AI Act Trilogue Targets April Deal, CRA Guidance Closes, CSRD Omnibus Now in Force

AI Act Digital Omnibus: Trilogue Launched, 28 April Deadline

The European Parliament adopted its negotiating position on the Digital Omnibus on AI on 26 March with 569 votes in favour, 45 against, and 23 abstentions. Nicfab Trilogue negotiations started the same day, with the last trilogue planned for 28 April. Delorscentre

Both Parliament and Council agree on pushing the high-risk AI system deadline for Annex III systems (biometrics, employment, education) to 2 December 2027, and Annex I systems (AI in regulated products) to 2 August 2028. Global Policy Watch Both co-legislators also introduced a new ban on AI systems capable of generating non-consensual intimate imagery of identifiable individuals. Global Policy Watch

The current timeline targets a final agreement as early as the second trilogue on 28 April. OneTrust If that holds, this would be one of the fastest EU legislative negotiations in recent memory. The institutions clearly want this wrapped before the 2 August 2026 general application date, even if the whole point of the Omnibus is to push that date back for high-risk systems.

CRA Draft Guidance: Feedback Period Closed on 31 March

On 3 March 2026, the European Commission published draft guidance for feedback, focusing on the scope of the CRA, particularly remote data processing solutions and free and open-source software. European Cyber Resilience Act The feedback period ran from 3 March to 31 March 2026. European Cyber Resilience Act

This matters because manufacturers are required to report actively exploited vulnerabilities and severe incidents starting 11 September 2026 European Commission. That is five months away and many companies still have not identified which of their products fall within scope. The Commission has published implementing acts on product categories and delegated acts on incident reporting to help clarify obligations Bird & Bird, but this guidance package is the first comprehensive compliance roadmap for manufacturers. Expect the final version by mid-2026.

CSRD Omnibus I Entered Into Force on 18 March

The Omnibus I Directive was published in the Official Journal on 26 February 2026 and took effect on 18 March 2026. Norton Rose Fulbright The amendments to CSRD will apply to financial years starting from 1 January 2027, with the first reports due in 2028. Norton Rose Fulbright

The practical impact is enormous. The Omnibus increases the application thresholds to companies with over 1,000 employees and €450 million net turnover Norton Rose Fulbright, compared to the original 250 employees and €50 million turnover. The CS3D has been amended to remove climate transition plan requirements and restructure due diligence obligations. Crowell & Moring The Commission is due to adopt revised European Sustainability Reporting Standards by delegated act within six months, so by 18 September 2026 at the latest. Arthur Cox LLP

Companies that spent 2024 and 2025 preparing for CSRD compliance should now urgently re-run their scoping analysis. Around 80% of previously in-scope companies just fell out.

78% of Enterprises Unprepared for AI Act

Vision Compliance published its 2026 EU AI Act Readiness Analysis on 1 April, finding that 78% of enterprises are unprepared for their obligations. The National Law Review 83% of organisations assessed had no formal inventory of AI systems, 74% lacked a designated internal owner for AI compliance, and 61% had no process for generating required technical documentation. The National Law Review

The Digital Omnibus may buy 16 extra months for high-risk compliance. It will not fix the fact that most organisations have not started the foundational work of knowing which AI systems they actually use.

Next week: Watch for progress on the AI Act trilogue technical sessions and any signals on whether the 28 April target holds.

Not sure where you stand on AI Act compliance? Take the free AI Act Readiness Assessment.