EU Reaches Provisional Agreement on First AI Act Amendments

On May 7, 2026, negotiators from the Council of the European Union, the European Parliament, and the European Commission reached a landmark provisional agreement on the “AI Omnibus” amendments—the first substantial revisions to the EU AI Act since its adoption in June 2024. The deal brings meaningful changes to compliance timelines and introduces stricter prohibitions on harmful AI applications.

Key Developments

The agreement makes three major substantive shifts:

Compliance Timeline Extensions: High-risk AI system (HRAIS) obligations based on use are postponed from August 2, 2026 to December 2, 2027—a 16-month delay. Product-regulated HRAIS obligations (covering medical devices, lifts, and radio equipment) move from August 2027 to August 2028. However, the transparency requirements for artificially generated content face a tighter squeeze, with the grace period reduced from 6 months to 3 months, with the new deadline set for December 2, 2026.

New Prohibitions on Harmful Content: The agreement introduces two critical prohibited AI practices effective December 2, 2026: bans on AI systems that generate or manipulate non-consensual intimate material and child sexual abuse material (CSAM). This represents a significant tightening of the regulatory approach to generative AI misuse.

Clarified AI Office Supervision: The deal clarifies which authorities oversee general-purpose AI models, with the AI Office gaining primary competence except in law enforcement, border management, judicial, and financial institution contexts where national authorities retain responsibility.

Why This Matters

For European AI builders and businesses, these amendments represent critical relief and renewed clarity. The extended timelines for HRAIS compliance provide additional runway for implementation—essential given the complexity of demonstrating conformity with the original August 2026 deadline. Yet the accelerated transparency deadlines signal that content authenticity disclosures remain a priority for regulators.

The new CSAM and non-consensual intimate content prohibitions mark a watershed moment: the EU is actively expanding its AI Act scope beyond the original framework, signaling that misuse prevention will continue driving regulatory evolution.

Practical Implications

For Irish and EU-based developers:

  • High-risk systems: If your AI solution falls under use-based HRAIS classification, you now have until December 2027 to meet core obligations—not August 2026. Verify your classification urgently.
  • Generative content: If you build systems generating synthetic media, you must implement transparency solutions by December 2, 2026.
  • Content moderation: Building safeguards against CSAM and intimate content generation is now a mandatory compliance requirement, not a best practice.
  • Governance: Understand whether your product falls under AI Office or national authority oversight based on your business model and use cases.

Open Questions

Several uncertainties remain ahead of formal adoption (expected by July 2026):

  • How will the AI Office and national authorities coordinate in boundary cases?
  • What technical standards will regulators expect for detecting synthetic intimate content?
  • Will further amendments follow the AI Omnibus, and at what frequency?
  • How will Irish Data Protection Commissioners align enforcement with the expanded prohibitions?

The provisional agreement must still be formally adopted and published in the Official Journal. Until then, the original August 2, 2026 implementation date technically remains in force—creating uncertainty for compliance planning. Expect final clarity by mid-2026.

For European AI stakeholders, this agreement signals that the EU’s regulatory approach is neither static nor softening. Builders should treat these amendments as a preview of the regulatory cadence to expect.

Source: EU AI Act Developments