A provisional political agreement reached on 7 May 2026 extends the EU AI Act's compliance deadlines for high-risk systems, but carves out one prohibition that will take effect sooner: a ban on AI systems that generate non-consensual intimate imagery, effective from December 2026. The deal itself is not yet law, but formal adoption by the European Parliament and Council is expected in July 2026, ahead of the original August 2026 trigger dates.
What the Omnibus Deal Actually Changes
The EU Council and European Parliament reached a provisional agreement on targeted amendments to the EU Artificial Intelligence Act — the first substantial revision since the regulation entered into force in 2024. The deal adjusts timelines, expands who benefits from lighter compliance rules, and adds a category of outright prohibition. It does not rewrite the Act's core architecture.
The two high-risk categories get different extensions. Standalone high-risk systems under Annex III (covering employment, education, biometrics, critical infrastructure, and migration) get 16 additional months, moving their compliance date from 2 August 2026 to 2 December 2027. Annex I systems — AI embedded in regulated products like medical devices and lifts — get 12 months, shifting their deadline from 2 August 2027 to 2 August 2028. National regulatory AI sandboxes, originally due by 2 August 2026, are similarly pushed back 12 months to 2 August 2027.
The Nudifier Ban: A New Floor for EU Law
The most immediately consequential change is a new prohibition in Article 5, which bans AI systems that generate or manipulate sexually explicit or intimate images, video, or audio without the subject's consent. The prohibition extends to systems where such output is a reasonably foreseeable outcome, not only those explicitly designed for it. AI-generated child sexual abuse material falls under the same prohibition. Both are effective 2 December 2026.
Penalties match the Act's top tier: fines of up to €35 million or 7% of annual worldwide turnover, whichever is higher. A safe-harbour provision exists for systems with effective preventive safeguards built in. That clause will likely become a focal point for compliance teams and, later, for enforcement disputes.
Watermarking: The Trilogue Compressed the Window
While most deadlines were extended, one was tightened. The European Commission's draft proposal had offered a six-month grace period for watermarking and synthetic-content disclosure under Article 50(2) for generative AI systems already on the market before 2 August 2026. The European Parliament pushed for three months. The trilogue compromise, confirmed by William Fry and Gibson Dunn, landed at four months — meaning these systems must comply by 2 December 2026. Any product team with a generative feature touching EU users should be treating December 2026 as a hard engineering deadline.
Broader Scope for Mid-Sized Companies
The Act's simplified compliance framework (lighter documentation, reduced fines, sandbox access) previously applied only to SMEs. The Omnibus extends these benefits to small mid-cap companies, defined as those with up to 750 employees and €150 million in annual revenue. A broader tier of European tech firms, including mid-sized SaaS and enterprise AI vendors, now qualifies for the lighter-touch regime.
The European Data Protection Board and European Data Protection Supervisor issued Joint Opinion 1/2026 in January 2026 — a response to the Commission's draft proposal, published before the 7 May political agreement was reached. The bodies supported streamlining in principle but warned that delaying essential requirements for high-risk systems risks leaving people unprotected during one of the fastest periods of AI deployment on record. Specific concerns included proposals to lower the threshold for processing special-category data and to weaken mandatory AI literacy obligations, and opposition to deleting mandatory registration for self-assessed non-high-risk systems. The final deal appears to have preserved the registration obligation — a point the co-legislators had resisted removing despite the Commission's proposal — though the full consolidated text will confirm the extent to which other EDPB recommendations were reflected.
It became law with days to spare
Formal adoption was expected in July, before the original August trigger dates arrived. That is what happened, and the margin was narrow.
The European Parliament adopted the agreed text on 16 June 2026 and the Council followed on 29 June. The measure was published in the Official Journal on 24 July as Regulation (EU) 2026/1744 and entered into force on 27 July, three days after publication. The obligations it defers were due to apply from 2 August.
The AI omnibus was deliberately separated from the wider Digital Omnibus package and fast-tracked for exactly this reason. A deadline extension that arrives after the deadline is not an extension, and the legislature had to move a date in an in-force regulation with about a week of headroom.
The revised dates are now settled rather than provisional. Annex III standalone high-risk systems apply from 2 December 2027, Annex I embedded systems from 2 August 2028, and national regulatory sandboxes from 2 August 2027.
What a sixteen-month deferral actually concedes
The core architecture was left alone, and that remains the case. What moved was the compliance deadline.
Employment, education, biometrics, critical infrastructure and migration are the Annex III categories. Those are the deployments where an unreviewed system does identifiable harm to identifiable people, and they are now three and a half years from the regulation entering into force before their obligations attach.
The stated reason is that harmonised standards and conformity-assessment infrastructure were not ready, which is accurate and is also a statement about how long it takes to build the machinery a risk-based regime needs. A rule that cannot be conformed to cannot be enforced, and the choice was between deferring the date and enforcing a requirement no one could satisfy.
The December 2026 prohibition on systems generating non-consensual intimate imagery was not deferred with the rest. Prohibitions need no conformity infrastructure, which is why that date held while the high-risk dates moved.
Europe pushed its dates back while Asia's came forward
Over the same months, three jurisdictions moved in three different directions.
Korea's AI Basic Act and its Enforcement Decree took effect on 22 January and have been running since, with penalties capped at ₩30 million, roughly US$20,000, and suspended for a year except where life or human rights are at stake. Vietnam's standalone AI law has been in force since 1 March, applies to foreign as well as domestic entities, and gives most providers until March 2027, or September 2027 in health, education and finance.
Both are in force now with modest teeth. The EU has strong teeth attached to dates in 2027 and 2028. Which approach produces better outcomes remains an open question. A company operating in both places faces a more immediate one, because the Asian obligations are already live while the European ones are not.
What this means for an ASEAN business selling into Europe
Sixteen months is long enough to change a product roadmap. It is too short to justify changing a compliance one.
An exporter building for Annex III conformity now has until December 2027 rather than August 2026, which removes a cliff edge for firms that were not going to make it. It does not remove the requirement, and the conformity-assessment capacity that was too thin to support an August 2026 deadline will be competing for the same scarce assessors in 2027 with a larger queue.
The regional rulebook is moving on its own track. ASEAN's Digital Economy Framework Agreement is due for signature in November, and in the ten weeks after negotiations closed, five member states legislated separately in areas it covers. A business in this region is therefore tracking three clocks at once, and the European one is now the slowest of them.
View author profile → · Editorial policy
