partially postpone obligations under the Regulation (EU) 2024/1689 (EU AI Act). On May 7, 2026, the Council and Parliament reached a provisional political agreement in Strasbourg during the third trilogue, following the failure of the second trilogue on April 28, 2026.
The agreement is provisional. Formal adoption by the European Parliament and the Council is targeted for the coming weeks, and in any case before August 2, 2026, as the originally scheduled deadlines would otherwise take effect automatically.
The Digital Omnibus answers three questions that have been stalling compliance teams since the beginning of 2026: When exactly do the high-risk obligations of Annex III apply? What happens to embedded AI components in regulated products (Annex I)? Does the labeling requirement for synthetic content (Article 50) remain in effect on August 2, 2026?
For SAP users making AI-supported personnel decisions, conducting credit scoring, or generating content via Joule, the answer is budget-relevant. Those who planned conformity assessments, risk management systems, and FRIA procedures for August 2026 in the spring of 2026 must now recalibrate. Those who ignored the original deadlines gain time, but not a reprieve.
The key points of the agreement from May 7, 2026:
Obligation CategoryOriginalNew (as of May 7, 2026)Annex III High-Risk Systems (standalone)August 2, 2026December 2, 2027 (fixed date)Annex I High-Risk Systems (embedded in regulated products)August 2, 2027August 2, 2028 (fixed date)Labeling of synthetic content (Art. 50 para. 2)August 2, 2026August 2, 2026 unchanged, with a 3-month transition period until December 2, 2026New Art. 5 Prohibitions (AI-CSAM, nudifier systems)not in original textDecember 2, 2026AI Regulatory SandboxesAugust 2, 2026August 2, 2027Article 26 Deployer ObligationsAugust 2, 2026unchanged, no postponementArticle 4 AI Literacyalready February 2, 2025unchangedArticle 5 existing prohibitionsFebruary 2, 2025unchangedArt. 53 GPAI model obligationsAugust 2, 2025unchangedThe dispute regarding the Annex I conformity assessment, which caused the second trilogue to fail, was resolved via an equivalence clause: AI machinery products only need to comply with sectoral safety rules, not additionally with the AI Act, provided that an equivalent level of protection for health and safety is guaranteed. According to Tech Policy Press (Laura Caroli, May 7, 2026), only the machinery sector was carved out; the eleven other sectors remain bound to the AI Act via bridging standards.
No free pass on the deployer side. The central trap: Article 26 was not postponed. Companies that deploy AI systems without developing them themselves will bear the full burden of deployer obligations starting August 2, 2026, regardless of the Omnibus.
Residual risk of formal adoption. The agreement is political, not legally binding. If the final vote in Parliament or the Council fails before August 2, 2026, the original deadlines will apply automatically. IAPP (April 30, 2026) and Modulos AI (May 7, 2026) point to the tight window between the agreement and publication in the Official Journal.
Political signal from Germany. Tech Policy Press documents that pressure from the Chancellery under CDU Chancellor Merz shifted the Council toward industry positions. Anyone interpreting this shift as permanent regulatory easing underestimates the possibility that subsequent guidelines (classification guidance, conformity requirements) will effectively replace the eliminated deadline.
Outdated protection through national oversight. While Brussels is postponing, NIS2 enforcement by the BSI is escalating in Germany. A compliance strategy that looks exclusively at the AI Act ignores the operational reality in which autonomous systems learn faster than their governance frameworks grow.
Watermarking gap is closing faster, not slower. The transition period for generative AI systems already on the market was shortened from six to three months compared to the Commission's proposal (the Parliament's position prevailed). For SAP Joule and comparable systems, this means: compliance for Art. 50 by December 2, 2026, three months earlier than originally planned.
A pragmatic compliance roadmap under the new status:
The provisional agreement of May 7, 2026, postpones the most burdensome technical obligations of Annex III by 16 months, but leaves three sets of obligations untouched: Article 26 deployer obligations, Article 4 AI literacy, and the existing prohibitions under Article 5. Anyone planning for December 2, 2027, while neglecting operational duties by August 2, 2026, has misinterpreted the logic of the Omnibus. The postponement affects product manufacturers more than users. In the SAP context, the pressure regarding audit trails, logging, and human oversight remains. Additionally, the formal adoption of the package is still pending, and national enforcement by the BSI, BaFin, and ESMA will follow their own timelines.