Less than 90 days. One law. The deadline most hotels thought was gone just came back.
On the evening of 28 April 2026, after roughly twelve hours of negotiation in Brussels, the second political trilogue on the EU AI Act Digital Omnibus ended without agreement. The Digital Omnibus, the European Commission's simplification package proposed in November 2025, was meant to postpone high-risk AI compliance obligations from 2 August 2026 to 2 December 2027. A follow-up trilogue is scheduled for approximately 13 May 2026. If that fails, or if a deal cannot move through formal adoption and Official Journal publication in time, the original deadline applies as written. That is fewer than 90 days from this writing. The question is part of the broader trust infrastructure for hotels argument the regulatory environment is now pulling forward.

Why did the Digital Omnibus trilogue fail on 28 April?

The collapse was striking because the headline element of the file, the postponement of high-risk obligations to 2 December 2027, was not the issue in dispute. Council and Parliament had converged on those dates. The unresolved file was the conformity assessment architecture for AI embedded in products already governed by EU sectoral safety law (Annex I to the AI Act). A single disagreement on that file was sufficient to block the entire package.
A further trilogue is expected on or around 13 May 2026. If the Omnibus is not formally adopted before 2 August 2026, the original AI Act deadlines remain in force. Compliance programmes recalibrated to the Omnibus timeline since November 2025 are now exposed.

What is the actual EU AI Act fine for hotels?

In every conversation with European hotel General Counsel and CFOs over the last six months, the headline number that comes up is €35 million or 7 percent of global turnover.
That number is in the Act. It does not apply to hotels.

The €35M / 7% ceiling sits in Article 99(3) and applies to prohibited practices under Article 5: social scoring, real-time biometric surveillance, certain emotion recognition in workplaces. A hotel running pricing AI, recommendation engines, or workforce management does not fall into that tier.

The fine that applies to hotels sits in Article 99(4): up to €15 million or 3 percent of global annual turnover, whichever is higher. It applies to non-compliance with the operator-level obligations of providers (Article 16) and deployers (Article 26) of high-risk AI systems, which is the legal mechanism through which the high-risk operational requirements of Articles 8 to 15 (including risk management, data governance, record-keeping, transparency, human oversight, and resilience) become enforceable. Compounded across systems and properties, real exposure for a European hotel group runs into the millions.

Hotels preparing for the wrong number are buying compliance theatre: policy frameworks, vendor questionnaires, ethics committees, all designed for a tier that does not apply to them. The high-risk tier requires something different. Theatre is built by lawyers. Evidence has to be built into the system that makes the decision.

Which hotel AI systems are high-risk under Annex III, point 4?

Annex III, point 4 covers AI used in employment and workers' management. For hotels, that means recruitment and screening, application evaluation, decisions on promotion or termination, task allocation by behavioural attributes, and staff performance monitoring. This category triggers the obligations of Article 15(4) on resilience, Article 12 on record-keeping, and Article 13 on transparency.

Guest-facing AI is more nuanced. Chatbots interacting with guests fall clearly under Article 50 transparency, which requires disclosure that the user is interacting with AI. Dynamic pricing and recommendation engines occupy contested ground. Some regulators apply the lighter Article 50 regime; others argue Article 6(3) classification can apply where the system materially affects an individual's access to a service. The regulatory consensus on guest-facing pricing is forming, not settled.

What is unambiguous is workforce-management AI. The schedulers and performance dashboards that decide who closes which shift sit squarely inside Annex III, point 4. The inverse mistake is visible in the market: hotels investing heavily in compliance for guest-facing AI where the regulatory weight is lighter, while treating the workforce systems as routine operational software. They are not.

What does Article 15(4) require, and why can cloud architecture not deliver it?

The text of Article 15(4), verbatim, reads: "High-risk AI systems shall be as resilient as possible regarding errors, faults or inconsistencies that may occur within the system or the environment in which the system operates."

The dominant regulatory reading treats "as resilient as possible" as a maximum-resilience standard, not a minimum. The legal question a national supervisor will ask is not whether the system has some resilience. The question is whether more resilience was achievable using available technology, and if it was, why it was not implemented.

Cloud primitives such as hardware security modules, confidential compute, and regional redundancy do exist. The structural gap is that typical hospitality deployment patterns do not compose those primitives into a topology where high-risk AI decisions are signed at hardware level and stored in a local immutable ledger that survives network failure. They run with database logs and quarterly backups.

A reconstructed log is a story. A hardware-signed record at the moment of decision is evidence. The AUVA-X on-premise architecture delivers Article 15(4) defensibility by composition: hardware-signing at source, local immutable ledger, network-independent continuity.

What should General Counsel, CFOs, and CTOs do in the next 90 days?

If you are a General Counsel, the Article 15(4) defensibility audit needs to be on the executive committee agenda before end of May. Inventory every high-risk AI system in scope, with workforce-management as the unambiguous priority. For each, document what evidence the system produces at the moment of decision, who can demonstrate it to a national supervisor, and how long it persists.

If you are a Chief Technology Officer, by 30 June you need an architectural option that generates hardware-signed evidence for every workforce-management AI decision your properties make. Ask cloud vendors to demonstrate the evidence chain surviving an eight-hour outage. Most cannot. Edge architectures for hospitality close that gap.

If you are a Chief Financial Officer, the math compounds: €15 million or 3 percent of global turnover, per breach of operator obligations, multiplied by systems, multiplied by properties. The same architectural shift also resolves the hotel cloud outage continuity risk and the pricing latency problem.

Cloud vendors promise compliance. We engineer it into the building.

Frequently Asked Questions

Conclusion: One Law, Less Than 90 Days

The political question of whether the high-risk deadline gets postponed remains open. The operational question of what hotels should do in the meantime is settled. Plan against the original deadline. Inventory the high-risk AI systems in scope. Build the evidence pipeline that Article 15(4) requires, and build it into the architecture rather than into a binder of policies.
The Digital Omnibus may yet be adopted before 2 August. It may not. The hotels that absorb the deadline either way will be the ones that built defensibility into the system that makes the decision, rather than into the documentation that describes it.