Brussels Strikes Deal to Thin Out AI Act and Outlaw Nudification Apps
May 7, 2026 – 8:11 am
After two failed trilogues, Parliament and Council finally reached a compromise that pushes the high-risk compliance deadline to December 2027, lightens paperwork for smaller firms, and writes a long-promised ban on non-consensual intimate imagery into Europe’s flagship AI law.
The European Commission confirmed on Wednesday that negotiators from the Parliament and the Council had finally reached political agreement on the so-called AI Omnibus, the package of amendments designed to soften the application of the bloc’s flagship Artificial Intelligence Act and bolt on a ban on AI-generated non-consensual intimate imagery.
It took three rounds to get there. The failed 28 April session collapsed after roughly twelve hours of haggling over how AI built into regulated products should be assessed for conformity. A Wednesday session, scheduled at short notice ahead of a 13 May fallback date, closed the gap.
Executive Vice-President for Tech Sovereignty Henna Virkkunen, who pushed the simplification drive through the College of Commissioners last November, said the deal would let companies “focus on building, not on paperwork”, framing it as proof that Europe can keep its rules-based approach while making them workable for industry.
Deadlines and Paperwork Changes
The highlight of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
The headline change is the timeline. Obligations on standalone high-risk AI systems listed in Annex III, covering biometrics, education, employment, essential services, law enforcement, justice, and border management, will now apply from 2 December 2027 rather than 2 August 2026. Rules for AI embedded in regulated products under Annex I take effect on 2 August 2028.
For companies sitting on partly built compliance programmes, that buys roughly sixteen extra months. Brussels insists the postponement is a function of unfinished standards work, not a retreat: harmonized standards from CEN-CENELEC and a fuller library of guidance documents are the precondition for switching the obligations on.
Smaller firms get more concrete relief. The agreement extends a set of simplifications already available to SMEs to small mid-cap companies, including templated technical documentation, lower fees, and easier access to regulatory sandboxes. The intent, repeated through the Commission’s press release, is to scale obligations to organizational size rather than apply a single compliance model to every provider in the value chain.
Ban on Nudification Included
The most politically charged element is the new prohibition on AI systems that generate child sexual abuse material or that produce non-consensual intimate images of identifiable people. Lawmakers had been pushing for it since the late-2025 Grok’s nudification scandal, and Parliament made it a red line for the trilogue.
The text now bans the placing on the market and use of AI tools whose primary purpose is to undress people in images or to depict identifiable individuals in sexually explicit scenarios without consent.