Six Months to August 2: The Deal-Desk Read on the AI Act and the Omnibus

It is the last Friday of January and I am at the desk with the second coffee, going through the M&A pipeline for next week’s column when the conversation I keep ending up in this month surfaces again. The call is with a corporate-development guy at a European hotel group I will not name. He is walking me through a tuck-in deal for an AI-driven hiring tool — résumé screening, candidate ranking, the lot — that they want to plug into the central HR stack across nine countries. Halfway through I ask him the question I have been asking everyone since the New Year: what is your read on 2 August?

He laughs. “Brussels will move it.”

I have heard a version of that line four times in three weeks now, from operators, from a banker on the sell-side of a property-management-software deal, and from a hospitality-group CFO who told me, on background, that they have “paused the compliance budget for the year, pending the Omnibus.” That is the conventional wisdom on this desk’s beat in late January: the European Commission is going to defer the high-risk obligations of the AI Act through its Digital Omnibus package, the August deadline will slide to December 2027, and the spreadsheet line for legal review can stay where it is.

The contrarian read — and the one I think the deal desk needs to be working from — is: do not bet on Brussels. Treat the original date as live. Six months out is when you stop hoping and start papering. Here is what is on the table, what is knowable as of today, and what the operator implication is. Interpretation, not consensus.

The deadline that is six months away

The AI Act — Regulation (EU) 2024/1689 — entered into force on 1 August 2024 and applies in phases. The first two phases are already in effect: the prohibitions and the staff AI-literacy obligation went live on 2 February 2025, and the governance and general-purpose-AI rules switched on 2 August 2025. Marco wrote up the operator-level fallout from those phases in his foundational piece on the Act last spring, and that piece is still the cleanest plain-English read on what is already live. Re-read it if you are coming in cold.

The phase that matters for the deal desk and for any operator buying AI hiring, AI biometric access, or AI workforce-management software lands on 2 August 2026. That is the date the high-risk obligations of the Act start to bite. As of this Friday, that is exactly twenty-six weeks out.

What “high-risk” means in plain English, because the term gets thrown around loosely: under the Act, an AI system is high-risk if it falls inside one of the use cases the regulation flags as high-stakes — and the use case that matters to hospitality operators is Annex III’s employment category. Per the Commission’s own navigating-the-AI-Act FAQ, that category explicitly covers AI used to “place targeted job advertisements, analyse and filter job applications, and evaluate candidates.” If you run an AI résumé screen on your front-of-house hiring pipeline, that is high-risk. If you run an AI scheduler that ranks workers for promotion or termination, that is high-risk. If you run a biometric clock-in that does anything beyond authenticate — anything categorising the person on the other end of the camera — read your contract very carefully.

The obligations that attach to a high-risk system are not light. The Commission’s overview page lists them in order: risk-assessment and mitigation systems, training-data-quality requirements, activity logging, technical documentation, deployer-facing instructions, human-oversight measures, and robustness/cybersecurity/accuracy standards. Most of that lives on the provider side of the supply chain — the vendor builds the system, the vendor carries the bulk of the paperwork. But deployers — that is the operator running the system in production — carry their own obligations: human oversight, monitoring, incident reporting, and the duty to use the system in line with the provider’s instructions. The August date is when both sides of that chain have to be ready.

What did not happen on 2 February

Here is the piece of the puzzle that broke this week, and the one most operators have not yet read.

Article 6 of the Act is the one that draws the line for what counts as high-risk in the first place — it is the classification gateway for the whole Annex III list. Under the Act, the Commission was required to publish operational guidelines on Article 6 — guidelines on the classification methodology itself — by 2 February 2026. That was Monday. The Commission did not publish.

The IAPP reported earlier this week that the Commission has slipped to a “draft by end of February, final adoption in March or April” timeline on the Article 6 guidance. The IAPP quotes Laura Caroli, one of the original Act negotiators, on what the miss means: “You’re not giving clarity” when foundational guidance on Article 6 remains unavailable despite being a core legal requirement.

You should take that quote seriously. The Article 6 guidance is not a nice-to-have. It is the document the Commission was supposed to publish to tell operators which AI systems actually qualify as high-risk. Without it, every operator counsel I have spoken to is having the same conversation with the same vendors: we think your product is high-risk under Annex III, you think it is limited-risk, neither of us has guidance from the regulator, and the deadline is six months out. That is the situation as of this morning.

Two things follow from the miss. One: the working assumption on this desk is that the Article 6 guidance, if it lands at all, lands in March or April — which leaves operators four months, max, to do classification work between final guidance and the deadline. Two: the harmonised standards that providers were supposed to certify against, the CEN/CENELEC technical standards, have publicly slipped to end-2026. That is after the deadline. There is no version of this in which the providers your hotel group is buying from in February 2026 will have a clean, certified, standards-aligned product to hand you. They will be operating on internal interpretations. So will you.

The Omnibus, in plain English

The other half of the conventional-wisdom bet — the one my corp-dev source on this morning’s call is putting his chips on — is the Digital Omnibus.

In plain English: an “omnibus” is a Commission package that opens up multiple existing pieces of legislation at once to amend them all together. The Digital Omnibus that is on the table right now would, among other things, push the 2 August 2026 high-risk deadline back to 2 December 2027. That is the 16-month deferral DLA Piper has been writing up for the in-house counsel crowd since the proposal dropped on 19 November 2025.

A “trilogue” is the closed-door negotiation between the Council (member states), the Parliament, and the Commission to land a final text. Nothing the Commission proposes becomes law without the trilogue producing an agreed text. The Omnibus is in trilogue now. The European Parliament’s LIBE committee held its hearing on the Omnibus this past Monday, 26 January, and the next political trilogue is on the calendar for late spring. As of this Friday, no agreement is on the board.

DLA Piper’s note on this is the clearest line in any analysis I have read this month, and I am going to quote it because it is the line every operator-side reader of this column should print and tape to the monitor: “Should the trilogue negotiations remain incomplete and the Omnibus not be formally adopted prior to 2 August 2026, the provisions of the original Act … will take effect from that date as originally drafted.” That is the legal reality. The Omnibus is a proposal in negotiation. Until it is adopted, the calendar is the calendar.

(Note for the operators who are reading this in the spring: subsequent trilogue rounds are scheduled, and the trajectory may well land a deal before August. I will be tracking it. But the working assumption for January, February, March is that you do not have a delay. You have a proposal. They are different.)

The deal-desk read

This is where I get contrarian on the desk’s house view, and where most operators I have talked to this month have it backwards.

The operator-side bet is: Brussels will move the date, my compliance budget can wait, my AI hiring vendor told me they are “watching the Omnibus closely.” I understand the bet. I think it is wrong on risk-reward.

Three reasons.

One: the cost of being wrong is asymmetric. If you treat the 2 August date as live and Brussels does defer to December 2027, you have spent six months papering compliance you would have had to do anyway — eighteen months later — and you are ahead of the rush. If you treat the date as dead and Brussels does not defer, you are out of compliance on day one of a regime whose fines are not theoretical. Marco walked through the fine architecture in the foundational piece — the prohibited-AI cap is €35 million or 7% of turnover, and the high-risk obligations carry their own enforcement teeth. I do not have a meaningful read on what early enforcement looks like in practice. I am not going to invent one. But the exposure is meaningful enough that the asymmetric bet is to comply.

Two: the M&A read on this is that compliance posture is becoming a diligence item. Two of the three hospitality-tech deals I have looked at in the past month have had AI Act compliance — provider-side conformity assessments, deployer-side documentation, training records — flagged in the data room as a yellow item. The deals that have it papered are getting cleaner multiples. The deals that have not are getting reps-and-warranties carve-outs that will bite at closing. That is happening now, not in August.

Three — and this is the one the desk keeps coming back to — Brussels has a pattern of partial reprieves. The shape of the Omnibus, if it lands, is unlikely to be a clean date-slide. The negotiation positions on the table from the November proposal suggest the Council and Parliament are pushing for a narrower reclassification of what counts as high-risk under Article 6, in addition to or instead of a date deferral. Translation: even if you get a delay on the calendar, you may not get a delay on whether your specific AI hiring tool is high-risk. Those are separable.

So the deal-desk read for January is: paper it now. Inventory your AI systems. Run them through Annex III. Get the high-risk classification questions on paper with each of your vendors in writing, with a date. If the vendor cannot tell you, in January 2026, whether the system they sold you in 2024 is high-risk under the Act, that is the diligence finding right there. Get the deployer-side oversight, logging, and human-review processes built into the operating procedures now, not in July. And read your vendor’s Article 6 self-assessment when they finally produce one — it will tell you more about their risk posture than their sales deck ever did.

If Brussels delivers a delay in the spring, fine. You will have done a quarter’s worth of compliance work eighteen months ahead of when you had to. That is a survivable bet.

The other side of the trade is not.

— Marcus runs The Bottom Line and gets the deal flow before the brokers. Tips: [email protected].