AI Act “Paused” — What Actually Changed and What Didn't

What Happened

Both EU co-legislators have now adopted their respective positions on the Digital Omnibus on AI:

Trilogue negotiations (formal talks between Parliament, Council and Commission) are expected to begin in April 2026, with a target agreement by May 2026. The Cypriot Council Presidency aims for ratification before August 2026.

Legal status: This is not yet adopted law. Both institutions have adopted negotiating positions, not a final text. The trilogue outcome may still modify dates and conditions.

Confirmed New Dates (both institutions’ positions)

Source: Council (March 13) and Parliament (March 26) positions. Dates subject to trilogue outcome.

The “Readiness Gate” Mechanism

Parliament introduces a conditional trigger: high-risk obligations only apply 6 months after a Commission decision confirming that compliance support (harmonised standards, guidance, tools) is available. 12 months for Annex I systems. The backstop dates (Dec 2027 / Aug 2028) apply if the Commission never issues that decision.

Key context: No CEN-CENELEC harmonised standard has been published to date. The first are expected at the earliest in Q4 2026. This delay is the primary reason for the postponement.

New Prohibited Practice: Nudifiers

Both institutions add a new prohibition to Art. 5: AI systems generating non-consensual intimate imagery (“nudifiers”) and child sexual abuse material. Both positions are aligned — this ban is expected to survive trilogue.

What Is NOT Paused

The following obligations remain fully in force. None of them are affected:

Key point: The majority of AI Act obligations that are already enforceable today are completely unaffected. Organizations subject to Art. 5, GPAI rules, or transparency requirements have no additional time.

What IS Conditionally Paused

Both institutions’ positions target a specific subset of obligations:

Why “Paused” Is the Wrong Word

The headline narrative will be: “the AI Act is paused, we have time.” This is dangerous and inaccurate.

Art. 5, Art. 50, and GPAI obligations remain fully active. A conditional delay on Annex III does not eliminate regulatory exposure — it displaces it. The obligations that carry the most immediate penalty risk (prohibited practices at 35M€ or 7% of turnover) are untouched.

Organizations that interpret this vote as permission to wait are not reducing risk. They are building undocumented exposure during the exact period when early positioning carries the most weight.

Why Your Position Matters More Now, Not Less

A dated, article-mapped assessment produced before any enforcement date is evidence of proactive regulatory positioning. This principle is already established in adjacent regulatory markets — GDPR, NIS2, DORA — where early documentation consistently demonstrated good faith during enforcement.

The date on your report is your strongest argument. Whether enforcement happens in December 2027 or earlier, having a documented position predating enforcement demonstrates that your organization took the regulation seriously before it was required to.

What You Should Do Now

Do not wait for the final trilogue outcome. The smart move is the same whether the postponement is adopted or not: