On 13 March, the Council of the EU agreed its negotiating position (general approach) on the parts of the Digital Omnibus package that simplify the AI Act. It is the first collective member-state verdict since the Commission tabled its seventh omnibus package in November 2025, and the headline is a large delay: obligations for high-risk AI systems, originally due to apply on 2 August 2026, now land on 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products. The package amends the AI Act, the GDPR and a related directive through two regulations, with the stated goal of simplifying the EU’s digital rulebook and supporting its own digital transformation.
Marilena Raouna, deputy minister for European affairs of Cyprus, holder of the rotating presidency, framed the mandate this way: “The changes agreed today strike the right balance between simplification and preservation of key protection standards.” That balance came with an explicit trade. The Council accepted the timeline relief, but put back two accountability mechanisms the Commission had proposed deleting — a direct answer to the red lines European data protection authorities drew in January.
Three New Timelines
The Council’s schedule changes break into three pieces. First, compliance obligations for stand-alone high-risk AI systems — hiring, education, law enforcement and similar uses — move from 2 August 2026 to 2 December 2027, a full 16 months, while keeping the Commission’s conditional trigger: the rules only start to apply once the Commission confirms the harmonised standards and tools are in place. Second, high-risk AI embedded in regulated products such as medical devices and machinery gets another year, to 2 August 2028. Third, the deadline for member states to establish AI regulatory sandboxes slides to 2 December 2027 as well.
What the Council Added Back
The most criticised line in the Commission’s draft was the deletion of the EU database registration duty for high-risk systems. The Council restored a compromise version: providers who consider their systems exempt from the high-risk classification must still register them in the EU database — self-assessed exemptions go back onto an auditable track. The “standard of strict necessity” for processing sensitive personal data in bias detection and correction also returns, matching the core demand of the EDPB-EDPS joint opinion issued in January.
The prohibited-practice list gets stricter, not looser: new bans on AI that generates non-consensual intimate imagery (the “nudification” apps) and on AI that generates or accesses child sexual abuse material. The Council also extended the watermarking obligation for deepfakes and AI-generated content from 2 August to 2 November 2026.
Two competence changes ride along. First, the AI Office: when a high-risk system and the general-purpose AI model underneath it come from the same provider, the AI Office takes over supervision — with exceptions for law enforcement, border management, judicial authorities, and financial institutions. Second, the Commission picks up a new duty to issue guidance for high-risk systems governed by sectoral harmonisation legislation, which gives developers in medical devices and machinery an official interpretation to work from.
Where Council and Parliament Diverge
The same week, the European Parliament’s IMCO and LIBE committees adopted their own position with 101 votes in favour, 9 against and 8 abstentions, with plenary confirmation expected on 26 March. The sharpest split between the two institutions is the schedule design: Parliament’s version insists on fixed dates and rejects the “only once standards are ready” conditional trigger; the Council keeps both. The Council’s mandate also authorises the rotating presidency to open negotiations with Parliament on the member states’ behalf. The trilogues that follow Parliament’s plenary will have to settle that difference first.
Simplify or Deregulate
The Commission’s original ambition was broad: extend SME exemptions to small mid-caps, reduce requirements in limited cases, reinforce the AI Office’s powers, and cut governance fragmentation. Supporters call it burden relief. Critics — several civil society groups and the data protection authorities among them — see deregulation of fundamental-rights safeguards wearing a simplification costume. The Council’s restorations show member-state governments picked a middle lane: timelines can move, accountability mechanisms cannot be deleted wholesale.
What It Means for Dev Teams
Three practical points. First, teams building high-risk use cases (hiring, credit, educational assessment, law enforcement) gain a 16-month buffer — but do not treat it as immunity: transparency obligations stay on the original track, and deepfake and AI-content labelling only moves to 2 November 2026. Second, self-assessed exemptions will require documentation and registration, so design your compliance-decision paper trail now — and teams processing sensitive personal data for bias correction will need to re-run their data protection impact assessments against the widened legal basis and the strict-necessity standard. Third, the law is still moving — Parliament’s and Council’s texts go into trilogue, and until a final version lands, hard-code none of the dates. For the rest of that week’s industry news, see the AI weekly roundup.
Sources
- Council agrees position to streamline rules on Artificial Intelligence — Council of the EU
- The EU AI Act Newsletter #98: Parliament, Council and the Omnibus Showdown — Future of Life Institute
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.