From the journal

EU lawmakers reach political agreement to delay AI Act high-risk obligations

On 7 May 2026 the Council of the EU and the European Parliament reached political agreement on the Digital Omnibus on AI. Annex III high-risk obligations are pushed to 2 December 2027. The Article 50 transparency grace period for AI-generated content shrinks to three months ending 2 December 2026. Member states have until 2 August 2027 to set up regulatory sandboxes.

3 min read

On 7 May 2026 the Council presidency and the European Parliament reached political agreement on the Digital Omnibus amending Regulation (EU) 2024/1689, the AI Act. The deal remains provisional. Co-legislators have stated they intend to adopt the agreed text before 2 August 2026. The amending regulation will enter into force on the twentieth day following publication in the Official Journal.

The agreement defers application of Annex III high-risk obligations until 2 December 2027. Annex III covers AI systems used in employment, education, access to essential public and private services, law enforcement, migration and the administration of justice. Article 50 transparency duties on AI-generated and AI-manipulated content now have a three-month grace period ending 2 December 2026. Article 57 requires each member state to operate at least one AI regulatory sandbox by 2 August 2027. Simplified technical documentation under Annex IV extends to small mid-cap companies of up to 500 employees.

Providers of general-purpose AI models, deployers in HR and credit scoring, and operators of biometric identification systems gain time to align internal controls. Recruitment platforms, edtech vendors, insurers using algorithmic underwriting and large language model integrators must still meet the December 2026 transparency cut-off when their outputs reach natural persons. Banks and crypto-asset service providers that deploy AI in fraud detection should plan documentation under the lighter SMC regime where headcount permits.

The deal has not yet been published as a consolidated text. The European Data Protection Supervisor and several civil society bodies have raised concerns about the impact on fundamental rights protections. The interaction between the deferred Annex III timeline and the Machinery Regulation timetable remains under review. National competent authorities still face the original deadlines for governance and notification structures pending formal adoption.

We advise on EU AI Act readiness, gap assessments and provider/deployer classification, and we maintain a partner network for cross-border filings. Contact us if you need help mapping obligations to your product. Work we undertake includes risk classification, conformity assessment preparation, transparency disclosure drafting, post-market monitoring design, GPAI provider obligations, and AI governance committee setup.

Source: Council of the European Union, press release Artificial intelligence: Council and Parliament agree to simplify and streamline rules, 7 May 2026, https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/. Date confirmed: 8 May 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.

AI Regulatory

More from the journal

See all
Illia Prokopiev

MLR Registration and the FCA Cryptoasset Gateway to 25 October 2027

This matter concerns the transition of a United Kingdom cryptoasset business from FCA registration under the Money Laundering Regulations 2017 to Part 4A permission under the Financial Services and Markets Act 2000. The question is whether MLR registration gives conversion, grandfathering, priority, or a right to continue after 25 October 2027, and what an affected firm should do before the gateway closes. This analysis assumes an existing UK-facing cryptoasset business, no relevant Part 4A permission, and an intention to continue after commencement.

Illia Prokopiev

Matched-Category Analysis of the Hong Kong Stablecoin Issuer Route and the Singapore Digital Payment Token Service Route

This matter concerns whether current licensing data supports a commercial comparison between Hong Kong’s stablecoin issuer route and Singapore’s digital payment token service route. The question is whether the proposition remains legally accurate as of 12 August 2026. “Commercially useful” is assumed to mean useful for selecting a market-entry and operating model, not proof that either regulator is more permissive.

Illia Prokopiev

ESMA's 2026 Custody Resilience CSA and the Rules That Actually Bind

ESMA’s 2026 Common Supervisory Action is a coordinated national review of digital operational resilience in crypto-asset custody. It will test whether selected crypto-asset service providers can demonstrate effective controls across six announced workstreams. The legal questions are which requirements are binding, how national competent authorities may assess control effectiveness, and what consequences may follow from a deficiency. This analysis assumes that the firm is permitted under MiCA Article 59 to provide custody and administration within Article 3(1)(17).