Omnibus weekend read. Europe Day. NHS GitHub goes private today.

At 4:30 in the morning on Thursday May 7, after roughly nine hours of negotiation, Council and Parliament negotiators reached provisional agreement on the Digital Omnibus on AI. The deal was reached under the Cypriot Presidency, with co-rapporteurs Arba Kokalari (EPP, Sweden) and Michael McNamara (Renew, Ireland). Over the weekend, law firms across Europe began publishing detailed reading guides. The picture that emerges is more nuanced than either “simplification win” or “watered down” framings allow.

The headline changes confirmed by Bird & Bird, Hogan Lovells, TechUK, Timelex, and the AI Act Lab. Annex III high-risk obligations (biometrics, employment, education, law enforcement, critical infrastructure, border management) move from 2 August 2026 to 2 December 2027. Annex I high-risk obligations (AI embedded in regulated products under sectoral safety legislation) move from 2 August 2027 to 2 August 2028. Article 50(2) watermarking obligations move to 2 December 2026 — only seven months away. The Annex I conformity assessment dispute that broke the 28 April trilogue was resolved through a face-saving compromise: the Machinery Regulation moves from Section A to Section B of Annex I, meaning machinery-embedded AI will be governed primarily by sectoral framework rather than the AI Act directly. MDR, IVDR, and the Radio Equipment Directive remain in Section A.

A new Article 5 prohibition was added, banning AI systems used to generate child sexual abuse material or non-consensual intimate imagery, including so-called “nudifier” tools. The prohibition applies in three configurations: placing such systems on the EU market, placing them on the market without reasonable safety measures, and deployer use. Companies have until 2 December 2026 to bring affected systems into line. A new Article 2(13) mechanism allows the Commission to limit, via delegated implementing acts, application of specific AI Act requirements where Section A sectoral legislation provides equivalent or higher protection. The definition of “safety component” in Article 3(14) has been tightened: products whose AI functions merely assist or optimise will not automatically be classified high-risk if a failure would not create health or safety risks.

The deal still needs formal adoption by both co-legislators before 2 August 2026, the date the Annex III obligations would otherwise become applicable. Until publication in the Official Journal, the original deadlines remain legally in force. The TechPolicy.Press analysis published over the weekend is the sharpest framing: civil society and industry are both frustrated rather than relieved. The left wing of Parliament secured the nudifier ban at the cost of yielding on the industry-friendly sectoral exemption. Chancellor Merz’s CDU and industry pressure carried the day on Annex I. For European organisations preparing for AI Act compliance, the practical implication is that 2 December 2027 and 2 August 2028 can now reasonably be used as the planning baseline, but governance, registration documentation, and ISO 42001 maturity work should not pause. The clock has moved. The substantive obligations have not.

On Saturday 9 May, EU institutions across Brussels and Luxembourg opened their doors for Europe Day 2026, marking the 76th anniversary of the Schuman Declaration of 9 May 1950. This year also marks two further milestones: 40 years since Portugal and Spain joined the EU, and 40 years since the first official Europe Day celebrations. The European Commission launched the day at the Berlaymont building at 10am CEST with an address by Executive Vice-President for a Clean, Just and Competitive Transition Teresa Ribera, under the official slogan “Europe’s Moment”.

The Berlaymont programme covered interactive thematic spaces on democracy and values, climate, prosperity, social justice, security, and Europe’s global role. The Council of the EU opened the Justus Lipsius building, where each of the 27 Member States hosted a stand. President of the European Council António Costa visited the stands and joined the day. The European External Action Service ran “Step Inside EU Diplomacy” with live video calls to EU staff worldwide. The European Committee of the Regions hosted the Festival of Regions and Cities. A festive march from the European Quarter ended at the Grand-Place at 4:45pm, where the city’s main square was draped in a large European flag. Luxembourg marks Europe Day on Sunday 10 May in Wiltz, highlighting cross-border regions and the 40-year anniversary of Portuguese and Spanish accession.

The political subtext, two days after the Digital Omnibus deal, is unavoidable. Europe Day asserts the values that justify the Union: peace, democracy, prosperity, integration. The Omnibus deal struck the previous Thursday morning is, on its face, a postponement of regulatory obligations to give industry time to comply. Read more strictly, it is a structural concession on the timeline at which the Union’s flagship AI safety law actually enters operational effect. Both can be true. The institutional warmth that surrounded Saturday’s celebrations is genuine. So is the question that civil society organisations including European Digital Rights and AlgorithmWatch raised over the weekend: whether “simplification” is a category of legal craft or a category of political surrender. Europe has given itself a moment. The substantive shift behind that moment is what industry spent the rest of the weekend reading.

The IEEE Conference on Artificial Intelligence (IEEE CAI 2026) closed on Sunday at the Escuela Técnica Superior de Ingeniería de Caminos, Canales y Puertos at the University of Granada. The three-day international conference, run by the IEEE Systems, Man, and Cybernetics Society, is an exhibition-led format focused explicitly on the application of AI to industrial verticals: healthcare and life sciences, sustainability, drones and UAVs, environmental monitoring, manufacturing, and the practical engineering work of moving AI systems from research into deployment.

Special Session S7-DRONES — AI-Enabled Drones for Environmental Monitoring and Sustainable Land Management — was convened by Jesús Rodrigo Comino (University of Granada, EGEMAP, DaSCI — the Andalusian Institute in Artificial Intelligence), Chris Xouris (Gaia Robotics), Manuel Seeger (Universität Trier), and Athanasios Kalogeras (Industrial Systems Institute / Research Centre ATHENA). The technical topics on the floor included multimodal data fusion (RGB, multispectral, LiDAR, thermal), edge AI and model pruning, low-power inference, federated learning, and explainable uncertainty-aware AI — the structural toolkit of European industrial AI work.

The weekend pattern is consistent with a story we have been tracking since the ARC European Industry Forum in Sitges on 4 May. Brussels debates how AI should be governed. Berlin convenes the founders. Granada and Sitges actually deploy. The IEEE CAI programme is not designed for policy commentary. It is designed for the engineering teams who will operate under whatever framework Brussels finalises. The Omnibus deal’s narrowed definition of “safety component” in Article 3(14) — products whose AI functions merely assist or optimise will no longer automatically be classified high-risk — is exactly the kind of provision shaped by the work happening on factory floors and in agricultural test sites. The two conversations are now visibly intertwined, even when the institutional and applied calendars do not appear to overlap.

Tomorrow is the deadline. NHS England’s internal guidance note SDLC-8, issued on 29 April, requires that all source code repositories “must be private by default” and may not be public “unless there is an explicit and exceptional need.” The exemption deadline was Tuesday 6 May. The compliance deadline is Monday 11 May — today, by the time most readers open this issue. Hundreds of public repositories will be made private. The justification, named explicitly in the guidance: the risk that frontier AI models — Anthropic’s Mythos in particular — could ingest the code and reason over it for vulnerabilities.

Across the weekend, the resistance kept building. An open letter on Keep Things Open has now passed 682 signatures, including former UK Health Secretary Matt Hancock, who called the policy a “huge mistake”. Critics, including former NHSX adviser Terence Eden who leaked the SDLC-8 guidance, argue that Mythos has likely already ingested the public code — closing it now does not retract that. Neither the UK AI Security Institute nor the NCSC has recommended this action. The NHS’s own service standard requires open-source publication of taxpayer-funded software. NHS England’s position, via a spokesperson to The Register: “We are temporarily restricting access to some NHS England source code to further strengthen cybersecurity while we assess the impact of rapid developments in AI models.”

The deadline holding through the weekend is itself the story. NHS England has not reversed course. The pushback has not slowed the policy. For European institutions watching how British public-sector bodies are operationalising their responses to frontier AI capability, the NHS lockdown going live tomorrow is the marker that signals what comes next. Other UK departments will be asked, in the days following, whether they intend to follow suit. The Cabinet Office’s Technology Code of Practice mandates open-source for public-sector projects. NHS England’s SDLC-8 sits in direct tension with that standard. The deadline is today. The wider policy reckoning starts tomorrow.