EU AI Act Digital Omnibus (Proposal November 2025)
TL;DR
- European Commission proposed the Digital Omnibus on November 19, 2025 — Status [VOLATILE]: trilogue ongoing, NOT yet adopted (as of May 2, 2026)
- Proposed Annex III (HR, recruiting, education, law enforcement): postponement from Aug 2, 2026 to Dec 2, 2027 — until adoption, Aug 2, 2026 remains legally binding
- Proposed Annex I (regulated products): postponement to Aug 2, 2028
- Unchanged: Art. 4 (AI literacy), Art. 5 (prohibitions), GPAI obligations, Art. 50 transparency
- Practical consequence: Until trilogue adoption, no postponement — align preparation to Aug 2, 2026
1. What happened
On November 19, 2025, the European Commission presented the Digital Omnibus proposal. Part of the EU's "Competitiveness Package," it also adjusts the Digital Services Act, Digital Markets Act, and Cyber Resilience Act. Status as of May 2, 2026: the proposal is in the ordinary legislative procedure (trilogue between Commission, Parliament, and Council); final adoption is still pending. The AI Act portion would — if adopted — postpone high-risk application dates without changing the substantive obligations. Until adoption, Aug 2, 2026 remains the legally binding deadline.
2. What would be postponed (proposal, not adopted)
| Area | Current deadline | Proposed |
|---|---|---|
| Annex III high-risk AI (HR, recruitment, education, law enforcement, migration) | 02 August 2026 (legally binding) | 02 December 2027 |
| Annex I high-risk AI in regulated products (machinery, medical devices, lifts) | 02 August 2027 | 02 August 2028 |
| Conformity-assessment procedure (Art. 43) | aligned with Annex III | aligned with proposed Annex III |
| EU database registration (Art. 49) | aligned with Annex III | aligned with proposed Annex III |
| Post-market monitoring (Art. 72) | aligned with Annex III | aligned with proposed Annex III |
3. What stays unchanged
- Art. 4 (AI literacy): in force since Feb 2, 2025 — no change
- Art. 5 (prohibited practices): in force since Feb 2, 2025 — fines up to 35M EUR / 7%
- Art. 27 (FRIA for public bodies, credit scoring, life/health insurance): Aug 2, 2026 deadline unchanged
- GPAI obligations (Art. 53-55): in force since Aug 2, 2025 — no change
- Code of Practice for GPAI (final July 10, 2025): unchanged
- Art. 50 transparency, watermarking, deepfake disclosure: Aug 2, 2026 deadline unchanged
4. Practical impact
| Stakeholder | Impact |
|---|---|
| HR recruiting tool providers | Conformity assessment required by 02 August 2026 (postponement to 11/2027 only on trilogue adoption) — AGG Section 22 burden-of-proof reversal applies regardless, already in force |
| Machinery manufacturers with AI components | Annex I deadline 02 August 2027 (proposal: postponement to 08/2028 — not adopted) |
| Universities and educational institutions | Annex III covers AI assessment tools for students — 02 August 2026 deadline applies |
| Banks and insurers | Credit scoring / premium scoring stays at 08/2026 (FRIA obligation); Annex III obligations possibly postponed |
| SMEs as deployers | AI Literacy mandatory since 02/2025 — training pressure unchanged |
02 August 2026 remains binding while the trilogue is ongoing. Use the time to finalise technical documentation under Annex IV, the risk-management system, and FRIA templates. The EU AI Act Kit provides 58 templates from the AI inventory through to the declaration of conformity.
5. Criticism and political context
The proposed postponement is controversial. Pro: EU competitiveness against the US and China; industry preparation time; standards maturity. Contra: civil-rights erosion (discrimination in HR and law enforcement would remain under-regulated for 16 months); signaling effect for other EU regulations; unequal treatment between early adopters and laggards. EDRi and other civil-rights organizations have published opposing positions; whether the trilogue will adopt the proposal is open as of May 2, 2026.
Summary
The Digital Omnibus is a Commission proposal as of Nov 19, 2025. If adopted, it would shift deadlines but not the substantive obligations. AI Literacy, Art. 5, GPAI, FRIA for public bodies / credit / life-health insurance, and Art. 50 stay on the original timetables. Build a defensible compliance package on the Aug 2, 2026 timeline — do not bet on a postponement that has not been adopted.
Frequently Asked Questions
What did the EU Commission propose on 19.11.2025?
Which obligations remain unchanged?
Why is the Commission proposing the postponement?
Does a potential postponement mean less compliance effort?
Sources
- European Commission — Digital Omnibus (proposal, 19 Nov 2025) (As of: 2026-05-02)
- Commission proposal text (GDPR Omnibus PDF) (As of: 2026-05-02)
- Regulation (EU) 2024/1689 — EU AI Act (current legal baseline) (As of: 2026-05-02)