EU eases AI Act for businesses while cracking down on deepfake nudes: Omnibus deal extends high-risk AI deadlines to late 2027 and bans nudification apps from December 2026
What it really says
On May 7, 2026, the Council of the EU and the European Parliament reached a provisional political agreement on the Digital Omnibus on AI, which amends the EU AI Act in several key ways. First, compliance deadlines for high-risk AI systems are significantly extended: AI systems in sensitive areas such as biometrics, critical infrastructure, education, employment, law enforcement, and migration (Annex III) now have until December 2, 2027 to comply instead of the originally planned August 2026. AI systems embedded in products covered by EU product safety legislation such as medical devices or machinery (Annex I) have a new deadline of August 2, 2028. Second, two new prohibitions are introduced: AI systems for generating or manipulating non-consensual intimate images, video, or audio (so-called nudification apps) and AI for generating child sexual abuse material will be banned from December 2, 2026. The prohibition extends beyond systems explicitly designed for such purposes to any system where such generation is a reasonably foreseeable outcome and the provider has not implemented adequate technical safeguards. Third, SMEs and small mid-cap enterprises receive tailored accommodations. The deadline for establishing regulatory sandboxes by national authorities is pushed to August 2, 2027. The grace period for transparency solutions for AI-generated content is reduced from six to three months, with a new deadline of December 2, 2026. Formal adoption by Parliament and Council is expected in June or July 2026.
Our assessment
This Omnibus agreement is good news on two levels. On one hand, it gives businesses significantly more time to implement the complex requirements for high-risk AI. The original August 2026 deadline was unrealistic for many companies, as technical standards and guidelines have only recently become available. The extension to late 2027 or mid-2028 is a pragmatic concession that prioritizes implementation quality over speed. On the other hand, the ban on nudification apps closes a dangerous gap. AI-generated non-consensual intimate images are already a massive problem primarily affecting women and minors. The fact that the ban goes beyond obvious cases and also holds providers accountable whose systems can foreseeably be misused is a strong signal. The regulation demonstrates it can learn: it simplifies where bureaucracy hinders innovation and tightens where concrete harm occurs. Critics note, however, that the deadline extension delays the AI Act's protective effect for citizens affected by high-risk AI in areas like law enforcement or migration.
Relevance for Germany
For Germany, this agreement is highly relevant for several reasons. First, the German federal government approved a cabinet draft for the AI Market Surveillance and Innovation Promotion Act (KI-MIG) on February 11, 2026, which will govern national implementation of the AI Act. The extended deadlines give German companies and authorities significantly more preparation time. Second, the nudification ban addresses a problem that is already acute in Germany: according to a study by the German Children's Fund, AI-generated nude images of minors are already a growing phenomenon at German schools. The new ban gives law enforcement an additional tool. Third, the many German SMEs that develop or deploy AI systems benefit from the tailored accommodations. Germany plans not to build an entirely new supervisory apparatus but rather to build on existing specialized oversight structures supplemented by central coordination functions. Formal adoption of the Omnibus amendments is expected before August 2026 to create legal certainty by the key date.
Fact check
The primary sources are the official press release of the Council of the EU from May 7, 2026, and the European Commission's press release. The core facts - deadline extension for high-risk AI systems (Annex III to December 2, 2027, Annex I to August 2, 2028), ban on nudification apps and CSAM generation from December 2, 2026, SME accommodations, and sandbox deadline extension to August 2, 2027 - are consistently confirmed by legal analyses from Gibson Dunn, Latham & Watkins, White & Case, and Mishcon de Reya. The information on German implementation via the KI-MIG comes from Bundestag documentation. Formal adoption is still pending as of this summary; the stated deadlines and prohibitions are based on the provisional agreement text and could be subject to minor adjustments during the final vote.
Source
- • https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/
- • https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1024
- • https://www.bundestag.de/dokumente/textarchiv/2026/kw12-de-kuenstliche-intelligenz-1151800
- • https://digital-strategy.ec.europa.eu/en/consultations/targeted-consultation-draft-guidelines-classification-high-risk-artificial-intelligence-systems