The EU just gave itself — and every AI company operating in Europe — a 16-month breather. After three rounds of bruising trilogue negotiations, the European Parliament and Council struck a deal on May 7 to delay the AI Act’s high-risk compliance obligations from August 2026 to December 2027. They also banned AI nudification tools. One of these things is much more popular than the other.
🔍 THE BOTTOM LINE
Europe’s flagship AI regulation just got simpler and slower. Companies selling high-risk AI systems into Europe have 16 extra months to comply, but the rules themselves haven’t disappeared — and the new nudification ban is enforceable immediately.
What Changed
The so-called “AI Omnibus” package amends the existing AI Act in three key ways:
1. Deadlines pushed back 16 months. Obligations for standalone high-risk AI systems — covering biometrics, education, employment, essential services, law enforcement, justice, and border management — now apply from December 2, 2027 instead of August 2, 2026. Rules for AI embedded in regulated products kick in August 2, 2028.
2. SME paperwork lightened. Small and mid-cap companies get templated technical documentation, lower fees, and easier access to regulatory sandboxes. The Commission frames this as “scaling obligations to organisational size” — critics call it regulatory capture by the back door.
3. AI nudification banned. The deal writes a prohibition into the Act for AI systems whose primary purpose is generating non-consensual intimate imagery of identifiable people, including CSAM material. Companies have until December 2, 2026 to comply. The ban doesn’t apply where developers have implemented “effective safety measures” to prevent generation — a carve-out for general-purpose models that already filter such outputs.
Why the Delay
Brussels insists the postponement is about unfinished standards work, not retreat. Harmonised standards from CEN-CENELEC and a full library of guidance documents are the prerequisite for switching obligations on — and they’re simply not ready.
That’s technically true. But it’s also politically convenient. Tech Commissioner Henna Virkkunen, who pushed the simplification drive through the Commission last November, said the deal lets companies “focus on building, not on paperwork” — a phrase that could have been written by any Silicon Valley lobby group.
The delay follows sustained industry pressure. France and Germany have been vocal about wanting lighter AI rules to protect domestic AI champions (Mistral, Aleph Alpha). The Omnibus package gives them what they wanted without formally dismantling the Act’s architecture.
The Nudification Ban: Finally
The most politically charged element of the deal is also its most concrete. The ban on AI nudification tools — apps that “undress” people in images or generate sexually explicit deepfakes of identifiable individuals — has been in the works since Grok’s nudification scandal in late 2025, when Elon Musk’s AI generated explicit images of real people including minors.
Parliament made the ban a red line for the trilogue. Enforcement sits with national market-surveillance authorities and the AI Office rather than sectoral regulators — which means it actually has teeth, provided member states fund those authorities.
The carve-out for general-purpose models with “effective safety measures” is the obvious loophole. Expect furious debate over what counts as “effective” when the first model generates non-consensual imagery despite its filters.
What This Means for New Zealand
We covered the original AI Act Phase 2 deadline back in April. The key update for NZ businesses:
- If you sell AI into Europe, you now have until December 2027 (not August 2026) to comply with high-risk AI obligations. That’s 16 months of breathing room.
- If you build AI tools that could generate intimate imagery, the nudification ban applies from December 2026 — no delay. Start auditing your safety filters now.
- If you’re watching EU regulation as a template, note the direction of travel: the risk-based pyramid stays, but compliance is getting lighter for smaller companies and slower for everyone. Whether that’s “simplification” or “retreat” depends on your politics.
The EU’s NZ AI Blueprint analysis shows Kiwi businesses are already in “high-use, low-trust” mode on AI. The Omnibus delay doesn’t change what NZ companies need to do — it just changes when they need to have done it by.
The Bigger Picture
The AI Act’s core architecture survives intact. The risk-based classification system, transparency requirements, and prohibited practices are all still there. What’s changed is the timeline and the compliance burden.
This is the EU’s version of the “move fast, regulate slowly” playbook. Announce ambitious rules. Delay implementation. Simplify in practice. Claim both innovation-friendliness and regulatory leadership. It’s a delicate balancing act, and both sides think they’re winning — which probably means neither is.
❓ Frequently Asked Questions
Q: Does the delay mean the AI Act is weaker? The rules haven’t changed — just the timeline. High-risk AI obligations are still coming, just 16 months later. The nudification ban is actually new and enforceable sooner. Think of it as a longer on-ramp, not a different road.
Q: What should NZ companies exporting to the EU do? Use the extra 16 months to build compliance into your product rather than bolting it on. Start with impact assessments for any AI that touches hiring, education, credit scoring, or law enforcement. The December 2027 deadline will arrive faster than you think.
Q: Does the nudification ban affect general-purpose AI models? Only if their primary purpose is generating non-consensual intimate imagery. Models like GPT, Claude, and Gemini that have safety filters are exempt — provided those filters are “effective.” Expect legal wrangling over that word.
🔍 THE BOTTOM LINE
Europe delayed its AI homework by 16 months and banned AI nudification in the same breath. Companies get breathing room on compliance; victims of deepfake exploitation get a real prohibition. The AI Act is still coming — it just won’t arrive as fast, or hit as hard, as originally promised.
Sources
- POLITICO: EU clinches deal to roll back AI restrictions
- The Next Web: Brussels strikes deal to thin out AI Act and outlaw nudification apps
- European Commission: AI Omnibus political agreement press release
- Computerworld: EU lawmakers strike provisional deal to soften AI Act
