On 19 November 2025 the European Commission tabled a legislative proposal — COM(2025) 836, procedure 2025/0359(COD) — to amend Regulation (EU) 2024/1689 (the EU AI Act) and Regulation (EU) 2018/1139. It is known as the Digital Omnibus on AI. On 13 March 2026 the Council of the EU adopted its negotiating mandate under the Cypriot Presidency. On 18 March 2026 the European Parliament's IMCO and LIBE committees adopted their joint report A10-0073/2026 by 101 votes in favour, 9 against, 8 abstentions. On 26 March 2026 the Parliament adopted its position in plenary with 569 votes in favour, 45 against, 23 abstentions. Interinstitutional negotiations — the trilogue — are now under way. The Cypriot Presidency has stated its objective of reaching a final agreement before 2 August 2026, the AI Act's general application date.

For a NYC company reading the regulation as it actually stands in April 2026, the Digital Omnibus is the single most consequential change since the AI Act entered into force. This note walks through what is on the table, what the three institutions agree and disagree on, and what compliance action a NYC company should take now — given that the Omnibus is a proposal, not yet law, and trilogue outcomes cannot be assumed.

What the Commission proposed on 19 November 2025

The Commission's Explanatory Memorandum to COM(2025) 836 identifies the rationale explicitly: "consultations reveal implementation challenges that could jeopardise the effective entry into application of key provisions of the AI Act. These include delays in designating national competent authorities and conformity assessment bodies, as well as a lack of harmonised standards for the AI Act's high-risk requirements, guidance, and compliance tools." The Commission estimates the proposal would generate administrative burden reductions of approximately €297.2 to €433.2 million.

The Omnibus introduces targeted amendments in seven primary areas:

1. High-risk AI application date tied to standards availability (Recital 22). The Commission proposes amending Article 113 so that Chapter III high-risk obligations enter into application only after the Commission confirms, by decision, that compliance support measures are available — harmonised standards, common specifications, Commission guidelines. Six months after such confirmation for Annex III AI systems, twelve months for Annex I. With absolute backstop dates: 2 December 2027 for Annex III (stand-alone high-risk AI systems), 2 August 2028 for Annex I (AI systems embedded in regulated products).

2. Article 4 AI literacy transformed (Recital 5). The Commission proposes replacing the current direct obligation on providers and deployers to ensure staff AI literacy with a duty on Member States and the Commission to "foster" AI literacy through training opportunities, informational resources, exchange of good practices, and non-legally binding initiatives. Training obligations specifically for high-risk AI deployers under Article 26 remain.

3. SME and small mid-cap enterprise (SMC) extensions (Recital 4). The Commission proposes introducing a legal definition for small mid-cap enterprises (SMCs) — aligned with Commission Recommendation 2025/1099 — and extending regulatory privileges currently granted to SMEs under the AI Act to SMCs: simplified technical documentation, simplified quality management system, proportionate consideration in the application of penalties under Article 99.

4. Bias detection and correction legal basis (Recital 6). The Commission proposes a new Article 4a replacing Article 10(5), providing a legal basis for providers and deployers of AI systems and AI models — not only of high-risk systems — to exceptionally process special categories of personal data under GDPR Article 9(1), where necessary for bias detection and correction, subject to appropriate safeguards.

5. AI Office centralised supervision (Recital 14–18). The Commission proposes amending Article 75 to extend the AI Office's exclusive supervisory competence to AI systems based on general-purpose AI models where the model and the system come from the same provider, as well as to AI systems embedded in very large online platforms (VLOPs) and very large online search engines (VLOSEs) under Regulation (EU) 2022/2065 (Digital Services Act). Sectoral authorities retain competence for AI systems related to products covered by Annex I harmonisation legislation.

6. Registration relief under Article 6(3) (Recital 9). The Commission proposes removing the Article 49(2) registration requirement for AI systems that providers have classified as non-high-risk under Article 6(3) because they perform only narrow procedural tasks. The provider remains obligated to document the Article 6(3) assessment before market placement.

7. Real-world testing expansion (Recitals 10–11). The Commission proposes extending the possibility of real-world testing outside regulatory sandboxes under Article 60 to high-risk AI systems covered by Annex I (previously limited to Annex III systems), and creating legal basis for Member State voluntary agreements to test Annex I Section B systems in real-world conditions.

Where the Council added to the Commission proposal (13 March 2026)

The Council adopted its general approach on 13 March 2026 with largely the same structure as the Commission proposal, with several significant additions:

Fixed deadlines, not conditional. The Council accepted the Commission's extension logic but rejected the standards-availability condition as a precondition for application. The Council's mandate uses fixed dates: 2 December 2027 for Annex III, 2 August 2028 for Annex I, regardless of standards availability.

New Article 5 prohibition on sexual/intimate content generation. The Council introduced a new prohibited practice under Article 5 for AI systems "that generate or manipulate realistic images or videos depicting sexually explicit activities or the intimate parts of an identifiable natural person" without that person's freely-given, specific, informed, unambiguous and explicit consent. The Council's text expressly also covers child sexual abuse material. An exception applies for AI systems equipped with effective safety measures preventing users from creating such content.

Article 49 registration reinstated. The Council rejected the Commission's removal of the registration obligation for Article 6(3) exempt systems. The Council reinstates the registration requirement but streamlines the content required.

AI Office centralised supervision, but with national exceptions. The Council narrowed the Commission's AI Office competence by providing that national authorities retain supervisory competence in specific sectors — notably law enforcement, border management, and financial services — even when the AI system is built on a GPAI model.

Special category data for bias detection retained stricter standard. The Council retained the "strict necessity" standard for processing special categories of personal data for bias detection, rather than the broader Commission formulation.

Where the Parliament diverges (26 March 2026)

The Parliament's position, adopted in plenary with 569–45–23, is broadly aligned with the Council on structural questions but adds its own accents:

Same fixed deadlines (2 Dec 2027 / 2 Aug 2028). The Parliament agrees with the Council on the fixed-date approach.

Same nudifier prohibition with the Parliament formulation. The Parliament's Article 5 text prohibits AI systems that "alter, manipulate or artificially generate realistic images or videos so as to depict sexually explicit activities or the intimate parts of an identifiable natural person, without that person's consent." Safety-measures exception maintained. The Parliament's formulation focuses on non-consensual content broadly; the Council's language uses "freely-given, specific, informed, unambiguous and explicit" consent — a stricter definition matching the GDPR Article 7 consent standard.

Article 50(2) transitional period shorter. The Commission proposed extending the compliance deadline for Article 50(2) marking obligations (for AI systems placed on the market before 2 August 2026) until 2 February 2027. The Parliament proposes a shorter extension, until 2 November 2026.

Article 4 AI literacy reforms retained. The Parliament's position preserves the Commission and Council alignment on transforming Article 4 into a Member State and Commission duty to foster rather than a direct obligation on operators.

AI Office competence limitations. The Parliament, like the Council, introduces limits to the AI Office's exclusive competence where national authorities retain jurisdiction in specific sectors.

What trilogue will resolve

The key divergences between the three institutions that must be resolved in trilogue:

Standards-availability condition or fixed dates alone? The Commission version preserves flexibility through the standards-availability trigger; Council and Parliament want fixed dates without the condition. The Parliament and Council converge here against the Commission. The trilogue outcome likely retains fixed dates — this is the most politically settled element.

Article 50(2) transitional period — 2 February 2027 or 2 November 2026? The Parliament's shorter deadline is more consumer-protective; the Commission's longer deadline offers more industry breathing room. Trilogue compromise possible.

Article 5 nudifier formulation — Council's GDPR-style consent standard or Parliament's broader formulation? Both positions ban non-consensual sexual deepfakes but with different legal thresholds. Trilogue will settle the precise text.

AI Office competence scope. Commission, Council, and Parliament all agree on some centralisation but differ on the exceptions. This will take the most detailed negotiation in trilogue.

Special category processing scope. Commission's broader formulation vs. Council's "strict necessity" standard.

Critical context — the Omnibus is not law yet

As of mid-April 2026, the Digital Omnibus on AI is a legislative proposal in active trilogue negotiations. It is not law. The AI Act as it currently stands — Regulation (EU) 2024/1689 — remains in force with its original text. The 2 August 2026 application date for high-risk obligations remains the legal baseline until the Omnibus is adopted and enters into force.

This matters operationally for NYC companies. A strategy that assumes the Omnibus will pass as currently drafted is a bet. A safer posture is to continue preparing for the 2 August 2026 date, while monitoring trilogue progress and being prepared to pivot if the Omnibus is adopted before that date.

The Cypriot Presidency has stated the objective of reaching agreement in April or May 2026. If they succeed, the Omnibus could enter into force during 2026. If they do not succeed before the Danish Presidency takes over in July, the uncertainty extends further.

What NYC companies should do now

From the perspective of operational compliance planning:

Do not wait for the Omnibus to resolve. Continue scope and classification work (see our self-assessment). Article 2 scope, Article 3 roles, Article 5 prohibitions, Annex III classification — none of these are materially affected by the Omnibus. The scope of the Regulation is unchanged.

Prepare Article 5 compliance assuming the nudifier prohibition will be added. Companies developing image or video generation AI should assume the prohibition will be in force before 2 August 2026 and structure product safeguards accordingly.

Take advantage of extended deadlines where they apply. If the Omnibus passes with 2 December 2027 as the Annex III high-risk date, this is a year and four months of additional preparation time. Use it to strengthen documentation quality, not to delay all work.

Article 4 AI literacy — continue training programs. Even if the Omnibus transforms Article 4 from a direct obligation into a Member State duty, deployer-specific training obligations under Article 26 remain, and organised staff AI literacy is a governance best practice regardless. Training programs should continue.

Monitor trilogue closely in May–June 2026. The single most important date for NYC compliance planning is when the trilogue concludes. That determines whether the AI Act applies in its current form on 2 August 2026 or in its amended form at a later date.

If you are an SMC (small mid-cap enterprise) — watch for new eligibility. Enterprises with between 50 and 500 employees, annual turnover between €10M and €100M, and balance sheet between €10M and €86M — formerly outside SME protections — would gain access to simplified technical documentation and QMS provisions if the SMC extensions pass. Many NYC mid-sized companies fall in this band.

Trust but verify — only the final trilogue text matters

Trilogue negotiations often produce outcomes that differ in important details from any one institution's opening position. The Commission, Council and Parliament positions summarised here will be compromised at specific thresholds, dates, and exception scopes. Until the compromise text is published and adopted through ordinary legislative procedure, compliance planning must build in the range of possible outcomes.

For NYC companies, the concrete action is: preserve flexibility, maintain scope and classification work, monitor trilogue weekly, and be ready to re-plan once the final text is published. This is as much a planning exercise as a legal exercise.

Primary sources. European Commission, COM(2025) 836 final — Proposal for a Regulation amending Regulations (EU) 2024/1689 and (EU) 2018/1139 (Digital Omnibus on AI), procedure 2025/0359(COD), 19 November 2025. Council of the EU, Press release 189/26, "Council agrees position to streamline rules on Artificial Intelligence", 13 March 2026. European Parliament, Report A10-0073/2026 (IMCO-LIBE joint report), 18 March 2026; plenary vote 26 March 2026 (569–45–23). European Parliament, Press release "Artificial Intelligence Act: delayed application, ban on nudifier apps", 26 March 2026. European Parliament Research Service, EPRS Briefing PE 782.651, 2026. European Economic and Social Committee Opinion on the Digital Omnibus, 18 March 2026. Regulation (EU) 2024/1689: Article 4, Article 5, Article 6, Article 10, Article 17, Article 26, Article 28, Article 43, Article 49, Article 50, Article 60, Article 72, Article 75, Article 99, Article 111, Article 113.