The EU Commission’s Digital Omnibus proposal delays high-risk AI Act compliance deadlines to December 2027 and streamlines GDPR breach reporting — offering a 16-month buffer for mid-market firms. CFOs and General Counsel should treat this window as a strategic acceleration opportunity, not a pause.
A political agreement on EU AI Act amendments extends high-risk AI compliance deadlines to December 2027 and August 2028, while preserving near-term transparency and governance obligations from August 2026. Mid-market companies must act now on foundational AI governance, GDPR convergence, and auditable compliance controls.
The European Commission’s proposed Digital Omnibus would unify GDPR, EU AI Act, NIS2, and DORA reporting obligations and extend key AI compliance deadlines to 2027–2028. Decision-makers must distinguish procedural relief from substantive obligation — enforcement risk remains high.
The EDPB’s Coordinated Enforcement Framework 2026 and the EU AI Act’s August 2026 full application deadline are creating overlapping compliance obligations that demand integrated action from CFOs, General Counsel, and CTOs. Organisations that treat GDPR and AI governance as separate workstreams face compounding regulatory exposure.
The EU AI Act’s high-risk AI obligations apply from August 2026, creating immediate compliance pressure for mid-market firms operating under a dual GDPR and AI Act governance model. CFOs, General Counsel, and board members must act now to inventory AI assets, build evidence-based controls, and quantify material regulatory exposure.
The European Commission’s proposed Digital Omnibus would streamline overlapping GDPR and EU AI Act obligations — but it remains a proposal, not law. With the AI Act’s full applicability date set for August 2026 and GPAI obligations already in force, corporate compliance teams cannot afford to wait.
The EDPB’s 2026 Coordinated Enforcement Framework and the EU AI Act’s full application in August 2026 are converging into a single, high-stakes compliance agenda for European and transatlantic businesses. Mid-market firms must act now to align data privacy governance, AI oversight, and cross-border transfer controls before enforcement pressure intensifies.
The EU’s Digital Omnibus proposal is reshaping how firms must integrate GDPR and AI Act obligations, offering operational relief without reducing core enforcement risk. With full AI Act applicability set for August 2026, executives have a strategic window — but a closing one — to align governance frameworks.
The EU has provisionally agreed to extend high-risk AI Act deadlines to 2027–2028 while accelerating AI content transparency rules to December 2026. CFOs and General Counsel must act now — GDPR enforcement remains fully active and AI governance has become a core compliance priority.
The EU AI Act’s August 2026 deadlines are closer than most boards appreciate, with high-risk AI obligations, GDPR dual compliance, and penalties of up to 7% of global turnover now defining the enterprise risk landscape. CFOs and General Counsel must act now to inventory AI systems, align governance frameworks, and embed compliance into M&A due diligence.