Pillar guide → For the full breakdown of EU AI Act obligations for SMEs and SMBs (Art. 4, 5, 26, 27, 50, fines, timeline), see our complete EU AI Act SME compliance guide.
On 7 May 2026, the Council of the EU and the European Parliament announced a provisional political agreement on targeted amendments to the EU AI Act, forming part of the European Commission's Digital Omnibus package. The stated goal: reduce compliance friction for European businesses and make AI governance genuinely accessible to smaller operators. Formal adoption is still pending, but the direction is set.
Compliance observers on X quickly flagged the broader dynamic. As Franke-Media noted on X, the problem with EU digital regulation has always been that "compliance burden is a fixed cost that only giants can absorb" — a structural asymmetry that local AI directly addresses.
For organizations already running local LLM stacks — or evaluating one — the news is largely positive: more time, broader SME relief, and a cleaner path to documented compliance.
What the Digital Omnibus Changes
Based on our reading of the published agreement, four changes stand out:
1. High-Risk AI Deadlines Pushed Back
The full obligations for standalone high-risk AI systems (Annex III of the AI Act) are now expected to apply from 2 December 2027 — roughly 16 months later than the original August 2026 target. For high-risk AI systems embedded in regulated products (Annex I), the deadline moves to 2 August 2028.
For organizations that had been preparing urgently for an August 2026 deadline, this is substantial breathing room.
2. SME Relief Extended to Mid-Caps
The simplified compliance framework previously limited to micro-enterprises and standard SMEs now extends to companies with up to 750 employees and €150 million in annual revenue. That bracket covers the vast majority of European businesses deploying AI in-house.
What the simplified framework means in practice:
- Standardized documentation templates instead of custom system cards built from scratch
- Access to national regulatory sandboxes for testing and validation
- Reduced maximum fines compared to the full framework
- Dedicated simplified guidance materials for smaller operators
3. GDPR Update for AI Bias Detection
The GDPR is amended to permit processing of special-category personal data for detecting and correcting bias in AI models — but only where strictly necessary, with processing limited in scope, justified, and documented. For most internal business AI applications — document search, HR assistance, code generation — this change is unlikely to be immediately relevant, as those systems rarely touch sensitive special-category data.
4. Watermarking Requirements from December 2026
From 2 December 2026, AI-generated content must carry watermarking and provenance labels. Organizations using AI outputs strictly internally face limited exposure here. Those producing AI-generated text, images, or video for customer-facing or public use will need to implement labelling workflows.
What Still Applies
The Omnibus deal delays and simplifies — it does not remove the fundamental obligations. Based on our reading of current requirements:
Risk classification remains mandatory: Every AI deployer should be able to document why their system falls into a particular risk category. Standardized templates make this easier, but the assessment itself still needs to happen.
Transparency toward users: Employees and customers interacting with an AI system must be informed that AI is involved in the interaction.
Human oversight for high-risk use cases: If your application touches hiring decisions, credit scoring, medical contexts, or safety-critical areas, the requirement for meaningful human oversight remains unchanged regardless of the deadline shift.
The practical implication: organizations that build a lean, well-documented local AI stack today will face minimal additional effort when formal compliance deadlines arrive in 2027.
Why Local AI Holds the Structural Advantage
The Digital Omnibus debate underlines a key point: compliance costs in the EU create a structural disadvantage for smaller European organizations relative to US hyperscalers. Local AI doesn't just reduce compliance cost — it addresses the root cause.
Running Ollama on a Mac Studio M3 Ultra (roughly €5,000–6,500), a self-hosted NVIDIA-powered server, or a cluster of Mac Minis gives operators structural compliance advantages regardless of how regulation evolves:
Model transparency: You know exactly which model version is running at all times. No vendor updating the system without notice. A system card is trivial to complete because every parameter is under your control — Llama 3.3 70B Q4 via Ollama stays exactly that until you decide otherwise.
Privacy by architecture: No data leaves your network. No third-country transfer under GDPR Chapter V, no processing on US hyperscaler infrastructure. This is not a contractual promise — it is a physical constraint. That is the most robust compliance mechanism available.
Audit-ready logging at zero incremental cost: Local systems can maintain complete request-response logs without paying a cloud provider for log retention. Compliance audits become straightforward rather than expensive.
Predictable, controllable costs: No vendor repricing, no API cost spikes during peak usage. Based on community-reported comparisons, a Mac Studio M3 Ultra stack recovers its upfront cost against equivalent cloud API spend within 12–18 months at moderate workload. Inference speeds for popular models are reported by practitioners in the range of 20–35 tokens/second on Apple Silicon M3 hardware.
Explore our approach to data sovereignty and local AI for more on the architecture principles behind these advantages.
Model Recommendations for Compliance-Sensitive Use Cases
Based on community-reported testing, the following combinations work well for business use cases requiring documented, auditable AI:
Llama 3.3 70B (Meta, Apache 2.0 licence): Strong reasoning and document analysis in multiple European languages including German, French and Spanish. Requires 64–96 GB unified memory; runs comfortably on a Mac Studio M3 Ultra (192 GB). Reported inference: 20–35 tokens/second.
Qwen2.5 32B (Alibaba, Apache 2.0 licence): Excellent quality-to-resource ratio; 32–48 GB RAM sufficient. Well-suited for multilingual business tasks, internal Q&A, and structured extraction. Accessible for teams with Mac Pro or mid-range server hardware.
DeepSeek-V3 (DeepSeek, MIT licence): Strong structured output and document extraction capabilities. 128k context window suits contract review, FAQ generation, and long-form report drafting.
All three run via Ollama or vLLM on-premise — no external API endpoint, no data leaving your infrastructure.
A Practical Checklist for Local LLM Operators
This list reflects our interpretation of current requirements and does not substitute for legal advice:
- System inventory: Which AI systems are deployed, and for which tasks?
- Risk classification: Does the use case touch high-risk categories — hiring, credit, health, safety — or remain purely assistive with human review?
- System card: Model name and version, hardware, deployment date, intended use description
- Access control: Who can send prompts? Open WebUI and similar interfaces provide role-based access control (RBAC) out of the box
- Review cycle: Semi-annual documentation review with a changelog
For most SMBs running assistive local AI, this checklist takes 2–4 hours to complete initially and roughly 1–2 hours to maintain semi-annually.
What the Omnibus Means Strategically
The Digital Omnibus agreement gives European businesses meaningful breathing room — but the strategically sound move is to use that time to build a clean foundation rather than to wait. Organizations that establish proper documentation now will treat formal compliance in 2027 as a minor update rather than a scramble.
Local AI is uniquely well-placed to deliver on this: consistent model identity, zero external data transfer, and full logging by design make the system card largely self-completing.
If you want to understand which local AI setup fits your team size, use cases, and compliance posture, we are happy to walk through it with you — no commitment required.