Brussels reaches an agreement to streamline the AI Act and ban nudification applications.

      Following two unsuccessful trilogues, Parliament and Council have finally reached a compromise that extends the compliance deadline for high-risk AI systems to December 2027, reduces paperwork for smaller companies, and incorporates a long-awaited ban on non-consensual intimate imagery into Europe’s leading AI legislation.

      On Wednesday, the European Commission confirmed that negotiators from both Parliament and Council achieved a political agreement on the AI Omnibus, a set of amendments aimed at easing the application of the EU's primary Artificial Intelligence Act while introducing a prohibition on AI-generated non-consensual intimate imagery.

      It took three attempts to reach this point. The failed session on April 28 ended after about twelve hours of negotiations regarding the assessment of AI integrated into regulated products for compliance. A session held on Wednesday, which was scheduled last minute in advance of a fallback date on May 13, successfully bridged the remaining gaps.

      Henna Virkkunen, the executive vice-president for technology sovereignty, who has championed the simplification efforts since last November, stated that the agreement would allow companies to “focus on building, not on paperwork,” emphasizing that this demonstrates Europe’s ability to maintain its rules-based approach while ensuring they are practical for the industry.

      Key changes include a revised timeline for compliance. Obligations for standalone high-risk AI systems listed in Annex III—covering areas such as biometrics, education, employment, essential services, law enforcement, justice, and border management—will now come into effect on December 2, 2027, instead of August 2, 2026. Regulations for AI embedded in regulated products under Annex I will begin on August 2, 2028.

      For companies working with partially developed compliance programs, this offers approximately sixteen additional months. Brussels asserts that the delay is due to incomplete standards work, not a retreat: the activation of these obligations is contingent upon harmonized standards from CEN-CENELEC and a comprehensive library of guidance documents.

      Smaller businesses will experience more tangible relief. The agreement expands a set of simplifications currently available to SMEs to include small mid-cap companies, offering benefits like standardized technical documentation, reduced fees, and easier access to regulatory sandboxes. The goal, reiterated in the Commission’s press release, is to tailor obligations according to organizational size rather than impose a uniform compliance model across the entire value chain.

      The most politically significant aspect is the newly established prohibition on AI systems that create child sexual abuse material or generate non-consensual intimate images of identifiable individuals. Lawmakers have been advocating for this since the late-2025 outrage surrounding Grok’s nudification case, with Parliament declaring it a non-negotiable point in the trilogue.

      The new regulations prohibit the marketing and use of AI tools whose primary function is to undress individuals in images or portray identifiable persons in sexually explicit contexts without consent. Companies have until December 2, 2026, to align existing products with these rules.

      This ban does not apply where developers have implemented effective safety measures to prevent generation and misuse, a provision designed to protect general-purpose models that already filter such outputs.

      TNW reported on the political agreement regarding intimate deepfakes when Parliament included it in its mandate in late March; the trilogue text largely reflects this stance, although enforcement responsibility now lies primarily with national market-surveillance authorities and the AI Office instead of sectoral regulators.

      Critics will point out that the package preserves the fundamental structure of the AI Act. The risk-based pyramid remains unchanged. Rules regarding foundation models, effective since August 2025, are not altered. The Code of Practice for general-purpose AI providers will continue to be applied voluntarily. Although watermarking requirements for AI-generated content have been postponed from February to December 2026, they remain mandatory.

      More than forty civil-society groups, which previously signed a letter opposing the Omnibus in April, contend that the narrative of simplification masks genuine reductions in fundamental rights protections, especially regarding biometric identification and AI applications in educational settings. Their concerns persist following the agreement, as the trilogue did not revisit the substantive obligations, only their timing and paperwork.

      Conversely, the industry interprets the package as part of a broader effort to enhance competitiveness that also includes the simplification of GDPR and the review of the Data Act. This conclusion is supported by the fact that every concession in the AI Omnibus pertains to procedural adjustments rather than substantial changes.

      The political agreement still requires formal approval by the Parliament’s plenary session and by ministers in the Council, which is anticipated before the summer break. If this approval is not secured, the initial high-risk deadline of August 2, 2026, will remain in effect, a scenario the Commission has sought to prevent for the past six months.

      Meanwhile, national authorities have their own responsibilities: they must develop the simplified documentation forms, sandbox templates, and SMC guidance ahead of the new deadlines, or the relief indicated on paper will not translate into practical relief.