EU negotiators reach provisional deal to ban AI 'nudifier' apps, impose operational-transparency rules

The European Union’s latest AI Act compromise is less about rewriting the law than deciding which obligations arrive first, which ones move back, and which harms get singled out for faster treatment. On May 7, negotiators from the Council, Parliament and Commission reached a provisional agreement on the Digital Omnibus on AI, the first formal amendment package since the AI Act was adopted in June 2024. The package delays some of the toughest compliance duties for high-risk systems, keeps pressure on synthetic-content transparency, and adds a targeted prohibition aimed at non-consensual “nudifier” tools. For companies, the practical effect is that compliance work gets more specific: teams now have to map legal categories to concrete product features, release dates and user flows. ### So what actually changed in the timetable? The May 7 provisional deal pushes back the main obligations for Annex III high-risk AI systems — the use-based category that includes systems used in areas such as employment, education and access to essential services — from August 2, 2026 to December 2, 2027. It also delays obligations for Annex I product-regulated high-risk systems, such as certain AI embedded in regulated products, from August 2, 2027 to August 2, 2028. (insideprivacy.com) Inside Privacy said the revised schedule reflects a “two-tiered approach,” while Pinsent Masons reported the delay is intended to give standards bodies and regulators more time to produce the standards, tools and guidance businesses need to comply. Pinsent Masons said a European Parliament spokesperson described the new dates as fixed, rather than earlier backstop dates tied to future guidance. (insideprivacy.com) ### Which AI systems get the extra 16 months? Annex III covers stand-alone high-risk systems defined by use case rather than by product law. Reporting on the deal has highlighted hiring, healthcare and education as the most visible business categories affected by the 16-month extension, because those sectors were among the ones preparing for the August 2026 deadline. TechTimes said companies building AI tools for those sectors gained the extra time under the May 7 agreement. (insideprivacy.com) The delay does not erase the underlying obligations. Pinsent Masons said the high-risk regime still covers risk management, data quality, transparency, human oversight, accuracy, registration, monitoring and incident reporting. What changes is when companies must have those controls in place. (insideprivacy.com) ### Why is December 2, 2026 still such an important date? December 2, 2026 remains a live deadline because the omnibus package does not postpone everything. Inside Privacy said Article 50(2) transparency duties for systems that generate or manipulate synthetic content and were already on the EU market or in service before August 2, 2026 would move only four months, from August 2, 2026 to December 2, 2026. (pinsentmasons.com) Systems launched after August 2, 2026 would have to comply from the date they are placed on the market or put into service. The underlying AI Act text requires certain synthetic outputs to be marked in a machine-readable format and be detectable as artificially generated or manipulated. That matters because companies cannot treat “deepfake labeling” as a distant issue if their products create or alter images, audio, video or text. (insideprivacy.com) ### Where do “nudifier” apps fit into this? Euronews reported that the EU’s new prohibition is aimed at AI systems used to create non-consensual sexualized or intimate images of real people — the tools commonly described as “nudifier” apps. TechTimes reported the ban would take effect on December 2, 2026, putting those systems on a faster track than the broader high-risk regime. (insideprivacy.com) The political significance is that the omnibus package is not only about simplification. Inside Privacy described the agreement as combining timeline relief with “new prohibitions,” and Euronews said the measure targets both companies developing such systems and users who create false intimate content of real people without consent. (euronews.com) ### Why are businesses calling this more “operational”? Pinsent Masons said the broader AI Omnibus was designed to make implementation more proportionate and more workable for businesses. That includes not just delayed deadlines, but changes to registration, sandboxes, post-market monitoring and the relationship between the AI Act and sector-specific product rules. (insideprivacy.com) In practice, that means legal compliance is moving closer to product operations. A company now has to ask whether a feature is a stand-alone high-risk use case, a product-regulated system, a synthetic-content generator subject to marking rules, or a prohibited system altogether. The answer can depend on when the system was placed on the market, what sector it serves, and whether it creates intimate content of real people without consent. (pinsentmasons.com) That is an inference from the structure of the amendments and the implementation dates set out in the provisional deal. ### What happens next before any of this is final? The May 7 agreement is still provisional and must be formally ratified. Pinsent Masons said adoption was expected in the weeks after the political deal, and the revised dates would then be written into the AI Act’s implementation calendar. (insideprivacy.com) For companies shipping AI into the EU, the next milestones are already visible. December 2, 2026 is the date attached to the synthetic-content marking transition and the nudifier-related prohibition described in current reporting, while December 2, 2027 and August 2, 2028 are the new dates attached to the two high-risk AI tracks in the provisional agreement. (insideprivacy.com) (pinsentmasons.com)