Luxembourg: The Council and Parliament reached political agreement on 7 May 2026 on a set of amendments to the AI Act that adjust compliance deadlines, sharpen rules for AI-generated intimate content, and clarify the relationship between artificial intelligence supervision and existing sectoral safety legislation. The agreement, part of a broader simplification effort known as the Digital Omnibus, arrives less than three months before the regulation’s main obligations enter into force.
Under the original timetable, the core obligations of Regulation 2024/1689 apply from 2 August 2026, including transparency rules for chatbots and high-risk AI systems used in employment, education, credit decisions and law enforcement. The legislative compromise preserves that anchor date while extending the deadline for establishing national regulatory sandboxes to 2 August 2027 and shortening the grace period for watermarking artificially generated content to three months, fixing a new deadline of 2 December 2026.
A newly drafted prohibition targets so-called nudifier applications — AI systems that generate non-consensual intimate imagery, including content depicting children. The ban will apply from 2 December 2026 and extends the existing list of prohibited practices under Article 5, which since February 2025 has covered subliminal manipulation, social scoring and untargeted scraping of facial images. Violations of the prohibited-practice list carry the highest tier of penalties: up to 35 million euros or seven per cent of worldwide annual turnover.
The negotiated text also resolves the long-running question of how the AI Act interacts with sectoral product safety laws. Industrial AI embedded in machinery, medical devices, lifts, toys and watercraft falls outside the AI Act where the Machinery Regulation already applies, removing a layer of duplication that industry associations had repeatedly flagged. The agreement clarifies the AI Office’s exclusive supervisory competence over general-purpose AI model providers, while preserving national authority over law enforcement, border management, judicial and financial applications.
The Commission’s argument for the timeline adjustment rests on the delayed availability of harmonised standards. CEN and CENELEC, the two European standardisation organisations, have been unable to deliver high-risk system standards within the original August 2025 mandate, and the bodies continue to work on the technical specifications that providers will rely on to demonstrate conformity. The Commission concluded that legal certainty required additional time before high-risk obligations bite for product-embedded systems, which now benefit from a transition period running until 2 August 2028.
Observers within the European Artificial Intelligence Board point to a more practical concern: the readiness of national competent authorities. Member States were required to designate market surveillance bodies by August 2025, and several jurisdictions are still finalising the staffing and technical capacity needed to inspect documentation packages, audit logging systems and verify post-market monitoring arrangements. Industry alliances have proposed shared testing sandboxes to reduce duplication across markets, and law faculties across Europe are updating curricula to reflect algorithmic accountability.
For providers of general-purpose AI models — which have been subject to Chapter V obligations since 2 August 2025 — the Commission’s supervisory and enforcement powers activate on 2 August 2026. Substantive obligations include keeping technical documentation up to date, providing downstream operators with the information needed to comply, adopting a copyright policy and publishing a training-data summary.
The Code of Practice for general-purpose AI, developed under AI Office coordination, remains a voluntary route to demonstrate compliance. Providers may also choose alternative methods, but the Code’s structured framework is increasingly treated by enterprise users as a baseline reference. Anchored civil liability exposure, fines of up to 15 million euros or three per cent of turnover for non-compliance with high-risk obligations, and the prospect of withdrawal orders from market surveillance authorities together establish enforcement teeth that few earlier digital regulations possessed.
