With Parliament and Council both having approved their respective mandates, trilogue negotiations for the AI Omnibus proposal will begin very soon (as early as this week).
This is a good moment to take stock of the current situation: looking at the two texts, one can already get a clear sense of where things are headed and whether we are in for smooth sailing.
Two caveats first. The Omnibus amends the AI Act, but the so-called “data Omnibus” — which amends the GDPR, Data Act, DGA, and related legislation — is a separate file with its own timeline and different actors (AI falls under IMCO-LIBE in Parliament; the data package under ITRE-LIBE). It also faces fewer time constraints than the AI one: the AI Act has the looming application date of 2 August to contend with, while the other instruments do not. The data Omnibus is therefore likely to take longer.
Second caveat: while nothing is ever certain in a trilogue — especially one of this complexity and political visibility — it is fair to say there is a roughly 95% chance the timeline will be respected. If the trilogues proceed quickly and smoothly, the AI Omnibus can still complete all required procedural steps to enter into force on 1 August, just ahead of the 2 August deadline it is designed to supersede.
A quick look at the two positions suggests the trilogues will indeed be swift. For context, the AI Act trilogue lasted “only” six months — for a file of considerable complexity. This one is much smaller in scope, and the two positions share many similarities; with the AI Act, there were far more substantial divergences between the co-legislators.
Below (and in part 2 of this article) is a breakdown of the points most likely to make it into the final text, followed by a brief discussion of the trickier ones that may face stronger opposition or not survive at all. A useful general rule of thumb for trilogues: when in doubt, the Council position tends to prevail, Parliament can often only make small adjustments to it.
Green spots 🟢mean smooth sailing (identical or quasi-identical) positions, yellow ones 🟡 are trickier and need at least a bit of technical discussion, red ones 🔴are political and will be the hardest to sort out, likely in a political trilogue (hopefully shorter than the one of 6 December 2023). Spoiler: this time, we will mostly have greens and yellows, possibly as little as one red point (see part 2 for this).
Timeline 🟢
The future dates of application are now clear: 2 December 2027 for Annex III systems and 2 August for Annex I.
As a reminder, any system already on the market before these dates will only need to comply if it has undergone substantial changes after those dates — meaning changes that were not predetermined by the provider and do not constitute a software update or security patch.
One notable addition🟡: a well-crafted Parliament amendment was taken on board — Article 6(5) will not have to wait for the dates above, but will apply immediately from August 2026. This is the paragraph mandating guidelines by the European Commission. It sends a clear signal that these guidelines — which were supposed to be published in February — have not been forgotten, and that the expectation is for them to come out as soon as possible. I do not expect this to be controversial; it should be a straightforward point for the Council as well.
The Council’s position specifies that the new bans (see part 2) will not apply immediately, but from February 2027 🟡. This will undoubtedly be somewhat contentious. Even though the ban cannot be retroactive (the rest of the bans started applying in February 2025), it is difficult to explain to the public why the proliferation of NCII and CSAM would not be blocked for another year. The Parliament, by contrast, proposes no specific date, which means it favours application as soon as the Omnibus enters into force — i.e. 1 August.
A special note on Article 50 🟡 (transparency of AI-generated content): this provision still applies from 2 August for new systems.
What changes is that systems already on the market before that date — essentially all of those currently available, from chatbots to deepfake generators — will have additional time to come into compliance. Here we see the first clear divergence between Parliament and Council: Parliament proposes three additional months (November 2026), while the Council, in line with the Commission, proposes six months (February 2027).
AI Literacy 🟡
The Omnibus proposal downgrades AI literacy from a hard obligation — as originally set out in the AI Act — to a soft obligation on the Commission and Member States to encourage it. Parliament and Council diverge here. Parliament stays closer to the original obligation, proposing to “support the improvement” of AI literacy (rather than “ensure” it) among providers’ and deployers’ staff, while clarifying that this does not guarantee a specific literacy level. The Council stays closer to the Commission’s proposal, placing the obligation on the Commission and Member States — though it maintains that providers and deployers of high-risk AI systems retain their respective literacy obligations under Articles 17 and 26. Both co-legislators call for additional supporting measures, including guidelines, public-private partnerships, and specific frameworks. The Council may have the upper hand here, and Parliament may only be able to push through select elements of its own proposal.
SMEs privileges extended to Small Mid-Caps 🟢
Both Council and Parliament retain the Commission’s extension of SME facilitations to small mid-caps, so this should sail through to the finish line smoothly, with a few adjustments — notably on fines and regulatory sandboxes.
Article 4a - processing sensitive personal data 🟢
The two texts of the new Article 4a — on the possibility of processing sensitive personal data for bias detection and correction — are identical (as was predictable; see my previous piece). Processing will be permitted, but only where strictly necessary, and the provision has been extended to all providers and deployers. It is also clarified that this is a possibility, not an obligation: you may, if strictly necessary, but you are not required to (and arguably should not by default).
Interestingly, the Council adds examples in Recital 6 of when this need might arise for non-high-risk AI applications: biases in eligibility or risk-scoring tools used to assess applications for public permits or licences, and biased AI-enabled fitness or wellness applications that do not constitute medical devices and may provide skewed guidance with potential health implications. The Council also clarifies — though this was arguably already implied by the article’s placement in Chapter I — that this provision will apply from the outset, as soon as the Omnibus enters into force (three days after publication in the Official Journal, potentially as early as late July).
Article 6 — Registration 🟢
AI systems that operate in a high-risk use case listed in Annex III but fulfil one of the four conditions in Article 6(3) — and do not perform profiling — will still be required to register in a dedicated section of the EU database. Both Parliament and Council rejected — in identical terms — the Commission’s attempt to eliminate this relatively minor obligation (the Commission’s own characterisation) for companies otherwise exempt from the AI Act altogether.
The only change is that at the point of registration, companies will no longer need to provide information on the status of the system or submit a scanned copy of any certificate issued by a notified body. This simplification could arguably have gone a step further, but it is notable that both co-legislators agree on the need for market surveillance authorities to maintain visibility over such systems, in order to prevent circumvention.
The rest in part 2, stay tuned!
Thanks Laura, I have a question - Does a provider who has self-assessed their Annex III system as not high-risk under Article 6(3) have an obligation to register that system in the EU database under Article 49(2) by 2 August 2026 — and does the Digital Omnibus delay mechanism affect that obligation at all?