AI Act roadmap: planning for a deadline

The Digital Omnibus did not collapse on 28 April. It stopped. After roughly twelve hours of trilogue negotiations, the Council and the Parliament could not reach a deal on the conformity-assessment architecture for AI embedded in regulated products. A second trilogue is scheduled for around 13 May. Until that round closes, or until any subsequent round closes, the AI Act applies on its original schedule. Your planning deadline is 2 August 2026.

When we covered the missed February guidance deadline in March, the smart money was on a clean Omnibus deal in May or June. That probability has fallen sharply. The work compliance leads need to do this quarter has not.

Four scenarios that matter

Modulos has produced the most useful probability-weighted breakdown of where the file goes from here. Their four scenarios are worth carrying into your own planning.

Scenario one: quick recovery on 13 May (~30%)

A face-saving compromise on Annex I, OJ publication in July, deadlines apply on the previously agreed dates: 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for product-embedded systems.

Scenario two: late deal under the Irish Presidency (~25%)

The next trilogue does not close. The Cypriot Presidency ends on 30 June 2026 without a deal. Ireland takes over on 1 July and a compromise is reached during summer. The original 2 August 2026 deadline passes without a postponement legally in force, and the Commission may issue forbearance or transitional guidance to manage the gap.

Scenario three: split deal (~15%)

Annex I is carved off into its own legislative track. The rest of the Omnibus, including the agreed Annex III postponement, the registration changes, the GPAI elements and the deepfake ban, passes on the previously converged terms. Industrial AI is handled separately, possibly via a Commission delegated act.

Scenario four: no deal before 2 August (~30%)

Before 28 April this was a 10 percent tail risk. After the cancelled press conference and the visible institutional fracture, it is now a real 30 percent scenario. Original obligations apply on schedule with limited notified-body capacity and no harmonised standards in place.

Three of the four scenarios still produce a delay; one does not. Your roadmap needs to handle all four.

What does not change in any scenario

This is the point most teams are missing. A large share of the AI Act compliance work is invariant across the four scenarios.

Article 5 prohibitions have applied since 2 February 2025. Article 4 AI literacy obligations applied on the same date. Articles 50 to 55 GPAI obligations have applied since 2 August 2025. None of this is on the table in the Omnibus.

The operational backbone underneath any high-risk classification is also invariant: AI inventory, system-level classification, provider-versus-deployer role mapping, fundamental rights impact assessment scoping, technical documentation, post-market monitoring design. None of it is altered by what the Council and Parliament eventually agree on.

If your governance programme still treats this work as conditional on the trilogue outcome, the trilogue outcome is not your problem.

What does change by scenario

A short list of moving parts.

The applicability date for Annex III high-risk systems sits between 2 August 2026 and 2 December 2027. The applicability date for Annex I product-embedded systems sits between 2 August 2027 and 2 August 2028, possibly later if the file is split. SME documentation simplifications are agreed in principle but not in force, so anything you build against them is still speculative. The proposed Article 4a legal basis for bias detection is on the table but unconfirmed.

None of this is trivial. It affects notified body queueing, conformity-assessment timelines and the size of your documentation pipeline. It is also the part of the file most likely to shift again before publication. Build the pipeline; do not over-engineer it for an outcome that has not landed.

ISO 42001 as the scenario-independent anchor

For organisations that need maturity that holds whatever clock the institutions settle on, anchoring on ISO 42001 plus the AI Act invariant block is more efficient than running parallel scenario-specific roadmaps. ISO 42001 controls map cleanly into Articles 9 to 15 of the AI Act, into the governance work we covered when the discipline shifted from planning to execution, and into the vendor governance discipline the Anthropic case made unavoidable.

One pipeline. Multiple regulatory destinations. Less waste.

What to do this quarter

Stop optimising for the December 2027 outcome. Reset the working deadline to 2 August 2026. Treat any delay you eventually get as a buffer, not a plan.

This week, re-classify any AI system you de-scoped on the assumption that the Omnibus would narrow Annex III. Confirm provider and deployer roles in writing. Name the single accountable owner.

This month, run a gap assessment against AI Act Articles 9 to 15 for every system that is high-risk under the law as it stands. If you have Annex I products in scope, get on the notified body queue now. Capacity was constrained before 28 April; it is worse this week.

This quarter, build the Article 49 registration pipeline and the Article 50 synthetic-content disclosure capability. Both survive in all four scenarios. Anchor the whole programme against ISO 42001 so the work is portable across whatever the Council and Parliament eventually publish.

The AI Act 2 August 2026 SME Readiness Self-Check on the Future Prep Tools page is the entry checklist for that quarter. It maps the operational steps onto the obligations as they currently stand and stays useful in scenarios two through four.

If it passes in May, none of this is wasted

If the Omnibus does pass in May or June, none of this work is wasted; it just gives you sixteen extra months to evidence it. And if it does not, you are ahead of any peer who waited. Either way, the cost of preparation is the same. The cost of waiting is not.