The European Parliament has done two seemingly contradictory things to the Artificial Intelligence Act in the same package. On 16 June it approved a ban on so-called nudifier applications, tools that use AI to generate sexualised or intimate images of identifiable people without their consent, while simultaneously postponing the application of the Act’s high-risk obligations deep into 2027. The vote, carried by 423 in favour to 57 against with 174 abstentions, captures a regulator trying to look both tougher and more lenient at once.
The nudifier prohibition is the eye-catching part. It outlaws AI systems designed to create child sexual abuse material or to depict an identifiable person’s intimate parts or sexual activity without consent. Companies have until 2 December 2026 to comply, after which breaches can attract fines of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. The carve-out is significant: systems that build in effective safeguards preventing such generation are exempt, which places the regulatory weight on technical design rather than on the underlying model.
The deferral is the quieter but arguably more consequential move. Obligations for high-risk systems listed in Annex III, covering uses such as recruitment, credit scoring and critical infrastructure, were due to bite in August 2026. They will now apply at the earliest in December 2027. The official justification is readiness. The harmonised technical standards that companies need in order to demonstrate compliance, drawn up by the European standards bodies CEN and CENELEC, are not expected before late 2026, and many national authorities responsible for enforcement have yet to be designated. Without standards and supervisors in place, the argument runs, an earlier deadline would have demanded compliance with rules nobody had finished writing.
Both decisions are defensible on their own terms. It is hard to argue that abusive image generation should wait for a broader timetable, and it is equally hard to enforce documentation and testing requirements against standards that do not yet exist. The tension lies in what the pairing signals. The Act was sold in 2024 as the world’s first comprehensive, risk-based AI law, a framework that would set a global benchmark much as the data-protection regime did before it. Delaying its core obligations while fast-tracking a single prohibition suggests a recalibration toward narrow, politically resonant harms and away from the systemic, horizontal approach that defined the original ambition.
This recalibration is not happening in isolation. It forms part of a wider digital omnibus effort to simplify and stagger Europe’s technology rulebook in response to industry complaints about complexity and to anxiety that heavy compliance burdens are deterring investment at a moment when the bloc is preoccupied with competitiveness. Supporters frame this as pragmatism: rules that cannot be implemented help no one, and conditioning enforcement on the availability of standards is more honest than pretending deadlines are real. Critics counter that repeated postponement erodes the credibility of the entire regime and rewards firms that lobbied hardest for delay, while the standards process itself becomes a slow chokepoint with little public scrutiny.
The deeper issue is sequencing. By banning nudifiers immediately but suspending high-risk rules, Brussels has effectively decided that prohibiting specific malicious uses is easier and more urgent than governing the much larger category of consequential but lawful systems. That may be the correct prioritisation. It is also an admission that the comprehensive model is harder to operationalise than its drafters assumed. The nudifier ban will likely be remembered as a clear, enforceable win. Whether the high-risk framework arrives in 2027 in workable form, or slips again, will determine whether the AI Act becomes the global standard it promised to be or a cautionary tale about regulating faster than institutions can follow.
