The AI Act Omnibus deal struck on May 7 is now fully mapped. High-risk AI obligations are postponed to December 2027 for stand-alone systems and August 2028 for AI embedded in regulated products, giving most affected companies 18 months of additional runway before the heaviest compliance requirements bite.
The same text adds a new prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a December 2026 compliance deadline. Both Council and Parliament must formally endorse the text before August 2 to prevent the original AI Act deadline triggering without the Omnibus amendments in place.
Policy & Regulation
AI Act postponement confirmed: businesses get 18 months.
The full Omnibus text confirms that Annex III high-risk systems, including biometrics, critical infrastructure, employment, education, and migration, are pushed to December 2, 2027, while Annex I systems embedded in products face an August 2, 2028 deadline. Co-legislators cited a structural sequencing failure: the technical standards and guidance documents companies need to actually comply with the rules are not yet finished.
Watermarking requirements for synthetic content remain on schedule for August 2026. Formal endorsement is expected before the summer recess. (Orrick) (William Fry)
Five EU states referred to the CJEU over DSA implementation.
The European Commission has sent Czechia, Poland, Spain, Cyprus, and Portugal to the Court of Justice for failing to designate and empower their Digital Services Coordinators. Estonia, Slovakia, Belgium, and the Netherlands resolved compliance at earlier stages.
The five remaining states now face potential financial penalties if the CJEU finds them in breach. The pattern is familiar: member states treat EU digital law as optional until litigation forces action, and enforcement of the enforcement mechanism is itself under-resourced.
For Poland and Czechia in particular, the referral lands as both countries have been publicly calling on Brussels to slow down on new digital legislation. (European Commission)
Amazon's €746M GDPR fine falls on procedural grounds.
Luxembourg's Administrative Court annulled the fine imposed on Amazon by the national data protection authority in 2021, at the time the second-largest GDPR penalty ever issued. The court confirmed the substantive violations almost in their entirety: Amazon's behavioral advertising practices did not comply with GDPR.
But the regulator had failed to assess whether the breaches were intentional or negligent before reaching for a maximum penalty, and had not considered lesser remedies first. The case goes back to the CNPD for fresh analysis.
The ruling exposes a structural weakness across EU enforcement: data protection authorities can identify real harm, but companies with sustained litigation capacity can invalidate penalties even when the core findings stand. (The Record) (CNPD)
Tech Sovereignty Package confirmed for May 27.
The European Commission's flagship bundle, delayed twice from an original March window, is now confirmed for May 27. The package includes the Cloud and AI Development Act (CADA), Chips Act 2.0, an open-source strategy, and a digitalisation roadmap for energy.
CADA is expected to define what constitutes a sovereign cloud provider, set eligibility criteria for public procurement, and potentially restrict EU public administrations from processing sensitive government data on US hyperscaler platforms in healthcare, finance, and judicial systems. Whether the final text contains binding restrictions or voluntary frameworks will determine whether this is structural change or another compliance exercise companies route around. (CADE Project) (CNBC)
Capital & Investment
Helsing nears $1.2B at an $18B valuation.
Munich-based defense AI startup Helsing is close to closing a round led by Dragoneer and co-led by Lightspeed, with Daniel Ek participating as an existing investor. The deal would value the company at $18 billion, up from $14 billion when it last raised in June 2025, and would make it Germany's most valuable startup.
The round is reportedly oversubscribed multiple times. Helsing develops AI for battlefield decision-making and produces the HX-2 loitering munition; the Bundeswehr approved an initial €269M contract in February, with a framework reaching €1.46B over seven years.
The company states that approximately 80% of its cap table remains European, a deliberate positioning against US competitors including Anduril. (TechCrunch)
EIC deploys Scaleup Europe Fund.
The European Innovation Council is making first investments from its new Scaleup Europe Fund, a direct equity instrument targeting deeptech companies in AI, quantum, cleantech, semiconductors, and advanced materials. The fund is designed to address the gap between early-stage EIC grants and the mid-stage rounds European companies routinely fail to raise domestically.
Whether the EIC can deploy capital at the speed and ticket sizes that founders need will be the test; the structural problem it is addressing is real and well-documented. (European Commission)
e2vc's €100M Fund III targets Central and Eastern Europe.
e2vc reached first close on Fund III at €100M, focusing on early-stage startups across the Central and Eastern European corridor. The region has consistently produced strong technical founders but lacks the density of Series A capital needed to keep companies growing locally.
The fund is one of several dedicated Eastern European vehicles closing in H1 2026, alongside Montis VC and others, suggesting LP appetite is beginning to follow the talent pipeline east at a meaningful scale. (Vestbee)
One to Watch
May 27: CADA text drops.
The Cloud and AI Development Act lands next week. Read the definitions section first: how the Commission defines a sovereign cloud provider will determine the regulation's actual reach.
A tight, binding definition displaces US hyperscalers from major public contracts; a vague one produces compliance theater. The procurement clauses matter equally.
The political context is unusual: tech sovereignty goals, AI competitiveness pressure, and genuine US trade friction are aligned in the same direction for once. Watch the definitions and procurement language, not the press release. (European Parliament Legislative Train)