22SEP

Omnibus widens the AI Office's reach

2 min read

10:47UTC

The AI Omnibus entered into force on 27 July, pulling AI behaviour embedded inside large platforms and search engines under the same Brussels supervisor as the model underneath it.

← Back to Germany's AI champion merges into Cohere Jump to analysis ↓

TechnologyDeveloping

Key takeaway

One Brussels desk now supervises both the model and the platform feature built on top of it.

The AI Omnibus entered into force on 27 July, extending the AI Office, the Commission's supervisor for general-purpose models, to systems built on those models inside large platforms and search engines ¹. Reach changed rather than dates. A chatbot feature bolted into a search product and the model answering behind it now sit with one supervisor instead of two.

The high-risk timelines the Omnibus carries are the ones negotiated in the May deal we reported at the time : 2 December 2027 for the Annex III list of high-risk uses, and 2 August 2028 for high-risk AI embedded in regulated physical products. Neither change touches Article 101 or the general-purpose dates in Article 113 of the EU AI Act, so the penalty clock that started on 2 August runs on its own schedule. For a platform operator the practical consequence lands in correspondence rather than in court: questions about a deployed feature and questions about the model behind it now go to the same desk in Brussels.

Deep Analysis

In plain English

A new EU law called the AI Omnibus took effect on 27 July. It means that if a big platform or search engine has an AI feature built using someone else's AI model, both the platform and the model's original maker now answer to the same regulator, the AI Office. Before this, a platform could potentially argue its AI feature was a separate product from the underlying model. The change does not move any of the fining dates that were already set, it just widens who the rules clearly apply to.

Deep Analysis

Root Causes

Before 27 July, a platform operator could argue its consumer-facing AI features fell outside the underlying model's own AI Act obligations, since Article 101 addresses model providers, not the products built on their output; the Omnibus closes that gap by extending AI Office jurisdiction to the embedding layer itself.

Leaving Article 113's GPAI dates untouched signals the political fix targeted supervisory scope, not enforcement timing, avoiding reopening the deadline negotiation already settled in May's Digital Omnibus deal , which moved Annex III high-risk dates but left GPAI enforcement fixed at 2 August.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: GDPR's 2018 extraterritorial scope rule pulled any platform processing EU users' data under one regulator regardless of where its underlying processing engine sat, the same structural move the Omnibus now makes for AI: regulate by where the effect lands, not where the model lives.

Counter-parallel: The Digital Services Act instead split enforcement by platform size, leaving very large platforms to the Commission and everyone else to national Digital Services Coordinators; the Omnibus rejected that tiered model in favour of a single regulator for all embedded GPAI.

Consensus view: The AI Office's own GPAI Signatory Taskforce, meeting for the fourth time on 17 July, has been treating the platform-embedding question as a boundary exercise: separating a model's own transparency duties from the behaviour of the consumer product built on top of it.

Counter-view: No named critic's assessment of the platform-embedding extension was found in the sourced record; the silence from consumer-platform operators is itself notable given the Google DMA fine landed only four days before the Omnibus took effect.

Key tension: Whether an 'embedded' general-purpose AI system inside a platform triggers the platform operator's own compliance duties, or only the underlying model provider's, the Omnibus text leaves that boundary for future AI Office guidance to draw.

Sources:GOV.UK, Cabinet Office and business department·GOV.UK, Cabinet Office and business department

Mentions:AI Omnibus →European Commission →AI Office →EU AI Act →Brussels →Google →Annex III →Digital Services Act →GDPR →GPAI →

First Reported In

Update #14 · AI Act fines arrive, three states list no regulator

GOV.UK, Cabinet Office and business department· 4 Aug 2026

Read original →

Causes and effects

Caused by

AI Omnibus deal splits enforcement into two speeds

The Omnibus's extended high-risk deadlines are the ones negotiated in the May Omnibus deal reported previously.

Occurred 7 May 2026

Read story →

This Event

Omnibus widens the AI Office's reach

Consumer-facing AI features and the model powering them now answer to one regulator, which removes the gap a platform could otherwise argue sits between the two.

Different Perspectives

ESMC (TSMC-majority joint venture)

ESMC's president said construction remains on schedule after the Dresden fab's topping-out ceremony on 14 September, reported by Focus Taiwan with first process equipment still targeted for the second half of 2027. No first-party ESMC or TSMC statement independently confirms the claim, and the fab remains 70% TSMC-owned inside a project Europe cites as its semiconductor sovereignty case.

Civo

Civo sold out its Navigate London sovereignty conference on 22 September, drawing about 800 attendees including a sitting MP, a former defence procurement minister and sponsors led by Nokia. Companies House confirms chief executive Mark Boost as Civo's sole person with significant control, British and UK-resident, which answers the ownership question the conference itself is arguing matters.

United States Trade Representative

USTR opened its 2027 National Trade Estimate comment window on 14 September, naming the EU among markets with restrictive technology requirements and inviting submissions on cross-border data rules. The window follows Trump's 24 July Section 301 order into EU digital rules by seven weeks, and unused comments are kept, in USTR's own wording, for future negotiations.

Cohere

Cohere published the deal on 16 September without naming a regulator, running the merged company globally under its own brand from dual Toronto and Berlin headquarters. It pledges the combined company will deliver sovereign AI on STACKIT, the Schwarz Group's German platform, aimed at government buyers weighing that offer against Berlin's own anchor-customer signal.

Germany (Federal Government)

Digital Minister Karsten Wildberger called the Cohere talks "a very strong signal" and signalled Berlin's readiness to become an anchor customer, now its main lever since equity sits with Cohere. The German side secured a co-headquarters and two Cohere C-suite seats, but the protective-rights terms it pressed for in July remain undisclosed.

Poland

Poland leads a self-announced AI Gigafactory consortium with a EUR 100 million phase-one commitment, matched by Czechia and joined by Hungary at EUR 25 million. EuroHPC has confirmed no consortium for the call closing 12 November, so the bloc exists only in national announcements so far.