EU negotiators set Dec. 2 AI‑Act watermark deadline, reinstate some database‑registration rules

The EU’s AI Act just got less theoretical and more operational. After late-night talks on May 7, the Council presidency and European Parliament negotiators reached a provisional deal that changes some of the law’s rollout dates, tightens a few rules, and closes at least one loophole companies were eyeing. The big practical shift is simple — some of the hardest high-risk obligations move later, but transparency rules for AI-generated content now have a hard deadline of December 2, 2026. ### What actually changed? Three things matter most. First, the EU fixed new dates for high-risk AI rules instead of leaving them tied to a future Commission readiness check. Stand-alone high-risk systems now move to December 2, 2027, and high-risk AI embedded in regulated products moves to August 2, 2028. Second, providers must register some systems in the EU database even when they think those systems qualify for a high-risk exemption. (consilium.europa.eu) Third, the deal adds a new banned practice around non-consensual sexual and intimate deepfake content, including CSAM. ### Why is December 2, 2026 the date everyone cares about? Because that is now the hard stop for AI-generated-content transparency measures — basically the disclosure and watermarking-style obligations people associate with synthetic media compliance. One legal summary of the deal notes that the grace period for those measures shrinks to three months, landing on December 2, 2026. That is much sooner than the new high-risk dates, so teams working on generated images, audio, video, and text cannot treat this as a 2027 problem. (consilium.europa.eu) ### What’s the database-registration twist? The negotiators reinstated a filing duty the simplification push had weakened. Providers must still register AI systems in the EU database for high-risk systems even where they believe the system is exempt from being classified as high-risk. Basically, Brussels decided that “we think we’re exempt” is not enough to avoid leaving a paper trail. That matters because database registration is how regulators, customers, and counterparties can see what is in scope and who is taking responsibility. (lewissilkin.com) ### Why did the EU do both things at once — delay and tighten? Because this is a competitiveness package, but not a deregulatory wipeout. The Omnibus VII proposal came out of the EU’s broader simplification push after the bloc’s 2024 competitiveness debate, and the original point was to make the AI Act easier to implement before the first big deadline on August 2, 2026. But Parliament also pushed to keep some guardrails strong — especially on sensitive data, oversight, and sexual deepfakes. (consilium.europa.eu) So the result is a trade: more time for complex high-risk compliance, less ambiguity on visible harms. ### Does this mean the AI Act is now final-final? Not yet. The deal is provisional and still needs formal adoption by Parliament and Council. But in practice, this is now the planning baseline because the institutions rushed the file specifically to avoid crashing into the August 2, 2026 deadline under the old timetable. Companies that wait for every final rubber stamp before doing implementation work are probably misreading the moment. (data.consilium.europa.eu) ### Who inside a company should care first? Product teams, trust-and-safety teams, and whoever owns model governance. If your systems generate media, the December 2026 work starts now — provenance labels, disclosure UX, watermarking choices, and deepfake abuse controls. If your systems might land in high-risk buckets, the extra time helps, but it does not erase the inventory, documentation, and vendor-mapping work. The delay changes the clock. (consilium.europa.eu) It does not change the direction. ### What’s the bottom line? The story is not “Europe backed off AI regulation.” It’s narrower than that. Europe bought companies more time on the hardest high-risk obligations, while making synthetic-content transparency and sexual-deepfake rules hit sooner and more clearly. For builders, the message is pretty direct — stop waiting for abstract guidance and start working backward from December 2, 2026. (consilium.europa.eu) (enz.ai)