EU AI Act Omnibus May 2026: Extended Deadlines and SMC Relief — What Actually Changed

The Deal in Plain Terms: A 16-Month Reprieve With Strings Attached

The EU AI Act has been in force since August 2024, but its compliance timelines — staggered across prohibitions, high-risk categories, and transparency rules — have been a moving target. The May 7 Omnibus agreement, reached after months of lobbying from technology industry groups and member state governments concerned about competitiveness, makes the most significant structural changes to those timelines since the Act was published.

According to Dastra’s detailed analysis of the Omnibus deal, the core changes resolve around four compliance dates that have been the subject of the most intense industry pressure.

High-risk AI systems (Annex III) — standalone systems covering areas like employment screening, credit scoring, and biometric identification — had a compliance deadline of August 2, 2026. That deadline is now moved to December 2, 2027, a 16-month extension. This is the change that most directly affects AI vendors selling into EU markets across HR tech, fintech, and public-sector procurement.

Regulated product safety components (Annex I) — AI embedded in products already governed by sectoral EU law (medical devices, automotive, toys) — see their deadline extended from August 2, 2027 to August 2, 2028.

Transparency obligations under Article 50 — the disclosure requirements for chatbots, emotion recognition systems, and deepfake labelling — remain at August 2, 2026. These deadlines are not moving. Companies deploying conversational AI or synthetic media tools in the EU must comply with these rules within weeks.

AI-generated intimate content: A new grandfathering rule defers watermarking requirements for generative AI to December 2, 2026, while the new prohibition on nudification applications (tools that generate sexually explicit imagery without consent) also takes effect December 2, 2026.

The SME Threshold Expansion: Who Now Qualifies

One of the most commercially significant changes in the Omnibus deal is the expansion of SME-equivalent protections beyond the traditional definition of small and medium enterprises.

Previously, the AI Act’s SME provisions applied to companies meeting the EU definition: fewer than 250 employees and either €50 million in revenue or a €43 million balance sheet total. The Latham & Watkins analysis of the Omnibus deal confirms that the new threshold extends protections to companies with up to 750 employees and €150 million in annual revenue — effectively creating a “small mid-cap” category that encompasses the vast majority of European and global AI startups.

The practical benefits of this expanded threshold include:

• Simplified compliance guidance materials from EU authorities
• Reduced fine structures for transparency and governance violations
• Access to regulatory sandboxes (including a new EU-level cross-border sandbox for high-risk AI testing)
• Standardised template documentation for technical files and conformity assessments

For AI companies in the 250–750 employee range — which captures most Series B to Series C stage AI startups globally — this is a material cost reduction. Enterprise-grade AI Act compliance was estimated by industry groups to cost €100,000 to €300,000 for initial implementation at a company of 300-400 employees; access to simplified templates and sandbox infrastructure reduces that figure substantially.

New Prohibitions: Nudification Apps and CSAM

While the Omnibus deal relaxes compliance timelines in several areas, it also introduces a new category of outright prohibition with severe penalties: applications designed to generate non-consensual intimate imagery (so-called “nudifier” apps) and child sexual abuse material (CSAM).

The ResultSense compliance analysis confirms that these tools must be removed from the EU market by December 2, 2026, with penalties reaching €35 million or 7% of worldwide annual turnover, whichever is higher. For context, a company with €500 million in global revenue faces a potential €35 million fine — roughly equivalent to the original Act’s maximum penalty for prohibited AI systems.

The Commission’s AI Office, which receives strengthened enforcement powers under the Omnibus deal, is specifically charged with overseeing compliance for these prohibitions. Companies operating generative image or video platforms — including general-purpose models that could be prompted to produce such content — need to audit their systems before December 2, 2026 and implement access controls, content filtering, and terms of service restrictions that demonstrably prevent prohibited use cases.

What Stayed the Same — and Why It Matters

It is important to be clear about what the Omnibus deal does not change, because the political messaging around the deal has been imprecise.

The prohibition categories that took effect in February 2025 — social scoring by governments, real-time remote biometric surveillance, manipulation through subliminal techniques — remain in force with no modifications. The August 2026 transparency obligations for chatbots and deepfakes are unchanged. GPAI (General Purpose AI) model obligations for providers of frontier models (those trained on more than 10^25 FLOPs) are unchanged.

The Omnibus deal also does not change the enforcement mechanism — member state national competent authorities retain primary enforcement responsibility for most AI Act provisions, with the Commission’s AI Office overseeing GPAI and cross-border cases. Companies that have invested in AI Act readiness for August 2026 have made a sound investment: that infrastructure will serve them for December 2027 compliance with minimal additional work.

What AI Vendors Should Do Between Now and December 2027

1. Rebuild Your Compliance Calendar Around the New Dates

The single most urgent action is to update your AI Act compliance project plan with the revised deadlines. August 2, 2026 remains a hard date for Article 50 transparency obligations — if your product includes a chatbot, emotion recognition feature, or generates synthetic media, those disclosure requirements apply this summer. Every other high-risk deadline has moved to December 2027 or later.

This distinction matters operationally: teams that have been treating all AI Act obligations as “August 2026” may be misallocating compliance resources toward high-risk technical file preparation when they should be prioritising transparency disclosures for customer-facing products. Resequence accordingly.

2. Verify Whether You Now Qualify for SME-Equivalent Treatment

If your company has fewer than 750 employees and less than €150 million in annual revenue, you now qualify for the expanded SME protections. This triggers eligibility for simplified documentation templates, reduced fine exposure, and regulatory sandbox access. Formal confirmation of eligibility will come through guidance from the EU AI Office — monitor the EU AI Act regulation tracking resources and register for sandbox programmes as they open.

Larger companies should also review whether subsidiaries or product-line entities meet the threshold — sandbox eligibility and simplified guidance can be valuable even when the parent company is out of scope.

3. Audit Generative AI Systems Against the Nudification Prohibition

The December 2, 2026 deadline for the nudification prohibition is the Omnibus deal’s only new hard deadline — and it applies to a broader universe of providers than might initially appear. Any company operating an image or video generation model that is capable of producing sexually explicit content (even if prohibited by terms of service) needs to conduct a technical audit of its systems and document the controls in place. The AI Office’s strengthened enforcement powers mean this is an area of active regulatory attention, not a paper requirement.

The Broader Context: What the Omnibus Deal Reveals

The May 7 agreement reflects a genuine tension within EU technology policy that the Omnibus deal does not resolve — it temporarily manages. European regulators face pressure from two directions: industry argues that strict AI deadlines disadvantage European companies relative to US and Chinese competitors operating in less regulated environments; civil society argues that the Omnibus deal’s deadline extensions leave AI-at-risk populations — job applicants, credit seekers, people subject to biometric surveillance — without protection for 16 more months.

The Omnibus deal’s formal adoption is targeted for July 2026, with the new obligations taking legal effect three days after publication in the Official Journal. The compliance calendar will then be fixed — and the industry will have had more than a year of advance notice before the December 2027 deadline. Companies that use this window to build durable AI governance infrastructure will be better positioned than those treating the extension as an invitation to delay.

Frequently Asked Questions

Sources & Further Reading

• Simpler, Safer, Stricter: Inside the EU AI Omnibus Deal — Dastra
• EU AI Act Omnibus Deadlines Extension — ResultSense
• AI Act Update: EU Resolves to Change Rules and Extend Deadlines — Latham & Watkins
• US Companies Face EU AI Act’s Possible August 2026 Compliance Deadline — Holland & Knight