After a marathon negotiating session that stretched past 4:30 a.m. on May 7, the European Parliament and the Council of the EU reached a provisional agreement on the Digital Omnibus on AI, pushing back the enforcement of high-risk AI system obligations by more than a year while simultaneously introducing a new EU-wide ban on AI-generated child sexual abuse material and non-consensual intimate imagery. The deal rewrites the compliance calendar for what remains the most ambitious AI regulatory framework on the planet — and companies building or deploying high-risk AI in Europe now have until late 2027 to get ready.
The New Timeline
The original EU AI Act, which entered into force on August 1, 2024, had set August 2, 2026 as the date when obligations for high-risk AI systems would begin to bite. That deadline is now effectively dead. Under the Omnibus agreement, standalone high-risk AI systems classified under Annex III — covering use cases in biometrics, critical infrastructure, education, employment, law enforcement, and border management — must comply by December 2, 2027. AI systems embedded as safety components in regulated products covered by Annex I, such as medical devices, machinery, and connected vehicles, get an even longer runway: August 2, 2028.
The rationale is operational rather than political. The harmonized standards that providers need to demonstrate conformity with the AI Act have not been finalized on schedule. National competent authorities and notified bodies — the institutional machinery required to actually enforce the rules — have lagged behind in several member states. The regulatory infrastructure simply was not ready.
But August 2, 2026 is not disappearing entirely. Article 50 transparency obligations, including the requirement to disclose when users are interacting with AI-generated content, remain on the original schedule. AI systems already on the market get a four-month grace period for watermarking requirements, extending that specific deadline to December 2, 2026.
The Nudifier and CSAM Ban
The most striking addition to the AI Act was not part of the European Commission's original Omnibus proposal. Co-rapporteur Michael McNamara, a Renew Europe MEP from Ireland who led negotiations in the civil liberties committee, said after the deal was struck: "Alongside simplification measures, we are banning nudification apps, a key part of the Parliament's mandate, and, of course, the creation of child sexual abuse material using AI systems."
The new prohibition under Article 5 bans AI systems that generate non-consensual intimate imagery or CSAM. Critically, the ban does not only target systems explicitly designed for abuse. It extends to any AI system where such generation is a reasonably foreseeable outcome and the provider has failed to implement adequate technical safeguards. Companies building general-purpose image or video generation tools will need to actively assess misuse risks at both the design and deployment stages. The prohibition takes effect December 2, 2026.
The push for the ban was catalyzed by the wave of AI-generated sexual deepfakes produced by Grok last winter, which involved millions of cases and triggered a Dutch court order against X. Parliament and member states concluded that existing remedies under the Digital Services Act and national criminal law were insufficient and that intervention at the model level was necessary.
The Industrial AI Standoff
The deal nearly collapsed one week before it was finalized. The core dispute concerned AI embedded in regulated products — machinery, toys, medical devices, and connected cars — that are already subject to existing EU sectoral safety legislation. The European Parliament, acting as the most vocal advocate for industry concerns, pushed to exempt these sectors from the AI Act entirely, arguing that a second layer of regulation would create burdensome duplication.
Co-rapporteur Arba Kokalari, an EPP MEP from Sweden, framed the outcome in competitive terms: "We now make the AI rules more workable in practice, remove overlaps and pause the high-risk requirements. In order for Europe to become an AI continent, we need to promote innovation, support startups and scaleups and make it easier to build AI in Europe."
In the end, only the machinery sector — one out of twelve regulated product categories — was carved out from the AI Act's framework, and even that carve-out remains tethered to the Act through bridging standards. German Chancellor Friedrich Merz had personally lobbied for broader exemptions, securing backing from France and Italy, but the Council and Commission held firm on preserving the AI Act's horizontal architecture for the remaining eleven sectors.
Other Key Changes
The agreement makes several additional modifications. The legal basis for processing sensitive personal data for bias detection has been expanded to all AI systems and general-purpose models, subject to strict necessity safeguards. The AI literacy obligation under Article 4 has been softened to an obligation of means. SME exemptions now extend to small mid-cap enterprises. The deadline for member states to establish AI regulatory sandboxes has been pushed back one year, to August 2, 2027. And the EU AI Office gains expanded enforcement powers, including exclusive competence over AI systems built on general-purpose models where the model and system share the same provider.
What Comes Next
The provisional agreement must still be formally adopted by both Parliament and Council and published in the Official Journal before it carries legal force. That process is expected to conclude before August 2, 2026. Until then, the original deadlines technically remain in effect.
For companies, the message is contradictory but clear: the new dates provide breathing room, but the compliance architecture takes time to build. The transparency obligations under Article 50 are arriving on schedule this August regardless. And the Omnibus is only a precursor to what may prove a far more consequential battle — the Data Omnibus, which proposes changes to GDPR that could reshape how personal data flows into AI training pipelines. The simplification wave in Brussels is just getting started.
“We are banning nudification apps, a key part of the Parliament mandate.”— Michael McNamara, Co-rapporteur, Renew Europe MEP