EU Regulation
EU Strikes Digital Omnibus Deal: High-Risk Deadlines Deferred, Nudifier Apps Banned
European Parliament and Council reached a provisional political agreement Thursday, pushing the most contentious AI Act deadlines to 2027 and 2028 — and adding a new outright ban on AI systems designed to generate non-consensual intimate imagery.
European negotiators announced a provisional political agreement on the Digital Omnibus on Thursday, salvaging a reform package that legal analysts had pronounced effectively dead just nine days ago. The deal delays compliance deadlines for Annex III high-risk AI systems — including those used in employment, education, credit scoring, and access to essential services — to December 2027, and pushes Annex I regulated-product AI obligations to August 2028. Watermarking requirements for AI-generated content, originally slated for August 2026, will now take effect in December 2026.
The reversal is dramatic. This newspaper’s April 28 edition reported the collapse of the trilogue track, citing analysis from IAPP, Modulos, and DLA Piper that no realistic path remained to defer the August 2 compliance deadline for prohibited AI practices before Parliament’s summer recess. That analysis assumed a particular procedural sequence; the deal struck Thursday rewrites it. Negotiators moved the trilogue forward, agreed on a single consolidated package rather than the staged reform originally proposed, and traded substance for speed — including, most notably, the addition of an entirely new outright prohibition that did not appear in the European Commission’s original Digital Omnibus draft.
That new ban targets so-called “nudifier apps” — AI systems whose primary purpose is to generate non-consensual intimate images. The prohibition takes effect across all twenty-seven member states with a compliance window of December 2026. It is the first EU-wide ban specifically targeting a single AI application category by its design intent, rather than by deployment context or risk classification. Civil-society groups had pushed for the addition during the late stages of negotiation; the Parliament rapporteur publicly framed it as a non-negotiable price of agreement.
The trade-off the package represents is straightforward. Industry obtains relief on the timeline pressure that had driven the most intense compliance scramble of the past six months — particularly for Annex III deployers who had argued that the technical documentation and post-market monitoring obligations could not realistically be operationalized by August. In exchange, the regulation gains a hard-edged consumer-protection win that polls well across the political spectrum and that lawmakers can point to as evidence that the AI Act framework can still produce enforceable safeguards even as it accommodates implementation realities.
The agreement remains provisional. It requires formal adoption by both the European Parliament and the Council of the EU before entering into force; analysts expect adoption votes in late June or early July. Until that adoption, the original August 2, 2026 deadline for prohibited AI practices technically remains in effect — though enforcement bodies in several member states have signaled they will exercise discretion during the transition. The legal posture, in other words, has flipped from “comply with the original or face penalties” to “comply with the original or watch the deal’s ratification calendar carefully.”