What Changed on May 7, 2026
The provisional agreement reached between the European Parliament and Council on May 7, 2026 — formally called the Digital Omnibus on AI — is not a replacement of the EU AI Act but a targeted amendment package that redesigns specific obligations within the existing Act. According to the NicFab analysis of the May 7 agreement, the agreement addresses six distinct areas: application dates, Annex I conformity assessment, the safety component definition, bias detection extension, SME and small mid-cap (SMC) relief, and GPAI enforcement powers.
The most significant additions are: a tripartite prohibition on AI systems that generate sexual intimate imagery of identifiable persons without consent (covering providers, deployers, and the systems themselves); an extension of the AI Office’s supervision authority to cover AI systems built on top of GPAI models (not just the GPAI models themselves); and a deadline shift for high-risk Annex III systems from 2024 to December 2, 2027.
The agreement is provisional — formal adoption is targeted for completion before August 2, 2026, when the original AI Act’s GPAI obligations take full effect. Until formal adoption completes, the 2024 AI Act text remains the operative legal instrument.
The Deepfake and Nudifier Ban: What It Covers and What It Doesn’t
The new prohibition targets AI systems that “alter, manipulate or artificially generate realistic images or videos so as to depict sexually explicit activities or the intimate parts of an identifiable person” without consent. The ban applies at three levels: providers cannot place such systems on the market, deployers cannot use them to generate prohibited content, and the systems themselves are categorized as unacceptable-risk under the expanded Article 5.
The Slaughter and May analysis of the Parliament’s earlier position notes that the ban applies to “nudifiers” — tools specifically designed to generate non-consensual intimate imagery — as well as AI-generated child sexual abuse material (CSAM). The compliance deadline is December 2, 2026: providers of systems meeting this definition must withdraw them from the EU market by that date.
What the ban does not cover: legitimate applications of image generation that could theoretically produce intimate content but are not specifically designed for that purpose (general-purpose image generators with content filtering). The key discriminating factor is whether the system’s design or primary use case is the generation of NCII. General-purpose GPAI providers with robust content moderation are not targeted by this provision.
The ban addresses a gap in the original Article 5 framework, which previously relied on fragmented enforcement through GDPR (unlawful processing of intimate images), criminal law (revenge porn statutes), and the Digital Services Act (illegal content takedown obligations). The new provision creates a single, model-level prohibition with AI Act penalties — up to €35 million or 7% of global annual turnover, whichever is higher.
GPAI Accountability: Extended AI Office Powers
The Omnibus agreement extends the AI Office’s supervision powers beyond GPAI model providers to cover AI system providers that build on GPAI models. This is architecturally significant: under the original AI Act, a company that builds a customer service application on top of GPT-4 or Claude is an AI system deployer subject to the obligations of their own system’s risk classification — the GPAI model provider (OpenAI or Anthropic) is regulated separately at the model level.
The Omnibus adjustment means the AI Office can now supervise AI systems built on GPAI models when those systems exhibit systemic risks. The practical consequence is that enterprise AI application builders — companies deploying GPAI-powered tools for HR decisions, credit scoring, medical triage, or law enforcement support — face a dual compliance structure: their system’s own risk classification obligations, plus potential AI Office oversight if their GPAI-based application creates systemic risks at scale.
According to the Digital Policy Alert tracker for the EU AI Act implementation, GPAI providers have been under baseline obligations since August 2, 2025: maintaining a private technical dossier, publishing a copyright summary, providing model cards to customers, and demonstrating EU copyright compliance. The Omnibus extension adds oversight of the application layer built on those models.
Advertisement
Four Compliance Signals for Enterprise AI Teams
Signal 1: December 2, 2026 is the Hard Deadline for Two Distinct Obligations
The Omnibus agreement creates two separate December 2, 2026 deadlines that require different compliance actions. The nudifier/NCII ban requires providers of prohibited systems to withdraw those systems from the EU market by that date. The AI-generated content watermarking requirement — requiring detectable provenance marking on AI-generated images, audio, and video — also applies from December 2, 2026. Enterprise AI teams should treat December 2, 2026 as a compliance checkpoint for both content generation systems and content watermarking infrastructure, not just one or the other.
Signal 2: The Annex III Deadline Extension Changes Your High-Risk Timeline
The EU AI Act explained by Decode the Future documents that Annex III covers high-risk systems in biometrics, law enforcement, education, and employment — the categories most enterprises encounter in HR tech, fraud detection, and identity verification. The extension from 2024 to December 2, 2027 provides an additional year for compliance with high-risk system obligations (conformity assessment, CE marking, EU database registration, post-market monitoring). This is a genuine compliance runway — use it to build the documentation infrastructure (technical files, risk assessments, human oversight protocols) rather than treating 2027 as a distant deadline.
Signal 3: The Bias Detection Extension Affects All Providers and Deployers
The Omnibus agreement extends bias detection obligations — previously limited to high-risk AI systems — to all AI providers and deployers under a “strict necessity” standard. This means that any enterprise using AI tools that process personal data must now assess whether those tools introduce discriminatory bias, even if the system is not classified as high-risk. The extension creates a new compliance baseline for AI systems previously outside the high-risk framework.
Signal 4: SMC Relief Reduces the Compliance Burden for Mid-Size Enterprise Teams
The original AI Act’s SME relief provisions (reduced documentation requirements, lighter conformity assessment pathways) have been extended to “small mid-caps” (SMCs) — a category covering companies above SME thresholds but below large-enterprise scale. If your organization falls into this bracket (typically 250–1,500 employees depending on the definition adopted in final implementing regulations), you may qualify for the extended SMC compliance pathway, which the DLA Piper Connecticut SB5 analysis approach to AI regulation suggests parallels the tiered compliance approach emerging in US state AI laws as well.
What Enterprise AI Teams Should Do Before December 2026
1. Audit Your AI Product Portfolio Against the Three December 2026 Obligations
The December 2, 2026 deadline is a compliance checkpoint for two distinct sets of obligations — not one. First, does any product in your AI portfolio generate non-consensual intimate imagery or is specifically designed to do so? If yes, it must be withdrawn from the EU market by December 2, 2026, or face penalties up to €35 million or 7% of global annual turnover. Second, does your AI content generation infrastructure produce detectable AI-provenance watermarks on images, audio, and video? The NicFab analysis of the May 7 provisional agreement confirms that watermarking is a separate December 2, 2026 obligation — not bundled with the nudifier ban. Run these as two separate compliance workstreams, not one.
2. Assess GPAI-Based Systems for Systemic Risk Exposure Under the Extended AI Office Powers
If your organization builds AI applications on top of GPAI models — GPT-4, Claude, Gemini, or Mistral — the AI Office now has extended supervision authority over your system, not just over the model provider. The threshold for AI Office intervention is systemic risk: high-volume tools used for HR decisions, credit scoring, fraud detection, or public-sector services face the greatest exposure. The AI Office’s published criteria for systemic risk assessment are the starting point. Enterprise AI architects should document the scale, use case, and risk profile of every GPAI-based application and retain that documentation. Undocumented systems are the highest-risk ones in a regulatory audit.
3. Extend Bias Detection Reviews to All AI Tools, Not Just High-Risk Systems
The Omnibus agreement’s bias detection extension applies to all AI providers and deployers under a “strict necessity” standard — not only those with high-risk system classifications. This creates a new compliance baseline: every enterprise using AI tools that process personal data must assess whether those tools introduce discriminatory bias, even if the system was previously outside the high-risk framework. The “strict necessity” standard is proportionate — the obligation is to assess and document, not to build comprehensive testing programs for every tool. Begin with the AI systems that touch the most users or highest-stakes decisions (customer-facing tools, HR systems, content moderation) and build a documented bias assessment trail that can withstand AI Office scrutiny if your system’s scale triggers oversight.
What Comes Next in the EU AI Regulatory Calendar
The Omnibus agreement is provisional — formal adoption by both Parliament and Council is targeted before August 2, 2026. The six-month period between May 7 and August 2 is the window for final text review, translation into all EU official languages, and formal publication in the Official Journal. During this window, the provisions do not yet have legal force.
After formal adoption, the compliance calendar runs: December 2, 2026 (nudifier ban + watermarking); December 2, 2027 (high-risk Annex III systems); August 2, 2028 (Annex I safety components in regulated products). Enterprise compliance officers should map internal AI system inventories against this timeline now — the Annex III extension provides breathing room, but the nudifier ban and watermarking obligation arrive in seven months.
Frequently Asked Questions
Does the EU AI Omnibus deepfake ban apply to general-purpose image generators like DALL-E or Midjourney?
No. The ban targets AI systems specifically designed to generate non-consensual intimate imagery (NCII) — including nudifiers and AI-generated child sexual abuse material. General-purpose image generators that can theoretically produce intimate content but are not specifically designed for that purpose, and that implement content filtering, are not covered by the model-level prohibition. The discriminating factor is whether the system’s design or primary use case is NCII generation. Providers of general-purpose image tools should ensure their content filtering is documented and robust, as the AI Office’s extended supervision powers could scrutinize GPAI-based systems that enable NCII generation through circumvention of filters.
What does the extension of AI Office powers over GPAI-built systems mean for enterprise application developers?
It means that enterprises building AI applications on top of GPAI models (GPT-4, Claude, Gemini, Mistral) face potential AI Office oversight if their applications exhibit systemic risks at scale. Previously, the AI Office primarily regulated GPAI model providers; the Omnibus extension creates a pathway for the Office to supervise the application layer. Enterprise teams building high-volume AI tools for HR decisions, credit scoring, fraud detection, or public-sector services should assess whether their system’s scale and use case creates systemic risk exposure — the AI Office’s published guidance on systemic risk criteria is the starting point for that assessment.
How does the bias detection extension change compliance requirements for AI tools that were previously not high-risk?
The Omnibus agreement extends bias detection obligations to all AI providers and deployers under a “strict necessity” standard — previously, only high-risk system providers faced formal bias assessment requirements. For enterprises using AI tools in non-high-risk contexts (content generation, customer support, internal productivity tools), this creates a new baseline obligation: assess whether the tool introduces discriminatory bias in its outputs, document the assessment methodology, and implement mitigation measures where bias is found. The “strict necessity” standard means organizations must collect only the data necessary to detect and correct bias, not build comprehensive testing programs — the obligation is proportionate to the system’s risk profile.
—
Sources & Further Reading
- Digital Omnibus on AI: the Provisional Agreement of 7 May 2026 — NicFab Blog
- AI Omnibus Update: Parliament Position Including Nudification Ban — Slaughter and May
- EU AI Act Implementation Timeline — Artificial Intelligence Act EU
- EU AI Act Explained: 7 Risk Tiers, Penalties & 2026 Timeline — Decode the Future
- What the EU AI Omnibus Deal Changes for the AI Act — Tech Policy Press
- EU Lawmakers Agree Draft AI Law Amendments Including Sexual Deepfake Ban — MLex
🔗 Related Intelligence
EU AI Act Article 50: Deepfake Labeling Becomes Mandatory August 2026
EU AI Omnibus Deal: The May 7, 2026 Agreement That Pushed High-Risk AI to December 2027
EU AI Omnibus SMC Exemptions: The 2027 Compliance Deadline Explained
EU AI Act August 2026: The High-Risk Compliance Checklist for Non-EU AI Providers
