EU AI Omnibus May 2026: Revised Deadlines, SMC Relief, and the New Compliance Calendar

What the May 7 Agreement Actually Changed

The EU AI Act, which entered into force in August 2024, set a compliance timetable that AI product companies built their internal roadmaps around. The May 7, 2026 Omnibus agreement — reached between the European Council and the European Parliament — modifies three of those timelines materially. According to the European Council’s official press release, the deal is designed to “simplify and streamline” the rules while maintaining the Act’s core risk-based architecture.

The most significant change for enterprise AI product teams is the extension of high-risk AI system compliance obligations. The original August 2026 deadline for Annex III high-risk systems (employment, education, credit scoring, biometric identification, law enforcement, migration) has been replaced by a December 2027 deadline. Systems embedded in products already regulated by EU sector-specific legislation — medical devices, aviation equipment, vehicles — receive a further extension to August 2028. White & Case’s analysis of the Omnibus deal describes this as “the most significant recalibration of the Act since its adoption.”

GPAI (General Purpose AI) model obligations — the requirements that apply to foundation model developers like OpenAI, Anthropic, Mistral, and Google — are not extended. These remain on the August 2025 timeline that already took effect, meaning providers operating in the EU must already be in compliance with transparency and copyright documentation requirements.

Three Changes That Require Immediate Roadmap Revision

1. The SMC Extension: Who Now Qualifies for Reduced Obligations

The original AI Act extended SME-level protections (reduced documentation requirements, lighter conformity assessment obligations, regulatory sandbox access) to companies with fewer than 250 employees and under €50M in annual revenue. The Omnibus agreement extends these protections to “small mid-cap companies” — organizations with up to 500 employees and revenue under €150M.

Dastra’s detailed analysis of the Omnibus deal notes that this extension brings a meaningful proportion of the European AI ecosystem into the lighter-obligation tier. Companies that previously planned their compliance programs under the full enterprise regime — because they exceeded the original SME thresholds — should immediately reassess their qualification status. If they now qualify as SMCs, the cost and timeline of their conformity assessment changes materially.

The SMC status is not self-declared — it must be verified against the EU’s standard enterprise size definitions as of the company’s last financial year. Companies near the threshold should prepare documentation now, because the SMC status determination is the first compliance question that internal legal and compliance teams will need to answer when the Omnibus formal adoption occurs in August 2026.

2. The Nudification Ban: What Counts and What Is Immediate

The Omnibus agreement introduces a new prohibited practice category: AI systems that generate or manipulate images, audio, or video of real persons in explicit sexual contexts without their consent — commonly referred to as nudification or non-consensual synthetic intimate imagery. This prohibition takes effect immediately upon formal adoption of the Omnibus, without the transitional period that applies to other new requirements.

Latham & Watkins’ AI Act update on the Omnibus clarifies that the prohibition extends to any provider whose system could be used for nudification, even if that is not the system’s primary purpose — meaning general image generation tools must implement technical controls or use-case restrictions that prevent this category of output. Companies providing general-purpose image generation, video synthesis, or face-swapping tools face an immediate compliance decision: implement content filters, add consent verification workflows, or restrict the capability for EU users.

The practical implementation challenge is significant. Existing content moderation approaches — prompt filtering, output classification, user agreement frameworks — all have known evasion vectors. The regulation implies a good-faith implementation standard, but companies should document their control architecture and the reasoning behind their chosen approach, anticipating that enforcement guidance from national AI regulators will define the standard of care more precisely.

3. The Revised High-Risk Compliance Calendar

The extended deadlines create a window but not a reprieve. According to Linklaters’ review of the Omnibus changes, the December 2027 deadline for Annex III systems is firm — and the conformity assessment process for high-risk AI systems is operationally complex enough that companies beginning preparation in Q3 2026 will be completing their assessments in Q4 2027 with little buffer.

The conformity assessment for a high-risk AI system involves: technical documentation (risk management system, data governance records, transparency documentation, human oversight design), testing against applicable harmonized standards (which are still being developed by CENELEC and CEN), and, for certain categories, notified body review. None of these steps can be compressed into a few weeks. Companies that use the 18-month extension to defer starting their compliance programs — rather than to improve the quality of their compliance programs — will face the same deadline pressure they would have faced under the original timetable, just 18 months later.

What AI Product Teams Must Do Before August 2026

The August 2026 formal adoption of the Omnibus creates four immediate action items for AI product companies operating in or serving EU markets.

First: determine whether the system you operate or embed qualifies as a high-risk AI system under Annex III. The Omnibus modifies deadlines but does not modify the classification criteria. Systems that were high-risk under the original Act remain high-risk under the Omnibus.

Second: determine your SMC status. If you now qualify as a small mid-cap, document it and restructure your compliance program accordingly. If you do not qualify, confirm your enterprise-level obligations and budget for the full conformity assessment.

Third: if your system involves image, audio, or video generation featuring real persons, conduct an immediate nudification risk assessment. Implement controls, document the implementation rationale, and consult legal counsel on the adequacy of your chosen approach relative to the emerging guidance from the European AI Office.

Fourth: if GPAI model obligations already apply to your foundation model — because you were operating under the August 2025 deadline — audit your current compliance status. The Omnibus does not extend GPAI deadlines; providers that are not yet in compliance with transparency and copyright requirements are already operating in violation.

The Antitrust and Market Structure Question

The Omnibus’s SMC extension has an unintended market structure implication worth noting. By reducing compliance obligations for companies under 500 employees and €150M revenue, the regulation creates a threshold effect: companies that grow past this boundary face a discontinuous jump in compliance cost. For companies currently approaching the SMC boundary, this creates a structural incentive to manage growth rate — a regulation intended to support smaller companies may inadvertently create a ceiling on ambition.

The European AI Office has acknowledged this structural dynamic in its commentary on the deal. The February 2026 report from the AI Office noted that the EU’s AI regulatory burden, measured as a percentage of revenue, is approximately three times higher for companies in the 500–2,000 employee range than for either SMCs or large enterprises. This “compliance cliff” at the SMC boundary is a known design flaw in the current framework and is likely to be addressed in the first formal review of the AI Act, expected in 2028.

For AI product companies planning their growth trajectories, the SMC boundary is now a material input to organizational design — not just a compliance checkbox.

Frequently Asked Questions

Sources & Further Reading

• Council and Parliament Agree to Simplify and Streamline AI Rules — European Council
• EU Agrees Digital Omnibus Deal to Simplify AI Rules — White & Case
• Simpler, Safer, Stricter Where It Counts: Inside the EU AI Omnibus Deal — Dastra
• AI Act Update: EU Resolves to Change Rules and Extend Deadlines — Latham & Watkins
• Commission Omnibus Package — European Commission