EU AI Act Omnibus: New Deadlines and Nudifier Ban

What the EU AI Act omnibus changed and what it left alone

The EU AI Act omnibus moved dates and added one ban; it removed no obligation. Regulation (EU) 2026/1744 amends the AI Act and has been law since 27 July 2026, so the dates it sets bind providers and deployers today. They are no longer a proposal.

Three things changed. High-risk rules start later, on fixed dates. The Article 50(2) duty to mark AI-generated content got a grace period for systems already on the market.

A new Article 5 prohibition was added. Parliament's own summary lists the new high-risk dates and the new ban side by side.

The rest stays as it was: the risk tiers, the list of high-risk uses and the content of the requirements. A credit-scoring model that was high-risk before the omnibus is still high-risk, and it simply has more time.

From provisional deal to Regulation (EU) 2026/1744

The text is final: the digital omnibus took about eight months from proposal to publication. The Commission tabled it on 19 November 2025, and law-firm notes written after the provisional agreement of 7 May 2026 still describe a deal waiting for adoption. The adopted regulation is the text that applies.

The Official Journal published the act on 24 July 2026, and its final article sets entry into force on the third day after publication. That left six days before 2 August 2026, the original date for Annex III systems.

The new EU AI Act timeline for high-risk AI

High-risk rules now start on two fixed dates: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. For Annex III, that is 16 months after the original 2 August 2026. AI-enabled machinery leaves the direct high-risk regime, and no requirement was dropped.

Annex III stand-alone systems wait until December 2027

A system that falls under an Annex III use now has until 2 December 2027 instead of 2 August 2026. Annex III lists uses such as biometrics, critical infrastructure, employment, credit scoring and education, where an AI system can decide something important about a person.

The extra 16 months cover work such as risk management, data governance, technical documentation and conformity assessment. The list of uses did not change, so a hiring tool that counted as high-risk before the omnibus still counts.

Annex I products move to August 2028 and machinery drops out

AI built into products under EU product-safety law now has until 2 August 2028, and AI-enabled machinery leaves the high-risk regime altogether. Machinery makers need only follow the sectoral approach of the Machinery Regulation, according to Parliament's summary.

Other products in Annex I still fall under the AI Act's high-risk rules, only on the later date. Makers of those products plan against 2 August 2028, and makers of machinery plan against the Machinery Regulation.

Did the Article 50 watermarking deadline move too?

Only for systems already on the market: generative AI placed on the EU market before 2 August 2026 has until 2 December 2026 to mark its outputs, and newer systems comply from launch. Article 50(2) requires providers of generative AI to mark audio, image, video and text outputs in a machine-readable way, so the content can be detected as AI-made.

A system placed on the market after 2 August 2026 gets no grace period. The Commission has published a second draft Code of Practice on marking and labelling AI-generated content, and the Code was not final when the deal was struck. Deployers that use generative AI to produce content for the EU market should plan for 2 December 2026 and align their labelling workflows with the final Code of Practice once it is published.

The new Article 5 ban on nudifier apps and CSAM

This is the one change that makes the AI Act stricter, and it applies from 2 December 2026. Parliament's summary describes a new provision that prohibits AI practices generating non-consensual intimate or sexual content as well as child sexual abuse material (CSAM). It sits in Article 5, the AI Act's list of prohibited practices.

What the new prohibited practice covers

No one may place on the market, put into service or use an AI system that produces realistic intimate or sexual depictions of an identifiable person without that person's consent. "Nudifier" apps are the clearest example, and the consent required has to be freely given, specific, informed, unambiguous and explicit.

Systems that generate child sexual abuse material fall under the same provision from the same date. Because "use" is on the list, deployers are caught as well as providers.

Why general-purpose image tools fall in scope

A general-purpose image or video generator can fall under the ban, because the test is foreseeability and not what the tool was built for. William Fry reads the drafting as reaching beyond purpose-built nudifier tools to systems whose functionality makes such misuse reasonably foreseeable.

A provider therefore cannot rely on the product description alone. The standard looks at what the system can foreseeably be used to produce, whatever its labelled purpose.

What the EU AI Act delay means for your compliance plan

Split the work by date, not by the word "delay": two obligations land on 2 December 2026, and the high-risk work has more time. The two are the Article 50(2) marking duty for systems already on the market and the new Article 5 ban. All dates are now fixed in law.

The 2 August 2027 date belongs to Member States, not to businesses. Each must set up at least one national AI regulatory sandbox, and that obligation moved from 2 August 2026.

The deadlines that still land in 2026

Any product that serves AI-generated audio, images, video or text to EU users needs two checks before 2 December 2026. First, list which generative systems were on the market before 2 August 2026, because only those get the grace period and newer ones must already mark their outputs.

Second, write down whether image or video features could foreseeably produce intimate depictions of real people, since foreseeability is the test for the new ban. Both checks involve engineering work, not only a policy update.

Putting the extra time for high-risk systems to use

Start with an inventory that sorts each AI system into Annex III, Annex I or neither, then plan documentation against the new dates. Annex III owners have until 2 December 2027, and makers of Annex I products have until 2 August 2028. Makers of AI-enabled machinery can drop those products from direct AI Act high-risk tracking, since they now follow the Machinery Regulation.

Regulation (EU) 2026/1744 is a long legal text with many amended articles. To have an AI assistant summarize the EUR-Lex page, convert the web page to Markdown first so the assistant works from clean text with the headings in place.

Summary: which omnibus dates still land in 2026

The omnibus leaves two items for 2026 and a longer runway for everything else. The Article 50(2) marking duty for systems already on the market and the new ban on nudifier apps and CSAM both apply on 2 December 2026. High-risk work for Annex III systems moves to 2 December 2027 and for Annex I products to 2 August 2028.

Sorting systems by date takes one inventory pass, which is quicker than reading the regulation and several law-firm notes in full. The word "delay" hides the two items that still land this year, and the dates are now written into Regulation (EU) 2026/1744.