The EU’s Regulatory Two-Step: Loosen the Reins, Ban the Creeps
The European Union has reached a political deal on its AI Act omnibus package, and it’s a classic Brussels compromise: ease compliance for businesses while cracking down on the worst AI abuses.
On the business side: high-risk AI system obligations are delayed until December 2027, and smaller firms get reduced paperwork. The EU heard the complaints about regulatory burden and responded by pushing deadlines back and cutting red tape.
On the abuse side: AI-powered nudification apps are now explicitly banned. Full stop. No exceptions. Create or distribute software that strips real people’s clothes using AI, and you’re violating EU law.
It’s the regulatory equivalent of saying “we’re not uptight, we just have standards.”
What the Omnibus Deal Actually Contains
The political agreement, reached between the European Parliament and Council of the EU, covers several key changes:
Delays and simplifications:
- High-risk AI system obligations pushed to December 2027 — giving companies 18 more months to comply
- Reduced documentation requirements for small and medium enterprises
- Simplified conformity assessments — fewer checkboxes for smaller firms deploying AI in high-risk categories
- Watermarking compromises — practical adjustments to the AI-generated content watermarking requirements
The nudifier ban:
- Explicit prohibition on AI-powered nudification apps — software that uses AI to generate non-consensual nude images of real people
- Criminal liability for creators and distributors
- This goes further than Minnesota’s first-in-the-US state ban on AI nudification apps, which was signed into law earlier this year — the EU ban is continent-wide and carries union-wide enforcement
Why the Two-Step?
The EU is reading the political room. On one hand, European tech companies and startups have been screaming about compliance costs driving them to the US or Dubai. The delay and simplification measures are a direct response to that pressure.
On the other hand, the explosion of AI-generated non-consensual intimate imagery — particularly targeting women and minors — has become a political crisis that transcends the usual left-right divide. Minnesota banned it. The UK is moving toward legislation. The EU is now the largest jurisdiction to impose a blanket ban.
The omnibus structure lets the EU claim it’s both pro-innovation and pro-safety — a balancing act that Brussels is increasingly good at, even if the execution is messy.
What This Means in Practice
For AI startups and SMEs, this is genuinely helpful. The extra 18 months and reduced paperwork lower the immediate compliance burden. If you’re a 20-person AI company in Berlin, you now have more runway before you need a compliance team.
For deepfake abuse victims, this is the strongest legal protection available in any major jurisdiction. The ban applies across all 27 EU member states, with enforcement through national authorities.
For large AI companies (OpenAI, Anthropic, Google, Meta), the changes are marginal. They were already building compliance infrastructure. The delay gives them breathing room but doesn’t change the trajectory.
For NZ and the rest of the world, this is a signal. The EU is setting the template — simplified compliance pathways for legitimate businesses, hard bans on the worst abuses. Expect other jurisdictions to copy this model.
The Cynical Read
Here’s the thing: the EU delayed high-risk AI obligations by 18 months, which means companies deploying AI in hiring, credit scoring, law enforcement, and healthcare — the categories most likely to harm people — get an extra year and a half of unregulated deployment. The people who need protection most get the longest wait.
And the nudifier ban, while welcome, is easy political points. Banning the worst abuse doesn’t compensate for delayed oversight on systemic AI harms. The EU knows this. It’s a calculated trade: give businesses what they want (delay) and give the public what it demands (the ban) and call it balance.
It might be balance. It might also be the EU learning to regulate in a way that actually sticks — by picking battles it can win rather than fighting a war on every front.
❓ Frequently Asked Questions
Q: What’s a “nudifier” app? AI-powered software that takes a photo of a clothed person and generates a realistic nude image of them. These apps have been used to create non-consensual intimate imagery, primarily targeting women and minors.
Q: Does the ban affect AI art tools like Midjourney or DALL-E? No. The ban targets apps specifically designed to generate nude images of real, identifiable people without their consent. General-purpose image generation tools are not affected, though they still need to comply with watermarking and transparency requirements.
Q: What does “high-risk AI system” mean under the AI Act? AI systems used in critical areas like hiring, credit scoring, law enforcement, border control, and healthcare. These face the strictest compliance requirements — which are now delayed until December 2027.
Q: Does this affect NZ? Not directly — NZ isn’t subject to EU law. But the EU AI Act is becoming a de facto global standard. NZ companies selling into Europe need to comply, and NZ regulators are watching the EU model closely.
🔍 THE BOTTOM LINE
The EU made it easier for small AI companies to operate and harder for creeps to build abuse tools. The delay on high-risk obligations is a gift to business — and a gap for the people those rules were supposed to protect. Whether that trade-off is worth it depends on whether the EU actually enforces the rules when December 2027 arrives.
SOURCES
- European Parliament — AI Act: deal on simplification measures, ban on nudifier apps
- European Commission — EU agrees to simplify AI rules and ban nudification apps
- Euronews — The EU simplifies the AI Act and bans nudifier apps
- Taylor Wessing — The EU Digital Omnibus on AI: what the political deal means
