On May 7th, 2026, something unusual happened in Brussels: EU legislators agreed to give businesses more time. After two years of the AI Act being treated as inevitable and non-negotiable, the Digital Omnibus on AI — the first major set of amendments since the Act’s adoption in June 2024 — offers a reprieve. High-risk AI system obligations have been pushed from August 2026 to December 2027 for most Annex III systems, and to August 2028 for product-regulated systems. The transparency requirements for synthetic content marking have been deferred by four months. National regulatory sandboxes get an extra year.

This looks, on the surface, like regulatory grace. It isn’t. It’s calibration.

The delays reflect something the Commission couldn’t admit publicly: the standards infrastructure wasn’t ready. CEN-CENELEC, the EU standards bodies responsible for the technical specifications that underpin compliance, needed more time. You can’t enforce obligations that nobody knows how to meet. So rather than watch a cascade of non-compliance actions in August, legislators chose the politically safer option: extend the deadline and look pragmatic. The industry lobby won this round, and they won it by pointing out the obvious — you can’t regulate what you haven’t defined.

Where the omnibus doesn’t extend, it tightens. The new prohibitions on AI-generated non-consensual intimate imagery and CSAM are not deferrals — they take effect December 2nd, 2026. These were added to Article 5, the Act’s “banned practices” section, which means the penalties are the serious kind: administrative fines, potential civil liability, and for providers, criminal exposure in some jurisdictions. The definition of who bears responsibility — provider versus deployer — is nuanced and will generate significant litigation. But the direction is clear: using AI to fabricate intimate content without consent is now a categorically prohibited use, full stop.

There’s also a structural shift worth noting. The Machinery Regulation has been moved from Annex I Section A to Section B, which means AI-enabled machinery — lifts, medical devices, certain industrial equipment — no longer has to satisfy both AI Act high-risk obligations and existing sectoral safety frameworks in parallel. Sector-specific law now takes precedence, and the Commission has until August 2028 to issue delegated acts incorporating AI-specific requirements into the Machinery Regulation. This is a meaningful relief for hardware manufacturers who’ve been staring at overlapping compliance obligations with no clear hierarchy. Whether it survives legal challenge from consumer groups who argue it waters down safety protections remains to be seen.

What the omnibus amendments collectively signal is that the EU’s approach to AI governance is maturing past the declaration phase. The early AI Act narrative — dramatic, expansive, everything-is-regulated — is giving way to something more operational. Adjustments will be made. The question is whether those adjustments serve innovation or just political optics. The December 2026 date for synthetic content marking isn’t glamorous, but it’s concrete. The new prohibitions on intimate imagery are sharper than most people realize. Brussels is learning to govern this space, and that means learning to prioritize. That’s not weakness. That’s how regulation actually works when it has to.