Trilogue Starts Next Month. Here's What the Three EU Institutions Are Actually Fighting Over.

The Starting Gun Has Been Fired

As of last Thursday, something significant changed: all three EU co-legislators now have their official negotiating positions on the AI Act's simplification package — the Digital Omnibus. The European Commission published its proposal back in November 2025. The Council of the EU agreed its mandate on 13 March. And then, on 26 March 2026, the European Parliament voted 569 to 45 to adopt its own position.^[1]

That vote completed the starting conditions for trilogue — the closed-door negotiations between Parliament, Council, and Commission where the final amended text gets hammered out. Media reports indicate the current aim is to begin those talks in April or early May 2026.^[3] With the original August 2, 2026 high-risk deadline sitting on the other side of those negotiations, the clock is ticking.

So: what are they actually negotiating about? Where do the institutions agree — and where do they not? And what does it mean for SMEs watching this process from a distance?

Where All Three Institutions Agree

There is genuine consensus on several core elements, which makes a deal before August 2026 credible.

All three agree that the high-risk AI compliance deadline should move. The original date — August 2, 2026 — was set before it became clear that the technical standards needed to demonstrate compliance wouldn't be ready in time. CEN-CENELEC's harmonised standards are now expected no earlier than late 2026. Without those standards, companies can't know with certainty whether their documentation meets the bar. All three institutions recognise that enforcing compliance against an undefined standard would create confusion, not compliance.^[2]

All three also agree on the backstop dates: if no Commission decision is issued confirming standards are ready, the absolute latest deadline for Annex III high-risk AI (employment, education, credit, essential services, biometrics) is December 2, 2027. For AI embedded in regulated physical products like medical devices, the backstop is August 2, 2028.

There's also agreement on adding a ban on nudifier apps — AI systems that generate non-consensual sexually explicit images of identifiable real people — and on extending simplified compliance benefits beyond just small businesses.

Where They Differ (And What's Still Being Negotiated)

The differences are meaningful, though not fundamental.

How far to extend the SME definition. The Commission's original proposal kept simplified rules for classic SMEs (under 250 employees, under €50M turnover). The Parliament went further, proposing to extend these benefits to a new category: "small mid-caps" — companies with fewer than 750 employees and less than €150M annual turnover.^[4] This would cover a much larger slice of the European business landscape. The Council's position sits somewhere in the middle. Expect the final text to include some extension of these benefits beyond classic SMEs — the direction of travel is clear even if the exact threshold isn't settled.

The watermarking deadline. The Commission proposed giving providers until February 2027 to implement machine-readable AI content watermarks (the technical metadata standard for Article 50). The Parliament shortened this to November 2, 2026. The Council's position is closer to the Commission's longer extension. This is one of the more contested details — the final date matters for tech platforms and content publishers who need to implement watermarking systems at scale.

How conditional the deadline should be. The Commission's original mechanism was dynamic: the high-risk deadline would only apply once the Commission issues a formal decision confirming standards are ready. Parliament and Council have both introduced fixed backstop dates, reducing the open-endedness of this mechanism. The exact trigger conditions — and what happens if the Commission never issues its decision — will need to be resolved in trilogue.

Sensitive data provisions. Some of the more ambitious simplification proposals from the Commission — around how sensitive personal data used in AI training gets treated — have been pulled back by both Parliament and Council. This is a notable area where the co-legislators are showing more caution than the Commission.

What This Means for Businesses Right Now

The honest position for SMEs is: act on what's certain, monitor what isn't.

Transparency obligations are certain. Article 50 — chatbot disclosures, AI content labelling, emotion recognition notifications — is not on the trilogue table. August 2, 2026 is the date. It hasn't moved in any of the three institutional positions, and it won't move in trilogue. If you have a customer-facing AI chatbot, a disclosure needs to be in place before August. If you're publishing AI-generated content, it needs to be labelled. These are quick fixes that should already be in progress.

High-risk AI compliance has a credible new timeline. If you're using AI in hiring, credit, education, or essential services, the relief is real — a December 2027 backstop is almost certainly coming. But "almost certainly" is not law. Treat August 2026 as your working deadline and prepare to shift it when the final Omnibus text is published.

The SME definition expansion matters. If your company sits between 250 and 750 employees, the Parliament's small mid-cap proposal could be significant. Watch for where the final definition lands — it determines whether you qualify for simplified documentation requirements.

The Bottom Line

For the first time since November 2025, the AI Act amendment process has a clear path forward. All three institutions have their positions. The door to trilogue is open. Given that the core elements — the extended deadlines, the nudifier ban, the SME support — enjoy broad agreement, there's genuine reason to expect a deal before summer.

But "expect" and "plan on" are different things. Until the final text clears trilogue and lands in the EU's Official Journal, the original AI Act deadlines remain legally binding. The businesses that will be in the best position aren't the ones waiting for the final text — they're the ones who've already handled the easy stuff (transparency disclosures, chatbot labelling, staff briefings) and can absorb the high-risk extended timeline as a bonus rather than a lifeline.