← Back to feed

Formal trilogue negotiations over the European Commission’s Digital Omnibus on AI have opened in Brussels, setting up a compressed race to rewrite parts of the EU AI Act before the August 2026 full-enforcement deadline. The Digital Omnibus package — presented by the Commission on November 19, 2025 — covers two parallel tracks: the Data Acquis (covering the Data Act, Data Governance Act, and related instruments) and the AI Omnibus, which directly proposes amendments to AI Act obligations already on the statute books.

The AI Omnibus is the more consequential of the two. Negotiators from the Parliament, Council, and Commission are now in trilogue — the closed three-way bargaining process that produces the final legislative text — debating a range of proposed changes: higher thresholds for classifying general-purpose AI models as systemic risk, expanded SME carve-outs, modified transparency obligations for deployers, and adjusted timelines for conformity assessments in high-risk categories.

What the AI Act Currently Requires

Under the AI Act as adopted, August 2026 marks full enforcement for high-risk AI systems and GPAI model obligations. GPAI models with over 10^25 FLOPs of training compute face the most stringent tier: adversarial testing, incident reporting, systemic risk assessments, and mandatory transparency with the Commission.

All seven of the major frontier labs — Anthropic, Google, Meta, Microsoft, OpenAI, xAI, and DeepSeek — now have models in or near that threshold. Compliance infrastructure build-outs are underway, but legal counsel and compliance teams across the industry have flagged the conformity documentation requirements as underspecified in implementing regulation.

What the Omnibus Proposes

The AI Omnibus does not repeal the AI Act. What it proposes is narrower: it would amend specific provisions that the Commission characterised as creating disproportionate burden relative to risk. Key proposals under negotiation include:

• GPAI compute threshold: Raising the 10^25 FLOP threshold — set in 2024 — to account for compute efficiency gains. Models like Gemini 3 Flash or Llama 4 Scout, which achieve frontier-tier performance at far lower training compute, were not the intended target of the systemic-risk tier.
• SME relief: Full exemption from GPAI obligations for providers with fewer than 250 employees and under €50M annual turnover — a carve-out the Commission argues is essential to keep European AI startups viable.
• Deployer obligations: Narrowing which downstream deployers of third-party models carry compliance liability, versus placing that burden on model developers directly.
• Implementation timelines: A rolling 12-month safe harbour for companies that have begun compliance processes but cannot complete them by August 2026.

The Political Stakes

The Omnibus was politically controversial before trilogues even began. MEPs from the Greens and S&D groups characterised the proposals as a rollback engineered by industry lobbying, pointing to the Commission’s simultaneous push to compete with US and Chinese AI investment. The EPP and Renew groups backed the Omnibus, framing it as necessary course correction. The Council, representing member states, entered trilogues broadly supportive but with divergent national positions on the compute threshold and SME definition.

Trilogues typically run two to six months. With full AI Act enforcement eight months away and the August 2026 date written into primary legislation — unamendable by the Omnibus process alone — it is unclear whether any trilogue agreement could deliver implementation relief in time. The Commission has separately indicated it would use delegated act powers to issue guidance if trilogues miss the window, though that approach is legally contested.

Enforcement Gap

Separate from the Omnibus negotiations, the Commission AI Office — the body responsible for GPAI enforcement — has already begun requesting model cards and incident disclosure frameworks from frontier providers. Three labs have received preliminary information requests as of Q1 2026. None had received formal notice of non-compliance, but the Office’s published readiness assessment flagged 70% of in-scope providers as having incomplete conformity documentation. With trilogues ongoing and implementing regulation still incomplete, the August 2026 deadline is increasingly treated by legal teams as a political rather than hard technical date.