- On 7 May, Parliament and Council reached a provisional agreement to simplify the Artificial Intelligence Regulation.
- The high-risk rules will apply on 2 December 2027 (stand-alone systems) and 2 August 2028 (systems embedded in products).
- A ban is added on AI that generates sexual or intimate content without consent and child sexual abuse material.
On 7 May 2026, negotiators from the Council of the European Union and the European Parliament reached a provisional agreement on the so-called digital omnibus on artificial intelligence, a Commission proposal to simplify and delay parts of the AI Regulation. The deal sets specific dates: 2 December 2027 for the obligations on stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in regulated products, such as medical devices with AI. The Commission had proposed a postponement of up to sixteen months.
The agreement adds a ban on AI practices that generate sexual or intimate content without consent or child sexual abuse material, applicable from 2 December 2026, and shortens from six to three months the grace period for generative AI systems already on the market to mark their synthetic content, with a new date of 2 December 2026. Formal adoption by Parliament and the Council is still needed; they aim to complete it before 2 August 2026, the date on which the high-risk obligations would otherwise have applied.
What is postponed and what is not
The AI Regulation entered into force in 2024 and applies in stages. The bans on the most harmful practices have applied since 2025 and this deal does not delay them. What is delayed is the regime for high-risk systems, which was due to start applying on 2 August 2026, and which is now staggered over two dates according to the type of system.
Stand-alone high-risk systems are those the regulation lists in an annex because of their impact on people, such as recruitment and staff-management tools, credit assessment or certain uses in education and essential services. Embedded systems are, for example, AI that forms part of a medical device or of a machine subject to other safety legislation.
High risk in practice
Whoever develops or markets a high-risk system will have to, among other things, manage risks, ensure data quality, document the system, allow human oversight and subject it to a conformity assessment. Whoever uses it in their business, for example in recruitment, will have their own duties of correct use and information. The postponement gives more time to prepare, but does not change the content of those obligations.
The agreement also keeps the obligation to register systems declared exempt from the high-risk regime, albeit with a simplified procedure, and preserves a strict necessity threshold for processing sensitive data in order to detect bias. These are nuances that matter to those who combine AI and personal data.
What to review
Companies can use the margin to take an inventory of the AI systems they use or supply: what they do, with what data, who develops them and in which category of the regulation they might fit. Providers of recruitment tools, credit analysis or generated content should start there.
It is also worth reviewing contracts with technology suppliers, so that they provide for who is responsible for compliance and documentation, and internal policies on marking synthetic content. This is a provisional agreement, not a rule in force; the final text may be adjusted on adoption. It is also useful to appoint someone to follow the rule, because the final texts and Commission guidance may clarify the scope of each obligation. Consult your adviser before planning investments.
More time is not fewer obligations: it is best used to sort out which AI is used and for what.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
