EU
Digital Omnibus Package on Artificial Intelligence
Impact date: 8 July 2026 (publication of Regulation). The most significant new application dates are 2 December 2027 for high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in regulated products. On 29 June 2026, the Council of the European Union gave its final approval to the Regulation amending the EU AI Act as part of the “Digital Omnibus on Artificial Intelligence”. While the Regulation does not alter the AI Act’s fundamental risk-based framework, it introduces important clarifications regarding its implementation. Most notably, the application dates for high-risk AI systems are postponed to 2 December 2027 and 2 August 2028 respectively, new requirements are introduced for the processing of sensitive personal data for bias detection and mitigation, and the rules on AI literacy are adjusted. Of particular relevance for employers, AI systems used in recruitment and employment-related decision-making continue to qualify as potential high-risk AI systems, although the associated compliance obligations will apply at a later stage. The broader Digital Omnibus proposal, which includes planned amendments to the GDPR, the ePrivacy Directive and the Data Act, remains subject to the ongoing legislative process.
In particular:
- 2 December 2026: prohibition of certain AI systems used to generate or manipulate non-consensual intimate content or child sexual abuse material; providers of systems generating synthetic content must also comply with transparency obligations by this date
- 2 August 2027: extension of the deadline for establishing national AI regulatory sandboxes
- 2 December 2027: postponement of the application of the rules for stand-alone high-risk AI systems, including systems used in employment, recruitment, education, biometrics and access to essential services, from 2 August 2026 to 2 December 2027
- 2 August 2028: application of the rules for high-risk AI systems embedded in regulated products (such as medical devices and safety-critical product components) postponed until 2 August 2028
- Explicit legal basis introduced for processing special categories of personal data, including health data, for the purpose of detecting and mitigating bias in AI systems, subject to strict requirements relating to necessity, access controls, documentation, data retention and pseudonymization
- AI literacy: Member States will assume a greater role in promoting adequate AI literacy, shifting part of the responsibility previously placed on providers and deployers of AI systems
- Strengthened role of the EU AI Office: expanded supervisory and enforcement powers in relation to certain General-Purpose AI (GPAI) systems to support consistent application and enforcement of the AI framework
Employer implications/action needed Employers should continue to assess whether AI systems used in recruitment, talent management, performance evaluation or employment-related decision-making fall within the category of high-risk AI systems. While the postponement of the implementation deadlines provides additional preparation time, it does not remove the need to classify AI systems, establish appropriate governance structures, maintain documentation and ensure contractual compliance. Employers should also review existing data protection and AI compliance processes in light of the new rules on bias detection and the use of sensitive personal data.
Employer risk The Regulation postpones key deadlines but does not suspend the substantive requirements under the AI Act. In particular, AI systems used in HR and recruitment remain potentially high-risk. Employers that fail to use the extended transition periods to prepare for compliance may face significant governance, documentation and regulatory risks once the relevant obligations become applicable.
Update on various employment-related EU Directives
Impact date: Ongoing A number of workplace-related EU Directives have passed their local implementation deadline or have recently been finalized by the EU and await Member State implementation. These include Directives on adequate minimum wages, transparent and predictable working conditions, work-life balance, gender diversity in the boardroom, whistleblowing, corporate sustainability reporting, pay transparency, platform workers, corporate sustainability due diligence, together with a Regulation on forced labor. A revised European Works Council Directive has also been approved. There are also proposed Directives on fair telework and the right to disconnect, and on improving working conditions for trainees. While not a Directive, the European Globalisation Adjustment Fund for Displaced Workers (EGF) is a special measure designed to support workers who lose their jobs due to major structural changes. Subject to final approval, the EGF will be extended to support workers affected by imminent job displacement in enterprises undergoing restructuring. Our two briefings (see links) provide a summary of the Directives and the Regulations.
The Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive have been revised, with the aim of reducing reporting burdens on businesses. A so-called “Omnibus” package of simplification measures entered into force on 18 March 2026.
Employer implications/action needed All employers operating in the EU (and, for some Directives, certain non-EU businesses) should expect to make some changes to their current arrangements to take account of the requirements of the Directives as each is transposed into national law.
Employer risk A risk of financial and other sanctions, and reputational harm, if employers do not comply with amended workplace legislation.
Links The Global Employment Law Update includes our EU Directives Tracker European Works Council Directive
Contact
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Connect with us
