Summary: On March 13, the EU Council agreed its position to delay stand-alone high-risk AI duties from August 2, 2026 to December 2, 2027, with embedded systems moving to August 2, 2028. It restored high-risk registration for self-assessed exemptions and the strict-necessity standard for sensitive data used in bias work. The Council and Parliament positions still require trilogue, so no final dates are settled.
The Council of the EU has locked in its negotiating position (a general approach) on the parts of the Digital Omnibus that simplify the AI Act, doing so on 13 March. It is the first time the member states have ruled together on the file since the Commission put its seventh omnibus package on the table in November 2025, and the verdict turns on one large postponement: duties for high-risk AI systems that were due to apply on 2 August 2026 now sit at 2 December 2027 for systems that stand alone, and at 2 August 2028 for AI embedded in regulated products. Two regulations carry the whole package, amending the AI Act, the GDPR and a related directive; the officially stated aim is a simpler EU digital rulebook and support for the bloc’s own digital transformation.
Speaking for the member states, Marilena Raouna — Cyprus’s deputy minister for European affairs, Cyprus holding the rotating presidency — gave the verdict its framing: “The changes agreed today strike the right balance between simplification and preservation of key protection standards.” Behind that balance sits a bargain declared in the open. The Council took the timeline relief, and paid for it by writing back the two accountability mechanisms the Commission had proposed deleting — an unmistakable reply to the red lines European data protection authorities drew in January.
The Revised Schedule, in Three Moves
Break the Council’s calendar changes into three moves. Move one: stand-alone high-risk AI systems — hiring, education, law enforcement and their kind — see compliance duties shifted from 2 August 2026 to 2 December 2027, sixteen full months, and the Commission’s conditional trigger survives untouched: the rules only start to apply after the Commission confirms that the harmonised standards and tools are in place. Move two: high-risk AI embedded in regulated products, such as medical devices and machinery, waits an additional year, to 2 August 2028. Move three: the deadline for member states to establish AI regulatory sandboxes moves to 2 December 2027 as well.
What Went Back Into the Council Text
Nothing in the Commission’s draft drew more criticism than the removal of the duty to register high-risk systems in the EU database. The Council revived it in compromise form: a provider that considers its system exempt from the high-risk classification must nonetheless enter it in the EU database — self-assessed exemptions are back on an auditable footing. Restored alongside it is the “standard of strict necessity” governing the processing of sensitive personal data for bias detection and correction, which answers the central ask of the EDPB-EDPS joint opinion published in January.
The list of prohibited practices moves the other way, toward tighter control: newly banned are AI that produces non-consensual intimate imagery — the “nudification” apps — and AI that generates or accesses child sexual abuse material. The watermarking duty on deepfakes and AI-generated content is stretched by the Council too, from 2 August to 2 November 2026.
Oversight responsibilities are redrawn in two places. One involves the AI Office: when the same provider stands behind both a high-risk system and the general-purpose AI model beneath it, supervision passes to the AI Office — except for law enforcement, border management, judicial authorities and financial institutions. The other loads a fresh duty onto the Commission: publish guidance for high-risk systems that fall under sectoral harmonisation legislation, which hands medical-device and machinery developers an official interpretation to rely on.
Where the Two Institutions Split
In the same week, the European Parliament’s IMCO and LIBE committees carried their own position with 101 votes in favour, 9 against and 8 abstentions, and plenary confirmation is expected on 26 March. The deepest disagreement between the institutions is how the schedule is designed: Parliament’s text allows nothing but fixed dates and throws out the “apply once standards are ready” conditional trigger, while the Council’s runs the two mechanisms side by side. The Council’s position likewise authorises the rotating presidency to open negotiations with Parliament on the member states’ behalf. That gap is what the trilogues following Parliament’s plenary will have to settle first.
Streamlining, or Deregulation in Disguise
The Commission set out with a broad agenda: stretch SME exemptions to small mid-caps, lower requirements in limited circumstances, build up the AI Office’s powers, and trim governance fragmentation. Defenders present the plan as burden relief; opponents — several civil society groups and the data protection authorities included — read it as fundamental-rights safeguards being loosened under a simplification label. What the Council chose to restore shows member-state governments steering a middle course: dates are movable, accountability mechanisms are not removable wholesale.
The Practical Read for Dev Teams
Three takeaways. One: teams whose use cases are high-risk (hiring, credit, educational assessment, law enforcement) have just gained a 16-month buffer — read it as breathing room rather than immunity, because transparency obligations keep their original timeline and deepfake and AI-content labelling moves only to 2 November 2026. Two: an exemption you assessed yourself will need a documented record and a registration entry, so build the compliance-decision paper trail into your product documentation now; teams handling sensitive personal data to detect bias will have to re-run their data protection impact assessments against the widened legal basis and the strict-necessity standard. Three: the text is still moving — Parliament’s and the Council’s versions are headed into trilogue, so lock in none of the dates until the final version lands. For the rest of that week’s industry news, see the AI weekly roundup.