Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
2026 FIFA World Cup
29MAR

AI Omnibus deal splits enforcement into two speeds

4 min read
14:01UTC

The Council of the EU and the European Parliament struck a provisional agreement on the Digital Omnibus on AI on Thursday 7 May 2026, moving the Annex III high-risk compliance deadline from 2 August 2026 to 2 December 2027 while leaving GPAI enforcement unchanged at 2 August 2026.

← Back to USA beaten 5-2 at World Cup host venueJump to analysis ↓
SportDeveloping
Key takeaway

GPAI providers face August 2026; European enterprise-AI deployments in the same verticals get until December 2027.

The Council of the EU and the European Parliament announced on Thursday 7 May 2026 that they had struck a provisional agreement on the Digital Omnibus on AI package, after the first trilogue collapsed on Tuesday 28 April over a clash with machinery regulation⁠1. The deal postpones the EU AI Act's Annex III compliance deadline (covering high-risk AI used in justice, employment, education and similar regulated domains) from 2 August 2026 to 2 December 2027, and pushes the Annex I embedded-product deadline (high-risk AI inside machinery, toys and medical devices) to 2 August 2028. general-purpose AI (GPAI, the regulatory category covering foundation models such as ChatGPT, Claude and Gemini) enforcement on 2 August 2026 is unchanged.

The deal landed two days after Mistral AI CEO Arthur Mensch added his name to the seven-chief-executive open letter to Commission President Ursula von der Leyen asking for AI rule simplification. The text agreed on 7 May reads closer to the industry letter's request than to the Commission's January draft. OpenAI, Anthropic and Google face the original GPAI activation date with a fine ceiling of 3 per cent of global turnover, alongside a new Article 5 prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material taking effect on 2 December 2026. Mistral AI and the merged Cohere-Aleph Alpha entity receive 16 extra months on the high-risk verticals where CAIDA will reserve EU public-sector procurement for European providers.

The AI Office gains supervisory authority over GPAI deployed inside very large online platforms (VLOPs) and very large search engines (VLSEs), an enforcement surface that did not exist in the original AI Act text. SME relief was extended to firms under 750 employees, or with annual turnover under €150m, or balance sheet under €129m, folding most European AI deployers below mandatory compliance. Aura Salla MEP, the rapporteur who chaired the collapsed 28 April trilogue and co-negotiated the 7 May deal, has not made a public statement on either outcome since her Sovereign Tech Europe panel appearance on 23 April. The procedural sequence of CEO letter, trilogue collapse, and reopened deal on more permissive terms reads as a textbook industry-engagement cycle inside a file that names sovereignty as its purpose.

Deep Analysis

In plain English

The EU AI Act classifies AI systems by risk. High-risk ones; like AI used to decide who gets a job, a loan, or access to critical services; face the strictest rules. The original deadline for these rules to apply was August 2026. The new deal pushes that to December 2027 for most businesses. But there is a catch: companies that build and sell the underlying AI models (like OpenAI's GPT or Google's Gemini) still face the original August 2026 deadline. The extra time is for companies that use those models in products, not for the model builders themselves. The idea is to give European businesses breathing room while keeping pressure on the big US AI companies.

Deep Analysis
Root Causes

The Annex III categories; AI in employment decisions, credit scoring, and critical infrastructure; require conformity assessments under harmonised standards that had not been published by the relevant standards bodies by the time the August 2026 deadline was set.

The European Standardisation Organisations, CEN and CENELEC, published only draft standards by Q1 2026. Without harmonised standards, enterprises cannot complete required assessments, making the original deadline structurally unenforceable regardless of political intent.

The GPAI enforcement date was kept at August 2026 because the AI Office's Code of Practice process was already in progress with named providers, and delaying it would have required reopening the Code of Practice procedure and restarting provider engagement. The Code of Practice's existing provider engagement made reopening the GPAI deadline impractical; the Annex III extension was where the political room existed.

What could happen next?
  • Consequence

    US GPAI providers — OpenAI, Google DeepMind, Anthropic — face AI Office scrutiny from 2 August 2026 while their European enterprise customers building on those models get until December 2027, creating a compliance gap that may increase US provider market leverage.

    Immediate · 0.8
  • Risk

    Aura Salla's contested appointment as rapporteur (flagged by seven NGOs including Corporate Europe Observatory) creates a procedural challenge risk: if the European Ombudsman finds a conflict of interest, the Omnibus provisional agreement could be reopened in Parliament.

    Short term · 0.35
  • Opportunity

    The AI Office's new supervisory authority over GPAI deployed inside very large online platforms and very large search engines (VLOPs and VLSEs) gives Brussels a new enforcement surface that did not exist in the original AI Act text.

    Immediate · 0.85
Sources:European Council·Document Foundation
Mentions:Ursula von der Leyen →Arthur Mensch →Cohere →ChatGPT →NIS2 →Gemini →Digital Omnibus →Parliament →Article 2 of the US Constitution →Cloud and AI Development Act →Council of the European Union →European Parliament →EU AI Act →Annex III →AI Office →Aura Salla →OpenAI →Anthropic →Google →Meta →Aleph Alpha →EU Observer →Corporate Europe Observatory →GDPR →GPAI →Mistral AI →Sovereign Tech Europe →AI Omnibus →New York →
First Reported In

Update #5 · Brussels' 27 May package, two days before G7

European Council· 17 May 2026
Read original →
Causes and effects
Caused by
Seven CEOs ask Brussels for less
The seven-CEO letter (ID:3070) co-signed by Mensch on 5 May preceded the 7 May AI Omnibus deal, which landed on terms closer to industry's request than to the Commission's January draft.
Occurred 5 May 2026
Read story →
This Event
AI Omnibus deal splits enforcement into two speeds
The deal creates an enforcement asymmetry that gives European enterprise-AI deployments 16 extra months in the same verticals CAIDA targets for European providers.
Led to
Mistral buys into the industrial stack
The AI Omnibus two-speed enforcement deal (ID:3370) gave Mistral the Annex III breathing room that enabled the M&A pivot.
Occurred 19 May 2026
Read story →
Omnibus widens the AI Office's reach
The Omnibus's extended high-risk deadlines are the ones negotiated in the May Omnibus deal reported previously.
Occurred 27 Jul 2026
Read story →
Different Perspectives
Council on Foreign Relations
Council on Foreign Relations
CFR's analysis identified 18.75% of the 48-team field facing access barriers — the only available quantification after the State Department admitted it has none. The explicit contrast with South Africa 2010's visa waiver for all ticket holders positions the US as a regressive host by historical standards.
New York commuters / Assemblyman Bhalla
New York commuters / Assemblyman Bhalla
Bhalla framed Penn Station's closures as a class issue: 'For the 99 percent that can't afford to attend the games, it would be nice to at least know how you're going to get home from work.' Eight closures lock 650,000 daily commuters out for tournament traffic, with one on a Monday rush hour.
French Football Federation
French Football Federation
The FFF called an 11:00 CEST press conference for 28 July, at its Paris headquarters, following an extraordinary executive committee meeting, at which Zinedine Zidane is expected to be presented as head coach succeeding Didier Deschamps. As of this writing no communique confirms the appointment, contract length or start date.
Morocco
Morocco
Morocco is pushing for the 2030 final at its Grand Stade Hassan II in Casablanca, a planned 115,000-seat venue that would be the world's largest football stadium on completion. The venue is contested by a Spanish petition for the Santiago Bernabeu, and FIFA has fixed neither the venue nor the tournament's proposed 64-team format.
FIFA
FIFA
FIFA's first tournament report, published 27 July, itemises nearly 300,000 accredited personnel, 73,700 security staff and 300,000 square metres of custom-grown turf, with no revenue or cost figure attached. As a Swiss association answering to its own Congress rather than a treasury, FIFA has followed the same operational-before-financial sequence it used after Qatar 2022.
Javier Tebas / La Liga
Javier Tebas / La Liga
La Liga president Javier Tebas said on 21 July that FIFA's system is rotten from the root and that Gianni Infantino's time as president has, in his words, concluded. Tebas has no vote in FIFA's process, so days after the IOC declined jurisdiction over a separate ethics complaint, he used the only instrument he has.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.