Operating Note
This weekly format separates confirmed law, draft/proposal, and soft law / market signals. That distinction is non-negotiable for any product claiming to help users with EU AI Act decisioning.
This week brought two significant institutional moves: the Council adopted its negotiating mandate on the Digital Omnibus on AI, and the ECB published a formal opinion recommending changes to how credit scoring models are classified under Annex III. No enacted law changed.
1. Confirmed changes
No confirmed changes this period. No new AI Act regulations, delegated or implementing acts, binding Commission guidelines, court rulings, or national AI Act transposition laws were published between 2–16 March 2026. All current-law enforcement dates remain as enacted. The AI Act Service Desk FAQ and Article 113 timeline confirm no changes.
2. Proposed changes
Council adopts Digital Omnibus negotiating mandate (March 13)
The Council of the EU adopted its negotiating mandate on the Digital Omnibus on AI (procedure 2025/0359(COD), document ST-7322-2026-INIT) on 13 March 2026. Trilogues with the European Parliament and Commission will follow. The mandate confirms four key proposals already tracked in this series:
- Annex III high-risk deadline: Link application to availability of harmonised standards, with an outer limit of 2 December 2027 (current law remains 2 August 2026 until amended).
- Annex I regulated products: Same mechanism, outer limit of 2 August 2028 (current law remains 2 August 2027).
- Article 4 AI literacy: Shift primary promotion obligations to Member States and the Commission, while the current Article 4 obligation stays in force until the amendment is adopted.
- Article 4a bias detection: New legal basis to process special categories of personal data for bias detection and correction, with strict GDPR safeguards.
The mandate also proposes expanding the AI Office’s central role over GPAI-based systems and simplifying EU database registration for AI systems assessed as non-high-risk under Article 6(3). Likelihood of adoption: HIGH — strong political momentum to de-risk implementation before August 2026.
ECB Opinion on credit scoring classification (March 13)
The ECB published Opinion CON/2026/10 on 13 March 2026, an own-initiative opinion addressed to the European Parliament and Council. Key recommendations:
- Credit scoring exclusion: Generalised linear models (linear/logistic regression) used for credit scoring under human supervision should be excluded from the Annex III(5)(b) “high-risk” classification.
- Supervisor information sharing: Amend Article 74(7) to create a two-way legal basis for sharing confidential information between prudential supervisors (ECB/national authorities) and AI Act market surveillance authorities.
- Prudential mandate protection: Explicitly state the AI Act is without prejudice to the ECB’s prudential supervisory mandate.
This opinion is non-binding but carries significant weight. Likelihood of integration into the final Omnibus text: MEDIUM — strong technical rationale but some Parliament groups may resist model-specific carve-outs in Annex III.
EP committee opinions on Digital Omnibus
The European Parliament’s JURI committee (draft report PE782.530) and CULT committee (draft opinion) support the core Omnibus changes while emphasising that simplification should not weaken fundamental-rights safeguards, particularly in education and culture contexts. The IMCO/LIBE lead report is still under preparation.
3. Guidance and soft law
CNIL–HAS joint consultation on AI in healthcare: On 5 March 2026, the French data protection authority (CNIL) and the French health authority (HAS) launched a joint public consultation on a draft guide for AI in healthcare. The guide covers data governance, performance evaluation, human oversight, transparency, and risk management across the AI lifecycle. This is national, non-binding, France-specific guidance — not an EU-wide change. However, it signals how national health authorities may interpret AI Act requirements in medical settings.
Commission AI literacy Q&A: The Commission’s AI literacy Q&A confirms that Article 4 obligations remain binding on providers and deployers as of 2 February 2025, and acknowledges that the Omnibus proposal would shift primary promotion duties to Member States. No new updates to the Q&A content were published this period.
Article 50 Code of Practice on labelling/watermarking: Multi-stakeholder work on a voluntary Code of Practice for labelling and watermarking AI-generated content under Article 50 is ongoing. As of 16 March 2026, no officially published draft with a confirmed version number or date is available from the Commission or AI Office. Timelines remain indicative.
4. Timeline tracker
| Date | Event | Status | Why it matters |
|---|---|---|---|
| 05 Mar 2026 | CNIL–HAS healthcare AI consultation launched | Soft Law | France-specific; signals national interpretation of AI Act in healthcare. |
| 13 Mar 2026 | Council Digital Omnibus mandate adopted (ST-7322-2026-INIT) | Proposed | Confirms delayed high-risk deadlines, Article 4/4a changes, AI Office expansion. Trilogues next. |
| 13 Mar 2026 | ECB Opinion CON/2026/10 published | Soft Law | Recommends excluding linear/logistic regression from Annex III(5)(b) credit scoring classification. |
| Feb–Mar 2026 | EP JURI draft report & CULT opinion on Omnibus | Proposed | Support core Omnibus knobs; emphasise fundamental-rights safeguards in education/culture. |
5. Enforcement and market signals
Enforcement: No AI Act fines, formal investigations, or enforcement decisions by EU-level bodies or national authorities were identified this period. The EDPB AI Act Correspondents Network held its second meeting, continuing preparations for coordinated enforcement across Member States.
Standards: No new harmonised standards or Commission implementing acts citing AI Act-related standards were published in the Official Journal. CEN/CENELEC and ISO/IEC JTC 1/SC 42 work continues, but nothing binding changed this period.
6. Founder actions this week
- Urgent: If your compliance roadmap relies on a fixed 2 August 2026 high-risk deadline, begin scenario-planning for the Omnibus delay (outer limit 2 December 2027). The Council mandate makes adoption increasingly likely. Do not change your target date yet — current law still says August 2026 — but prepare messaging for both scenarios.
- Important: If you operate in credit scoring or financial services, document a monitoring hook for the ECB’s proposed exclusion of linear/logistic regression models from Annex III(5)(b). This could materially change which of your models qualify as “high-risk.”
- Important: If you deploy AI in French healthcare, review the CNIL–HAS draft guide and consider responding to the public consultation before it closes. Even as non-binding guidance, it will likely shape enforcement expectations in France.
- Monitor: Track Digital Omnibus trilogue progress over the next 4–6 weeks. A political agreement could arrive as early as late spring 2026. Reassess all compliance timelines immediately if a compromise text is announced.
Use the timeline, the Compliance Checker, and your content layer together.
About the author: Abhishek G Sharma is the founder of Move78 International Limited and holds ISO 42001 LA, ISO 27001 LA, CISA, CISM, CRISC, CEH, CCSK, CAIGO, and CAIRO certifications.
Disclaimer: This page is educational and operational guidance only. It is not legal advice. Published: March 2026.