EU policymakers finalized the Digital Omnibus on AI, with the European Parliament endorsing it on June 16 and the Council giving final green light on June 29, 2026, deferring high-risk obligations for standalone Annex III systems to December 2, 2027 and for AI embedded in regulated products under Annex I to August 2, 2028.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source The package also extended watermarking transparency to December 2, 2026, narrowed the definition of a high-risk safety component, and added an Article 5 prohibition on AI that generates non-consensual intimate imagery and child sexual abuse material.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source 3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source Why it matters: the EU moved its own flagship deadline under competitiveness pressure and conceded, in effect, that the standards and guidance needed to make the rules operable were not ready.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source We assess, with moderate confidence, that the delay preserves the AI Act's substance while weakening the deterrent force of the Brussels effect, because a regulator that reopens its own timeline signals that its deadlines are negotiable.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source

The drivers

The formal votes in June were the end of a longer retreat. The Commission published the Digital Omnibus on November 19, 2025; a first round of trilogue talks on April 28 failed; the institutions reached a provisional political agreement on May 6, confirmed by Council representatives on May 13, before Parliament and Council ratified it in June.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source 2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source The core change is time: high-risk obligations that were due August 2, 2026 now fall in December 2027, and product-embedded obligations move to August 2028.2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source

The stated reason is telling. The deferral acknowledges that the regulatory infrastructure needed to make the obligations operable, harmonised standards and Commission guidance, had not materialized on schedule, and crucially the new dates apply regardless of whether those standards and guidance are ready by then.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source Alongside the delay, the package simplified: a narrower safety-component definition so that AI used solely for convenience, optimization, or quality control is no longer automatically high-risk, a Commission power to waive AI Act requirements where sectoral laws already impose equivalent obligations, and a softened AI literacy duty.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source 2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source Not everything loosened: the Omnibus added a new Article 5 prohibition on nudifiers and CSAM, with a safe harbour for systems that carry effective preventive safeguards.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source

Second order effects and the ledger

The immediate winners are providers of high-risk AI systems, who gain 16 additional months for standalone systems and 12 for product-embedded ones, plus a narrower classification that pulls convenience and quality-control uses out of the high-risk bucket entirely.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source Small and mid-cap companies gain access to simplified compliance pathways previously reserved for smaller firms.2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source European industry, which pressed the competitiveness argument, gains room to breathe against US and Chinese rivals operating under lighter regimes.

The losers are less visible but real. Civil society and rights advocates lose the near-term force of high-risk protections for biometrics, critical infrastructure, employment screening, and public-sector uses, all of which shift into 2027 and 2028.2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source The EU's own regulatory credibility takes a cost: the Brussels effect, the mechanism by which EU rules become de facto global standards because firms comply everywhere rather than maintain two systems, depends on the deadlines being fixed points. A deadline that moves once can move again, and the source material is explicit that a second postponement would carry institutional credibility stakes.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source The gain for potential victims of AI-generated intimate imagery is the clearest countercurrent, since that prohibition took effect rather than deferring.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source

The counter-case

The assessment that the delay weakens the Brussels effect could be wrong if the substance is what travels, not the timing. The AI Act's prohibitions, its general-purpose model obligations, and its high-risk framework all remain in force on the books; only the compliance dates moved, and the Omnibus even added a new prohibition.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source 3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source On this reading, global firms will still build to the EU standard because the standard itself is intact, and a one-time schedule adjustment during a bumpy rollout is normal legislative housekeeping rather than a retreat. For the weakening thesis to fail, the December 2027 and August 2028 dates would need to hold firm and firms would need to keep treating EU rules as the global baseline; the practical risk is that once a regulator shows its timeline is adjustable under industry pressure, compliance planning treats future EU deadlines as soft.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source

What to watch

  • The December 2027 date holds. If the Annex III deadline arrives without a further postponement, the Brussels effect survives the wobble; any move to defer again before then would confirm the timeline is negotiable.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source
  • Harmonised standards actually ship. Because the deadlines now apply whether or not standards are ready, watch whether the Commission publishes the missing standards and guidance well before December 2027; continued absence would set up pressure for another delay.3 VerifyWise 2026-06-20 The deferred deadlines apply regardless of whether harmonised standards and guidance are ready, the delay acknowledges regulatory infrastructure that did not materialise, and a second postponement would carry institutional credibility stakes. Open source
  • The watermarking deadline lands. The December 2, 2026 transparency requirement for AI-generated content is the nearest test of whether the new dates are treated as firm; slippage there would be an early warning.1 Gibson Dunn 2026-06-30 Annex III high-risk obligations deferred to December 2 2027 and Annex I to August 2 2028, watermarking extended four months, safety-component definition narrowed, and a new Article 5 prohibition on nudifiers and CSAM added. Open source
  • Global firms hold to the EU baseline. If major AI providers continue building to EU high-risk requirements ahead of the deferred dates rather than pausing, the substance-travels reading is correct; visible pullback would confirm the deterrent softened.2 Travers Smith 2026-05-08 May 7 2026 agreement postpones Annex III to December 2 2027 and Annex I to August 2 2028, reduces regulatory overlap, and extends simplified pathways to small and mid-cap companies, pending Council and Parliament approval. Open source