EU Digital Omnibus proposes delay of AI compliance deadlines

The article explains that the European Commission has put forward two proposals, the Digital Omnibus Regulation and the Digital Omnibus on AI Regulation. They would alter rules on AI governance, data protection, cyber incident reporting and cookies. The article says the aim is to simplify the European digital rulebook while keeping protections for users, and describes the changes as a restructured rollout rather than a weaker AI Act.

The central proposal concerns the AI Act's high-risk requirements. The original schedule had these obligations arriving in stages by August 2, 2026, and being fully enforced by August 2, 2027. The article says supporting infrastructure is not ready: harmonized standards, common specifications and conformity tools are missing, and many member states lack working supervisory authorities. The proposal therefore ties enforcement to the availability of standards and guidance, gives longer windows to high-risk systems under Article 6(1) and Annex I, and pushes machine-readable marking of AI-generated content for existing systems to February 2027. It also eases duties for small firms and small mid-caps, drops the staff AI literacy duty for providers and deployers, and would allow legitimate interest as a basis for training AI models under conditions. The article calls the combined effect a de facto one-year delay.

Other changes include one entry point for incident reports, a 96-hour breach deadline instead of 72, cookie rules moved into the GDPR with one-click refusal, and one EU-wide impact assessment list in place of 27 national ones.

The proposals still need approval from the European Council, Parliament and Commission, so the final text could differ. Should standards be late, backstop dates apply, namely December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems.