EU reaches AI Act omnibus deal to simplify high-risk compliance and ban nudification apps

Brussels, 7 May 2026

The European Commission welcomes the political agreement reached today between the European Parliament and the Council of the EU on simpler, innovation-friendly rules for artificial intelligence (AI).

The Commission proposed the Digital Omnibus on AI only five months ago as part of the EU’s simplification agenda to boost Europe’s competitiveness. This will make the implementation of the AI Act for EU businesses easier while maintaining its benefits for European society, safety and fundamental rights.

Today’s agreement sets a clear implementation timeline for the rules governing high-risk AI systems. Rules for systems used in certain high-risk areas — including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027. For systems integrated into products such as lifts or toys, the rules will apply from 2 August 2028. This sequencing will help ensure that technical standards and other support tools are in place before the rules start to apply.

The agreement also strengthens protection for citizens. It prohibits AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material, such as AI ‘nudification’ apps.

For businesses, the agreement introduces simpler rules and clearer governance. Certain privileges for small and medium-sized enterprises are extended to small mid-cap companies. The interplay between the AI Act and EU product safety laws, in particular the Machinery Regulation, was also clarified, avoiding duplication between sectoral and AI rules. More innovators will also gain access to regulatory sandboxes, including an EU-level sandbox, to test their AI solutions in real-world conditions. The Commission AI Office’s enforcement powers will be strengthened to support oversight of certain AI systems, including those built on general-purpose models and those embedded in very large online platforms and very large search engines.

This agreement will deliver safer and simpler rules for both citizens and businesses. The Digital Omnibus on AI also complements existing support initiatives, including the AI Act Service desk and the upcoming guidelines on the classification of high-risk systems and transparency obligations.

Next steps

The European Parliament and the Council must now formally adopt the political agreement. Upon adoption, the amendments will be published in the Official Journal of the European Union and enter into force three days later.

Background

The Digital Omnibus on AI was proposed on 19 November 2025, aiming to simplify the AI Act while maintaining its level of protection. It was published together with another digital omnibus that streamlines rules on cybersecurity and data, complemented by a Data Union Strategy to unlock high-quality data for AI and European Business Wallets. The package represents the seventh omnibus proposal as part of the Commission’s efforts to simplify EU rules by making business in the EU simpler, less costly and more efficient.

For more information

Simpler EU digital rules and new digital wallets to save billions for businesses

An agile Digital Rulebook for the EU | Shaping Europe’s digital future

Quote

Our businesses and citizens want two things from AI rules. They want to be able to innovate and feel safe. Today’s agreement does both. With simpler and innovation-friendly rules, we make it easier to innovate without lowering the bar on safety. We are also making sure the tools supporting EU companies for a smooth implementation of the AI Act are ready.

^{Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy}

Source – EU Commission

EU Parliament position on AI Act simplification measures, ban on “nudifier” apps

Brussels, 7 May 2026

Postponement of some obligations for AI systems to prevent legal uncertainty
EU ban on nudifiers and on AI-assisted creation of child sexual abuse material
No overlapping rules for machinery product safety

The agreement between EU co-legislators aims to make it easier for providers to comply with the AI Act, while maintaining its main provisions and risk-based approach.

Early Thursday morning, Parliament and Council negotiators reached a provisional deal on amending certain rules within the EU’s Artificial Intelligence Act as part of the digital omnibus package.

New deadlines

The law postpones the application of certain parts of the AI Act to ensure that necessary standards and support measures, needed to clarify the application of the rules, are in place. Following the agreement, obligations on high-risk AI systems will apply:

From 2 December 2027 for AI systems with a high-risk use case (including those involving biometrics, and those used in critical infrastructure, education, employment, law enforcement, and border management)

From 2 August 2028 for AI systems used as safety components and covered by EU sectoral legislation on safety and market surveillance

The law also delays the application of watermarking obligations on AI-generated content until 2 December 2026 (instead of 2 February 2027 in the Commission proposal). Watermarking techniques allow for the detection and tracing of AI-generated content.

Ban on nudifier apps

Parliament and Council also agreed to ban AI systems that create child sexual abuse material or depict the intimate parts of an identifiable person, or them engaged in sexually explicit activities, without that person’s consent.

The prohibition applies to:

placing AI systems on the EU market with the purpose of creating such content;
placing them on the EU market without reasonable safety measures to prevent such creation;
deployers using these systems for the purpose of creating such content.

The content in question can be images, video or audio. Companies will have until 2 December 2026 to bring their systems in line.

Reducing overlaps, centralised enforcement

The following changes to the AI Act were also agreed:

Removing overlapping requirements on AI for machinery products by clarifying that they only need to comply with sectoral safety rules (instead of both the AI Act and sectoral rules); with safeguards that ensure an equivalent level of health and safety;
Narrowing down what qualifies as “safety component”, meaning that products with AI functions that only assist users or optimise performance will not automatically face high-risk obligations, if their failure or malfunction does not create health or safety risks;
Possibility to process personal data where strictly necessary to detect and correct biases, with proper safeguards, both in high-risk and non-high-risk AI systems ;
Extending SME exemptions from certain rules to small mid-cap enterprises (SMCs), to support their growth;
Streamlining enforcement of certain general-purpose AI systems within the EU’s AI Office.

Quotes

Co-rapporteur for the Internal Market and Consumer Protection committee Arba Kokalari (EPP, SE) said:

With this agreement, we show that politics can move just as quickly as technology. We now make the AI rules more workable in practice, remove overlaps and pause the high-risk requirements. In order for Europe to become an AI continent, we need to promote innovation, support startups and scaleups and make it easier to build AI in Europe”.

Co-rapporteur for the Civil Liberties, Justice and Home Affairs committee Michael McNamara (Renew, IE) said:

I’m pleased that this morning we reached an agreement on the AI Omnibus. Alongside simplification measures, we are banning nudification apps, a key part of the Parliament’s mandate, and, of course, the creation of child sexual abuse material using AI systems. This way, we have the tools to act if providers do not address AI systems that compromise fundamental rights or human dignity.”

Next steps

The provisional agreement needs to be formally adopted by both Parliament and Council before it can enter into law. The co-legislators intend to adopt it before 2 August 2026, the start date for current rules on high-risk systems.

Press conference

Co-rapporteurs Arba Kokalari (EPP, Sweden) and Michael McNamara (Renew, Ireland) answered journalists’ questions on the details of the trilogue agreement at a press conference on Thursday at 11.00 CEST. Details on how to follow are available here.

Background

The legislation agreed today is part of the seventh omnibus package on simplification proposed by the European Commission on 19 November 2025 (“the digital omnibus”). Parliament is also currently working on the other proposals in the package: the digital omnibus on amending laws on data use and data protection, and the proposal establishing European business wallets.

Further information

Source – EU Parliament

EU Council position on AI agreement to simplify and streamline rules

Brussels, 7 May 2026

Today, the Council presidency and European Parliament negotiators reached a provisional agreement on a proposal to streamline certain rules regarding artificial intelligence (AI).

The proposal forms part of the so-called ‘Omnibus VII’ legislative package in the EU’s simplification agenda. The package includes proposals for two regulations aiming to simplify the EU’s digital legislative framework and the implementation of harmonised rules on AI.

Today’s agreement on the AI act significantly supports our companies by reducing recurring administrative costs. It ensures legal certainty and a smoother and more harmonised implementation of the rules across the Union, strengthening EU’s digital sovereignty and overall competitiveness. At the same time, we are stepping up the protection of children targeting risks linked to the AI systems. This agreement is clear evidence of our institutions’ ability to act swiftly and deliver on our commitments. It marks the first deliverable under the ‘One Europe, One Market’ roadmap agreed by the three institutions last week, well within the set deadline.

^{Marilena Raouna, Deputy Minister for European affairs of the Republic of Cyprus}

The Commission had proposed to adjust the timeline for applying rules on high-risk AI systems by up to 16 months, so that the rules start to apply once the Commission confirms the needed standards and tools are available. The Commission had also proposed further targeted amendments to the AI act that would extend certain regulatory exemptions granted to SMEs also to small mid-caps (SMCs), reduce requirements in a very limited number of cases, extend the possibility to process sensitive personal data for bias detection and mitigation, reinforce the AI Office’s powers and reduce governance fragmentation. Given that provisions on high-risk AI systems are due to enter into force on 2 August 2026, the co-legislators have treated the proposal with utmost priority, and, in that perspective, broadly maintained the thrust of the Commission’s proposal.

Main amendments introduced by the co-legislators

The co-legislators added a new provision in the AI act, prohibiting AI practices regarding the generation of non-consensual sexual and intimate content or child sexual abuse material (CSAM). The provisional agreement also introduces a fixed timeline for the delayed application of high-risk rules: the new application dates would be 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products.

Furthermore, the provisional agreement reinstates the obligation for providers to register AI systems in the EU database for high-risk systems, where they consider their systems to be exempted from classification as high-risk. It also reinstates the standard of strict necessity for the processing of special categories of personal data for the purpose of ensuring bias detection and correction.

The provisional agreement postpones the deadline for the establishment of AI regulatory sandboxes by competent authorities at national level until 2 August 2027 and reduces the grace period for providers to implement transparency solutions for artificially generated content from 6 months to 3 months, with the new deadline set on 2 December 2026. The deal between the co-legislators also clarifies the competences of the AI Office for the supervision of AI systems based on general-purpose AI models where the model and that system are developed by the same provider by listing exceptions where national authorities remain competent, including law enforcement, border management, judicial authorities and financial institutions.

As for the AI act’s rules for industrial AI and their interplay with sectoral legislation in sectors such as medical devices, toys, lifts, machinery and watercraft, a compromise was found between the co-legislators on a mechanism that allows to resolve situations in which sectoral law has similar AI-specific requirements to the AI act, by limiting the latter’s application in those specific cases through implementing acts. In addition to this, a compromise was found to exempt the machinery regulation from direct applicability of the AI act. The Commission was also empowered to adopt delegated acts under the machinery regulation which would add health and safety requirements in respect of AI systems that are classified as high-risk pursuant to the AI act. This solution effectively addresses any possible overlaps between the high-risk requirements from the AI act and those from sectoral legislation. The provisional agreement also adds a new obligation for the Commission to provide guidance to assist economic operators of high-risk AI systems covered by sectoral harmonisation legislation in complying with the high-risk requirements of the AI act in a manner that minimises compliance burden.

Next steps

Today’s provisional agreement must be now endorsed by the Council and the European Parliament before being submitted to a legal/linguistic revision with a view to the formal adoption of the legislative act by the co-legislators in the coming weeks.

Background

In October 2024, the European Council called on all EU institutions, member states and stakeholders, as a matter of priority, to take work forward, notably in response to the challenges identified in the reports by Enrico Letta (‘Much more than a market’) and Mario Draghi (‘The future of European competitiveness’). The Budapest declaration of 8 November 2024 subsequently called for ‘launching a simplification revolution’, by ensuring a clear, simple and smart regulatory framework for businesses and drastically reducing administrative, regulatory and reporting burdens, in particular for SMEs.

Since February 2025, as a follow-up to the call by EU Leaders at that and subsequent meetings, the Commission has put forward ten ‘Omnibus’ packages aiming to simplify existing legislation on sustainability, investment, agriculture, small mid-caps, digitalisation and common specifications, defence readiness, chemical products, digital issues including on AI, environment, the automotive sector and food and feed safety.

Source – EU Council