EU Council gives final green light to AI Act Omnibus - deepfake ban enacted, high-risk deadlines pushed back 16 months
What it really says
The Council of the European Union on June 29, 2026, cleared the final legislative hurdle for the 'Digital Omnibus on AI,' giving its definitive approval to the amendment package. The European Parliament had already voted in favor on June 16, 2026. The legislative procedure is now complete - the regulation will be published in the EU Official Journal shortly and enters into force on the third day after publication. The Omnibus amends the EU AI Act in several key areas: First, obligations for standalone high-risk AI systems (Annex III) are postponed from August 2, 2026, to December 2, 2027 - a 16-month extension. For high-risk AI systems embedded in regulated products (Annex I), the new deadline is August 2, 2028. Second, a new prohibition is inserted into Article 5 of the AI Act: AI systems that generate or manipulate non-consensual sexual or intimate content, as well as those that produce child sexual abuse material (CSAM), are explicitly banned. This prohibition takes effect on December 2, 2026. Third, SME benefits are expanded: companies with up to 750 employees and annual revenue of up to EUR 150 million will benefit from simplified compliance requirements, reduced fines, access to regulatory sandboxes, and standardized documentation templates. Fourth, the deadline for establishing national AI regulatory sandboxes is extended to August 2, 2027.
Our assessment
This development merits a yellow rating because it contains both encouraging and concerning elements. The good news: the ban on so-called nudifier apps and AI-generated child abuse material closes one of the most threatening gaps in the original AI Act. The fact that this prohibition takes effect as early as December 2026 demonstrates political will to act on the most pressing dangers. The expansion of SME benefits is also sensible - it prevents small and medium-sized enterprises from being crushed by compliance costs that large corporations can easily absorb. The concerning side: the 16-month postponement of high-risk obligations means that AI systems in particularly sensitive areas - such as credit scoring, hiring decisions, law enforcement, or medical diagnostics - can operate without the mandated transparency and oversight requirements until December 2027. Critics argue that the EU is yielding to industry pressure and delaying citizen protections. The extension also signals that many companies simply were not ready to implement the rules on time - an indication of how complex the requirements are and how far practice lags behind theory.
Relevance for Germany
This development is directly relevant for Germany in several ways. First, the Federal Network Agency (Bundesnetzagentur), which the Bundestag designated as Germany's central AI supervisory authority via the KI-MIG law on June 12, 2026, gains additional time to build the necessary capacities and expertise through the extended deadlines - an advantage, as the agency must take on entirely new responsibilities. Second, German SMEs, which form the backbone of the economy, benefit from the expanded thresholds. Companies with up to 750 employees receive simplified requirements, which covers a large portion of Germany's Mittelstand. Third, the nudifier ban addresses a growing societal problem in Germany as well, where cases of AI-generated intimate imagery at schools have been increasing. Fourth, the extended sandbox deadline until August 2027 gives German authorities more room to establish these testing environments where companies can trial AI systems under regulatory supervision. Fifth, the original high-risk deadline of August 2, 2026, was just four weeks away - many German companies would have been unable to meet it.
Fact check
The Council's final adoption on June 29, 2026, is confirmed by the official press release from the Council of the EU. The European Parliament's prior vote on June 16, 2026, is documented by DataGuidance and multiple law firm analyses. The specific changes - postponement of high-risk deadlines to December 2, 2027 (Annex III) and August 2, 2028 (Annex I), the new nudifier prohibition effective December 2, 2026, the expanded SME thresholds, and the sandbox deadline extension to August 2027 - are documented in the legislative text and in consistent analyses by Latham & Watkins, Gibson Dunn, DLA Piper, and Deloitte. The political agreement of May 7, 2026, as the basis for these changes is confirmed by the Council's own press release of the same date.
Source
- • https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/
- • https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1024
- • https://ieu-monitoring.com/editorial/eu-council-gives-final-approval-to-ai-act-simplification-under-omnibus-vii/1244434
- • https://www.lw.com/en/insights/ai-act-update-eu-resolves-to-change-rules-and-extend-deadlines