EU Seals Digital Omnibus Deal on AI Act, Pushing High-Risk Deadlines to 2027 and Banning Nudifier Apps
The European Parliament and Council reached a provisional political agreement on May 7 to simplify the AI Act, shifting key compliance deadlines and adding a new ban on nonconsensual intimate imagery.
Overview
After months of trilogue negotiations, the European Parliament and Council of the EU reached a provisional political agreement on May 7 to amend the AI Act through a package known as the Digital Omnibus on AI, according to the European Commission. The deal extends compliance deadlines for the most sensitive categories of artificial intelligence systems, adds a new prohibition on AI tools that generate nonconsensual sexual imagery, and streamlines obligations for smaller companies — while stopping short of the broader sectoral exemptions that the Parliament had initially sought.
As previously reported, both institutions had separately endorsed their negotiating mandates in March and April, with both converging on the need to extend the August 2, 2026 application date for high-risk AI systems. The May 7 agreement brings those positions into a provisional text, though formal adoption by both Parliament and the full Council is still required before it carries legal force.
What Changes — and What Does Not
The most consequential shift in the deal is the extension of compliance timelines for high-risk AI systems. Under the original AI Act, many of the regulation’s core obligations for high-risk systems were due to take effect on August 2, 2026. The provisional agreement now sets two new deadlines, according to the European Commission’s AI Act overview: December 2, 2027 for standalone high-risk AI systems such as those used in biometrics, critical infrastructure, education, employment, migration, border control, law enforcement, and the administration of justice; and August 2, 2028 for high-risk AI systems embedded in regulated products governed by sectoral EU safety laws.
Several provisions were already in effect before this deal. The prohibitions on “unacceptable-risk” AI practices, including real-time biometric surveillance in public spaces, entered application on February 2, 2025, and the governance rules for providers of general-purpose AI models became applicable on August 2, 2025. Those timelines are unchanged, per the Commission.
The AI Act’s general application date of August 2, 2026 remains in place for transparency rules and other obligations not covered by the extensions — but the relief for high-risk system operators is substantial, particularly for organizations that had been racing to meet the original summer deadline.
New Prohibition: A Ban on Nudifier Tools
The provisional agreement adds a new category to the AI Act’s prohibited practices: AI systems whose purpose is to generate or manipulate sexually explicit or intimate images of identifiable real persons without their consent. The ban also covers AI-generated child sexual abuse material. These prohibitions are set to take effect on December 2, 2026, giving providers roughly six months to comply, according to the European Parliament’s position adopted ahead of the final deal.
The provision was introduced by the Parliament and was driven in part by the Grok incident in early January 2026, when large numbers of users exploited xAI’s image generation tool to produce nonconsensual nude images of real women and girls, triggering investigations by regulators across Europe, India, and Australia. The Council accepted the nudifier prohibition as part of the final text.
The Parliament had also sought to expand the nudifier ban to cover systems with “reasonably foreseeable” misuse, even when not explicitly designed for that purpose, subject to adequate safety measures. That framing reflects the Parliament’s position, per its March plenary vote, in which MEPs approved the amendments by 569 votes to 45, with 23 abstentions.
Simplified Rules for Smaller Companies
The deal extends a range of regulatory privileges — simplified technical documentation, proportionate quality-management requirements, and priority access to AI regulatory sandboxes — to small mid-cap companies, a category that goes somewhat beyond the small and medium-sized enterprise definition used in earlier drafts, according to the European Commission. The rationale is that slightly larger companies without significant corporate resources face compliance burdens comparable to true SMEs.
AI literacy obligations are also softened. The original AI Act required deployers to ensure a sufficient level of AI literacy among staff. The amended text replaces that outcome-based standard with a softer means-based obligation, requiring organizations to take measures to support the development of AI literacy rather than to demonstrate a particular result, as analyzed by TechPolicy.Press.
The agreement also expands the conditions under which sensitive personal data — including data on race, health status, and sexual orientation — may be processed for bias detection and correction. That permission now applies to all AI systems, not just those classified as high-risk, though it is subject to strict necessity and security conditions, per TechPolicy.Press.
The Machinery Carve-Out and What Parliament Didn’t Get
One of the Parliament’s core demands during negotiations was a broad exemption from AI Act compliance obligations for sectors already governed by EU product-safety legislation — covering everything from medical devices to automotive components. That effort fell short. The final deal grants an exemption only to AI systems covered by the EU Machinery Regulation, according to TechPolicy.Press. For machinery, the Commission gains authority to adopt delegated acts specifying any additional AI-specific safety requirements, with full AI Act rules set to reintegrate by August 2028.
Industry groups and civil society organizations have responded to the deal with mixed assessments. Consumer advocates warned that some of the data-processing expansions could create new risks to fundamental rights, while some technology industry associations argued the simplification measures did not go far enough, according to reporting by TechPolicy.Press.
Strengthened AI Office and EU Sandboxes
The agreement also expands the enforcement toolkit of the European AI Office, which was established under the AI Act to oversee providers of general-purpose AI models. The Office gains additional inspection and investigation powers, and the deal clarifies its exclusive competence over situations where a single provider develops both the underlying AI model and the downstream application — including within corporate groups, according to the European Commission.
A new EU-level regulatory sandbox is established alongside the national sandboxes that member states are required to stand up by August 2, 2027. The EU sandbox is intended to give AI developers a testing environment that spans the single market, rather than navigating separate national arrangements.
What Comes Next
The May 7 agreement is provisional and political. The actual text must still go through formal adoption procedures — votes in the European Parliament and endorsement by the full Council — before it is published in the Official Journal and enters into force. Until then, the original August 2, 2026 deadline for the AI Act’s general application continues to apply as the operative legal framework.
A separate legislative package, referred to as the Data Omnibus, remains in preparation and is expected to address broader questions about GDPR’s interaction with AI training, including changes to how personal data definitions apply to AI systems, according to TechPolicy.Press. That package is likely to attract considerably more controversy, as it touches on the core data protection principles that the original GDPR established.