EU AI Act trilogue: high-risk obligations delayed, deepfake porn to be banned
What it really says
In the ongoing trilogue between EU Council, Parliament and Commission, obligations for standalone high-risk AI systems under Annex III (biometric systems, AI in hiring, education, credit scoring) are set to apply from 2 December 2027 instead of 2 August 2026. The labelling obligation for AI-generated content is being pushed from 2 August to 2 November 2026. At the same time, non-consensual intimate imagery (deepfake porn) and AI-generated child sexual abuse material are to be added as prohibited practices under Article 5. The second trilogue is scheduled for 28 April 2026.
Our assessment
The delay of high-risk obligations is a compromise: industry and member states pushed for technical standards and authority capacity to be built before obligations kick in. This is understandable, as two standards bodies missed their end-2025 deadlines and the Commission itself missed a deadline for high-risk guidance. Still, anyone taking the AI Act seriously sees a risk that delays may become a habit. Adding deepfake porn to the prohibited list, by contrast, is a clear win for fundamental rights, backed by both Council and Parliament.
Relevance for Germany
German companies that have spent months preparing for 2 August 2026 (particularly HR tools, credit scoring providers and education platforms) gain 16 extra months. That eases short-term compliance pressure but extends legal uncertainty. For victims of deepfake porn, an EU-wide ban would add a meaningful lever alongside German criminal law.
Fact check
The dates cited come from the public trilogue process and are confirmed by multiple law firms and the European Commission. The final text is still pending and details may change before adoption.
Source
- • K&L Gates Update 20.01.2026 (legal analysis)
- • artificialintelligenceact.eu (ongoing tracker)
- • IAPP on missed Commission deadline
- • TUEV Consulting 2026 status update