The EU AI Omnibus buys time — and forces the standards conversation
The May 7 Omnibus agreement pushes high-risk obligations to December 2027 and adds two new prohibitions. The headline is the timeline relief. The substantive shift is that the AI Office now has 18 more months to ship the harmonized standards that make the Act actually enforceable.
What changed
The May 7 political agreement on the AI Omnibus is the first set of substantive amendments to the AI Act since June 2024 adoption. Three changes matter:
- Timeline relief. High-risk use-based obligations move from August 2, 2026 to December 2, 2027 — 16 months of additional runway.
- New prohibitions. Non-consensual intimate AI material and CSAM generation become Article 5 prohibitions (highest enforcement tier) effective December 2, 2026.
- Sandbox flexibility. Member-state regulatory-sandbox obligations also postponed by a year, removing a brittle deadline that several states would have missed.
The standards problem
The deeper read is that the AI Act's enforcement teeth depend on harmonized technical standards (CEN/CENELEC work products) that nobody could deliver by the August 2026 cliff. Pushing the cliff to December 2027 buys time to actually ship the standards — without which the high-risk classification regime would have been enforced by improvisation, which is worse than not enforcing it.
Regulatory deadlines that arrive before the standards do produce enforcement by litigation. The Omnibus avoids that.
What the new prohibitions do
Adding non-consensual intimate AI material and CSAM to Article 5 is the substantive policy expansion. Both were already illegal in member-state criminal codes; making them Article 5 prohibitions adds (a) a uniform EU-wide enforcement framework, (b) criminal-referral potential for deployers and developers, and (c) explicit obligations on platform-tier services to prevent generation.
For the open-weight tier that now dominates OpenRouter, the question is operational: how do downstream deployers attest filter-and-control compliance for models whose weights they didn't train? The Article 5 framework doesn't yet have a clean answer.
The US-side mirror
The contrast with the US-side posture is sharp. The EU just took a year of timeline relief to ship better standards. The US voluntary AISI evaluation regime is still moving without statutory backing. Enterprises operating in both jurisdictions get to pick which uncertainty they hedge — and most are starting with the EU because the deadlines are firmer even after the delay.
European Council — AI omnibus → · Inside Privacy — Omnibus update → · Latham — AI Act update →