After two failed trilogues — the EU’s notoriously grueling negotiation process — Parliament and Council reached a political agreement on the so-called AI Omnibus. The package does two things: it softens the AI Act’s implementation timeline for industry, and it writes an outright ban on AI nudification tools into European law. Both matter, but one is more significant than the other.

The Deadline Slip

The headline concession is timing. High-risk AI systems — covering biometrics, education, employment, law enforcement, and border management — now have until 2 December 2027 to comply, instead of the original August 2026 deadline. AI embedded in regulated products gets until August 2028.

Brussels says this is because harmonised standards and guidance documents aren’t ready yet. That’s probably true, but it’s also a convenient gift to an industry that was nowhere near ready. Sixteen months is a significant runway. For companies that had compliance programmes underway, this buys them time. For those who hadn’t started, it just bought them time to not start.

Small and mid-cap companies get concrete relief: templated technical documentation, lower fees, easier access to regulatory sandboxes. The principle being applied is that obligations should scale to organisational size, which is sensible. A five-person startup building an AI recruitment tool shouldn’t face the same paperwork burden as a Fortune 500 deploying AI in hiring decisions across millions of candidates.

The Nudification Ban

The more consequential element is the prohibition on AI tools that produce non-consensual intimate imagery. These are apps — the Grok nudification feature being the most notorious example — that could take a photograph of a clothed person and produce a fake nude image.

Parliament made this a red line for the trilogue. The final text bans AI systems whose primary purpose is to undress people or depict identifiable individuals in sexually explicit scenarios without consent. Companies have until 2 December 2026 to comply. There’s a carve-out for developers who’ve already implemented effective safety measures — general-purpose models that filter such outputs already aren’t targeted.

This is the first time a major jurisdiction has written an explicit ban on non-consensual intimate imagery generation into its AI law. It matters not because the technology is particularly sophisticated — it’s been around for years — but because it signals that some applications are simply off-limits regardless of how the technology evolves.

What Survived the Negotiation

Critics, including more than forty civil society groups that signed a letter against the Omnibus in April, will note that the core AI Act architecture remains intact. The risk-based pyramid stands. Foundation model rules are unchanged. The Code of Practice for general-purpose AI continues on a voluntary basis. Watermarking obligations slipped from February to December 2026 but remain mandatory.

In other words: Brussels moved the furniture, but didn’t renovate the house. The simplification narrative is real in procedural terms — less paperwork, later deadlines — but the substantive obligations on high-risk AI systems weren’t reopened. If you were building an AI system for use in hiring or education or law enforcement, the rules are the same. You just have more time to figure out how to follow them.

The agreement still needs formal endorsement from Parliament’s plenary and from Council ministers before the summer recess. Without that, the original August 2026 deadline applies — which is why Brussels spent six months trying to avoid exactly that outcome.

National authorities, meanwhile, have a parallel job: the simplified forms, sandbox templates, and guidance documents need to actually exist before the new deadlines help anyone. Paper relief doesn’t translate to practical relief until the infrastructure is in place.

Executive Vice-President Henna Virkkunen framed the deal as proof that Europe can keep its rules-based approach while making it workable for industry. Whether that framing survives contact with reality remains to be seen.