European Union: European Parliament and Council of the EU reached provisional agreement on Digital Omnibus on AI Regulation (2025/0359) including cybersecurity requirements for high-risk AI systems

On 7 May 2026, the European Parliament and the Council of the EU reached a provisional agreement on the Digital Omnibus on AI Regulation (2025/0359). The Digital Omnibus on AI Regulation would set fixed application dates for cybersecurity obligations for high-risk AI systems. Obligations for Annex III high-risk AI systems would apply from 2 December 2027 and obligations for Article 6(1) high-risk AI systems would apply from 2 August 2028. The Digital Omnibus on AI Regulation would also clarify the interplay between the Digital Omnibus on AI Regulation and EU sectoral product safety legislation by limiting its application in cases where sectoral law contains equivalent AI-specific requirements. The Machinery Regulation would be exempt from direct applicability of the Digital Omnibus on AI Regulation, with the European Commission empowered to adopt delegated acts under the Machinery Regulation adding health and safety requirements for AI systems classified as high-risk. The provisional agreement must be formally adopted by both the European Parliament and the Council of the EU before 2 August 2026.