The Digital Omnibus Delay and AI Insurance Underwriting

The delay question resolved, and underwriting did not move

Insurance is a business of pricing risk today for a policy period that starts today. Through the first half of 2026 AI liability underwriters writing cover for European enterprises were not in a position to pause submissions until the Digital Omnibus concluded, because renewals, new business and capacity allocation decisions do not stop for a regulatory negotiation with no fixed close date. So they did not pause. They priced.

That is what makes the outcome informative rather than merely newsworthy. The Omnibus entered into force on 27 July 2026 and moved the Annex III high-risk date by sixteen months, from 2 August 2026 to 2 December 2027. If AI liability pricing had been driven by the statutory deadline, that would have shown up: softer terms, thinner submission requirements, capacity waiting for December 2027 to start asking hard questions. None of it happened. Specialist capacity continued to expand through the whole uncertain window and through the resolution of it, and the submission questions did not change.

The reason is structural. The Act's high-risk regime supplies a penalty, and a penalty is only one of the exposures an AI liability policy sits behind. The others did not move. Under Article 99, infringement of the Article 5 prohibitions carries fines of up to thirty five million euro or seven percent of worldwide annual turnover, and those provisions have applied since 2 August 2025. The EIOPA opinion of 6 August 2025 set out how insurers should align AI governance and risk management with Solvency II, the Insurance Distribution Directive, DORA and the GDPR, and it is supervisory guidance rather than a deadline, so it never had a date to move. The revised Product Liability Directive still applies from 9 December 2026. None of that supervisory architecture was contingent on the Omnibus, and none of it paused.

What moved, and what did not

The distinction underwriters hold clearly, and the one enterprises most often blur, is between the obligations the Omnibus moved and the obligations it did not touch. Exactly two things moved, and both are high-risk dates: Annex III standalone high-risk systems, from 2 August 2026 to 2 December 2027, and Annex I high-risk AI embedded in regulated products, to 2 August 2028. Everything else stayed where it was. The Article 5 prohibitions and the Article 4 AI literacy duty have applied since 2 February 2025. The GPAI obligations under Articles 53 and 55 have applied since 2 August 2025. The transparency obligations including Article 50 and the governance rules applied from 2 August 2026, and from that date the AI Office and the authorities of the Member States hold responsibility for implementing, supervising and enforcing the Act.

Directive (EU) 2024/2853, the revised Product Liability Directive, is the one to watch now. It applies from 9 December 2026 on its own legislative timeline, and nothing in the Omnibus touched that date. Note what that sequencing produces: the strict liability regime for defective AI-enabled products lands almost a full year before the Annex III high-risk obligations it is often discussed alongside. This directive extends strict liability exposure to defective AI-enabled products and services, shifts the burden of proof toward claimants in ways more favourable to them than the prior regime, and applies regardless of whether the enterprise in question falls inside or outside whatever high-risk perimeter the AI Act ultimately settles on. An enterprise, or an underwriter, that read news of the AI Act delay and concluded the compliance clock had generally slowed down is making an error that matters at claims time. The product liability exposure lands in December 2026 regardless, and our companion analysis of product liability directive readiness sets out what that means for coverage design specifically.

What FRIA and Article 9 to 17 documentation is worth to an underwriter now

The reason the whole uncertain window was manageable for underwriters, rather than paralysing, is that the documentation an enterprise produces to satisfy the EU AI Act's governance obligations was never valuable only because a legal deadline made it mandatory. A completed Fundamental Rights Impact Assessment under Article 27, a functioning Article 9 risk management system, current Article 10 data governance records, Article 14 human oversight assignments, and the broader Article 9 through Article 17 documentation set are all, from an underwriting perspective, evidence that a deployer understands its own AI system, has identified who could be harmed by it, and has built controls around that risk. Good governance practice of that kind does not stop being informative to an underwriter because a statutory deadline moved by a year and a half.

This is the same logic already established for how compliance paperwork becomes underwriting evidence more broadly, discussed in our analysis of whether AI insurance pays out without a completed FRIA. What the Omnibus deferral changed is when Annex III obligations become a strict legal requirement with regulator-facing enforcement behind them. It did not change whether the underlying documentation is useful to an underwriter deciding how to price a policy today. Enterprises that keep building this evidence base are rewarded by underwriters on the merits of the documentation itself, not on the basis of a compliance deadline that has or has not arrived.

This pattern is visible in how insurers active in this market are underwriting AI liability now. Munich Re's aiSure performance cover, extended to up to fifteen million euro, US dollar, or Canadian dollar equivalent through its February 2026 partnership with Mosaic, prices against measured AI performance rather than a compliance checkbox. Armilla, writing as a Lloyd's coverholder with limits up to twenty five million US dollars per organisation, and the Artificial Intelligence Underwriting Company's AIUC-1 standard, which sits behind the first AI agent policy secured by ElevenLabs, both build their underwriting submissions around governance and evidence categories that map closely to the AI Act's own documentation requirements. None of these products are waiting for the Digital Omnibus outcome to decide what counts as good evidence.

What the sixteen months are actually for

The deferral has one real effect on pricing and it is narrow. A missing piece of Article 9 or Article 27 documentation looks different to an underwriter when the enterprise has until 2 December 2027 to complete it than when the deadline has already passed. Pricing for that specific gap softens somewhat. Policy wording built around demonstrated governance, rather than around the existence of a statutory deadline, is unaffected.

The larger effect runs the other way, and it is a timing effect rather than a pricing one. Most European enterprises will see one or two renewals before 2 December 2027. The evidence file that will be a legal requirement then is being asked for at every one of those renewals now. An enterprise that builds it in the next four quarters builds it on its own schedule, at its own cost, and collects the underwriting credit for it at each renewal in the interval. An enterprise that waits until 2027 builds the same file under deadline pressure, pays more for the consultancy because everyone else is buying it in the same quarter, and takes worse terms in the meantime. There is also something an underwriter reads in the choice itself: an enterprise that visibly paused governance work when a regulator gave it permission to has said something about its risk culture that is relevant to pricing.

This is also the pattern EIOPA's opinion of 6 August 2025 anticipated at the insurer level. By asking European insurers to align AI governance and risk management with existing Solvency II, IDD, DORA and GDPR frameworks rather than waiting for AI-specific supervisory rules to be finalised, EIOPA effectively told the market that governance obligations do not pause for regulatory sequencing elsewhere. The same logic now applies symmetrically to the enterprises those insurers are underwriting. Our companion review of the EIOPA February 2026 survey on insurer AI readiness sets out how that alignment is progressing across the market.

Practical guidance for enterprises seeking coverage in this window

The operating instruction for an enterprise seeking AI liability coverage in the second half of 2026 is now straightforward, and the regulatory backdrop is settled enough to state it plainly. Document to the higher compliance bar on the pre-Omnibus schedule, not the post-Omnibus one. A completed FRIA where Article 27 applies, a current Article 9 risk management system, Article 10 data governance records and Article 14 human oversight documentation are underwriting assets at the next renewal, which is well before December 2027. Treating the deferral as a reason to deprioritise the work forgoes underwriting credit that is available now and moves the cost of the work into the quarter when every other European deployer is buying the same help.

Enterprises should also keep the Product Liability Directive separate in their planning. A December 2026 readiness plan for Directive (EU) 2024/2853 proceeds on its own fixed timeline, and it is now the nearer of the two deadlines by almost a year. Finally, enterprises engaging with underwriters should expect submissions to be evaluated on the evidence provided rather than on where the compliance calendar sits, since that is demonstrably how this market priced the whole Omnibus period. For the questions themselves, see what AI insurance underwriters ask before writing a policy, and for what the resulting cover does and does not pay for, what AI agent insurance covers and what it costs.

Readers tracking what the Omnibus in force changes for cover specifically can read the Omnibus in force and its AI agent insurance implications, and the wider deployer picture at agentliability.eu. The Agent Insured waitlist is open for European enterprises preparing for AI liability coverage and gives access to the Agentic Liability Monitor briefing, which tracks how underwriting standards are developing as both the AI Act enforcement period and the Digital Omnibus trilogue progress.