EU AI Act Digital Omnibus — Annex III high-risk deadline extended to 2 December 2027; new CSAM/non-consensual-imagery prohibitions with 2 December 2026 hard stop

The 7 May 2026 provisional political agreement (Council + EP) on the Digital Omnibus on AI materially restructures the AI Act compliance timeline for Swiss and EU organisations:

• Annex III (biometrics, employment, education, credit scoring, critical infrastructure, law enforcement, justice, migration): extended from 2 August 2026 → 2 December 2027. Swiss public-sector deployers of high-risk AI in these categories (border management AI, judicial AI, benefits assessment AI) gain 16 months of additional runway.
• Annex I (AI embedded in regulated products: medical devices, machinery, toys): extended to 2 August 2028.
• AI watermarking (Article 50(2)): extended to 2 December 2026.
• New Article 5 prohibitions: AI generating non-consensual intimate imagery (deepfake nudification) and CSAM must cease by 2 December 2026 — no transition period.
• Prohibited practices under the existing Article 5 list and AI literacy requirements remain applicable from February 2025 with no new transition.

The extension does NOT relieve organisations of ongoing risk assessment or gap analysis obligations — ESAs have signalled that supervisory expectations for DORA-regulated entities using high-risk AI systems remain aligned with the AI Act obligations regardless of extension. Formal parliamentary and Council votes are expected June–July 2026.