EU Council and Parliament Advance AI Act Overhaul, Delaying High-Risk Rules as Civil Society Warns of Rights Rollback
The EU Council and Parliament endorsed amendments delaying high-risk AI system deadlines by up to 16 months and banning nonconsensual deepfake imagery, as Amnesty International warns of a rights rollback.
Overview
The European Union is moving to reshape its landmark AI Act less than two years after its adoption, with both the Council of the EU and the European Parliament endorsing amendments that delay compliance deadlines for high-risk AI systems and introduce new prohibitions on nonconsensual sexually explicit deepfakes. The changes form part of the bloc’s broader “Omnibus VII” simplification package, which the European Commission framed as a bid to reduce regulatory burden and boost competitiveness. Civil society groups, led by Amnesty International, have pushed back sharply, calling the effort a corporate-driven dismantling of hard-won digital rights protections.
Council and Parliament Align on Delayed Timelines
On March 13, 2026, the Council of the EU adopted its negotiating position on the proposed amendments, which would push back the application date for standalone high-risk AI systems to December 2, 2027, and for high-risk systems embedded in products to August 2, 2028. Under the original AI Act timeline, those obligations were set to take effect starting August 2, 2026.
Five days later, the European Parliament’s Internal Market and Civil Liberties committees voted 101 to 9 in favor of a parallel set of amendments, with 8 abstentions. The Parliament’s version aligns closely with the Council on the delayed high-risk deadlines but goes further in one area: it shortens the deadline for watermarking requirements on AI-generated content to November 2, 2026, rather than pushing it back to February 2027 as the Commission had proposed.
Co-rapporteur Arba Kokalari of the European People’s Party emphasized the need for “predictable, stop-the-clock, simplified rules” to reduce barriers to investment in European AI development. The Parliament held a plenary vote on March 26, 2026, to finalize its mandate ahead of trilogue negotiations with the Council.
New Ban on Nonconsensual Deepfake Imagery
Both the Council and Parliament mandates introduce a new prohibition on AI systems that generate sexually explicit or intimate images resembling real individuals without their consent. The Council’s text also covers child sexual abuse material, while the Parliament’s version includes an exemption for systems that deploy effective safety measures to prevent such outputs.
Co-rapporteur Michael McNamara of the Renew group cited widespread public concern about so-called “nudification” applications as a driving factor behind the provision.
Expanded SME Relief and Database Requirements
The amendments extend compliance support measures beyond small and medium-sized enterprises to include small mid-cap companies, a change designed to ease the transition for growing firms that outpace SME thresholds. The Council mandate also reinstates the requirement for AI providers to register their systems in the EU database even when they consider those systems exempt from the high-risk classification, and preserves the “strict necessity” standard for processing sensitive personal data in the context of bias detection and correction.
The deadline for member states to establish regulatory sandboxes, originally set for August 2026, has been pushed to December 2, 2027, under the Council’s mandate.
Civil Society Raises Alarm
Amnesty International published a critique in April 2026 arguing that the simplification proposals, marketed as reducing red tape, amount to a rollback of fundamental rights protections designed to benefit large technology companies. The organization pointed to provisions that would eliminate transparency requirements such as publishing risk assessments to the EU database, allow high-risk systems to operate under grandfathering clauses, and remove safeguards against biased or harmful AI.
The group warned that the proposals threaten rights including privacy, nondiscrimination, freedom of expression, and democratic participation. Amnesty called on EU legislators to strengthen and enforce existing digital regulations rather than weaken them under pressure from industry lobbying.
What Comes Next
With both institutions having adopted their negotiating mandates, trilogue negotiations between the Council, Parliament, and Commission are expected to begin in the coming weeks. The anticipated timeline projects a political agreement by June 2026, with the amended regulation published by July 2026. Until then, the August 2, 2026, deadline for high-risk system compliance remains in legal limbo, leaving businesses and regulators in a holding pattern as the final text takes shape.