This month of May, three signals have discreetly hardened what is expected of us: proof. For an AI management, the question is no longer the calendar, it is the lineage.
May 2026 will have saturated the AI agenda with a European postponement, a G7 cyber benchmark, a revised OECD framework, and even an encyclical from Pope Leoartificial intelligence. At this rate, we’re off! But anyone who takes the time to reread these texts together hears a unique message, and it doesn’t feel like a respite. It looks like a call to order.
On the night of May 6 to 7, the Council of the Union and Parliament agreed on the Digital Omnibus on AI. The high-risk systems in Annex III, expected for August 2, 2026, slide to December 2, 2027. Those in Annex I, to August 2, 2028. The reason is valid: the harmonized standards of CEN-CENELEC JTC 21, supposed to mark compliance, will not arrive on time. A postponement of confession because no one was ready, neither Brussels nor the companies.
Caution is necessary, and it weighs. The agreement remains provisional. As long as it has not been formally adopted, before August 2, 2026, the original dates of article 113 retain the force of law. Setting a compliance plan to a deadline that is absent from the Official Journal is building on sand.
Let us admit the acquired carryover. The error is not there. It consists of confusing an extended deadline with a reduced requirement. May 2026 said the opposite. Three times.
The same month, three times “prove”
On May 12, the G7 cybersecurity working group published a text that almost no one saw: the SBOM for AI, a minimum nomenclature for documenting an end-to-end artificial intelligence system. Co-led by Italy (ACN) and Germany (BSI), signed by the cyber agencies of the seven countries: ANSSI for France, with the Canadian CSE, the American CISA, the British NCSC and the Japanese NCO in conjunction with the European Commission. Seven clusters structure traceability: metadata, models, datasets, system properties, performance indicators, security, infrastructure. The issue? Shedding light on what classic SBOMs leave in the shadows, these risks that ordinary code does not know about, data poisoning, prompt injection, alteration of weights. For an operator, the message is unambiguous: you will be asked for the genealogy of your models, their training data, their dependencies. Not a statement of intent.
At the same time, in Paris, on the sidelines of the G7 Digital Ministerial under the French presidency, the OECD is revising its notification framework resulting from the Hiroshima process. Version 2.0, designed to involve SMEs in reporting. Voluntary transparency moves down the chain from large models to mid-sized publishers and deployers. Yesterday reserved for giants, it has become an ordinary expectation.
As for the Omnibus, which is sold as a relaxation, it also restores the registration of high-risk systems in the European database. Fewer loopholes, more public visibility. The slope, again, goes down towards the proof.
Three texts, one direction. The schedule loosens while the documentation tightens. This is what the word “simplification” conceals: lightening the declaration most often amounts to making the demonstration heavier.
The question has changed
For AI management, the shift is clear. Yesterday: am I on time? Tomorrow: will I be able, on the day of an investor check or due diligence, to say where this model comes from, on what data it was learned, who composed it, who validated its use? The report does not answer it. It provides time to prepare. Or to do nothing.
The most reassuring thing can be summed up in one sentence: the heart of this project does not depend on overdue standards. AI committee, responsible use policy, validation process for new cases, inventory of systems and lineage, everything is being built today, on the ISO/IEC 42001 foundation and information security already in place. These eighteen months are not for waiting for standards. They are used to show up in 2027 with evidence, not promises.
I spent May watching these texts pile up. What strikes me is not their number, it is their silent convergence. We talked a lot about respite. Almost no one saw that at the same time, the price of entry was going up. The organizations that win this window will not be those that waited the longest. They will be the ones who, when the day comes, will open the hood of their systems without breaking a sweat.
