Parliament and the Council reach agreement on the amendment to the AI Act: ban on sexual deepfakes finalised

Brussels – After more than a month of negotiations—and a brief suspension due to differences of opinion—in the early hours of this morning (7 May), the European Parliament and the Council of the European Union have finally announced that they have reached a provisional agreement on the proposed amendment to the Artificial Intelligence Act (AI Act or AIA). This is the European Union regulation that will govern the use of AI from 2024, and its revision is part of the broader framework of the so-called Digital Omnibus, the legislative package launched by the European Commission last November to simplify a series of EU rules on digital matters.

There are two key points to the compromise reached today. On the one hand, to postpone, or in some cases simplify, various provisions of the AI Act to give companies using AI systems more time to adapt. On the other hand, to take a stricter approach towards all companies producing so-called nudifier apps, which are capable of altering images of real people without their consent and depicting them in a nude or sexually explicit manner.

The ban on nudifier apps

The agreement reached with the Member States fully incorporates the  Proposal to completely ban nudifier apps,  adopted by the European Parliament during its plenary session in Strasbourg on 26 March. The ban will apply both to users of these systems (who often use them to generate scenes of child sexual abuse) and to the companies that make them available. In particular, in the event of a breach, companies will be held liable both if they place apps on the market that are intentionally designed for this purpose and if they have simply applied insufficient prevention and security measures.

The ban agreed today will come into force from 2 December and, although the text does not specify which apps are targeted, it seems clear that the EU was prompted to act by the case involving Grok (the AI assistant of social network X) last January. This was clarified by the Swedish MEP and co-rapporteur of the measure, Arba Kokalari (EPP), who explained at a press conference that “we do not have a list of nudifier apps, but we all know what Grok and X did a few months ago, and we want to send the message that all of this is banned in Europe.”

While, in theory, the ban appears straightforward to implement, there remain a number of practical issues to be resolved. For example, on which definition of intimate content should the ban be based? In this regard, the text’s other co-rapporteur, the Irish Michael McNamara, emphasised that “we have drawn up a list of the parts of the body that should be considered intimate, but it is in the preamble” and therefore does not form part of the actual legislative text.

Regulatory simplification: the German approach is—partially—adopted

It was precisely over how to simplify the original European AI regulations that negotiations between MEPs and Member States had stalled on 29 April. According to reports in various publications, the two sides were unable to reach an agreement on the issue of so-called “double regulation“: for certain sectors (medical devices, toys, boats, machinery), specific EU legislation already existed setting out rules on AI, and these would have been “added” to the new rules established by the AI Act. The centre-right majority in the European Parliament, together with Germany in the Council, was calling for a blanket exemption for all these sectors from the AI Act to streamline the legal framework and thus avoid the need for dual regulatory compliance. Centre-left MEPs and several Member States, however, opposed this for fear that adequate safety guarantees would be sacrificed on the altar of simplification.

The compromise announced today satisfies pretty much everyone: only the Machinery Regulation will be exempt from the directive, while leaving the Commission with the power to adopt delegated acts to add safety requirements for machinery using high-risk AI systems. However, Kokalari herself confirmed that the negotiations on this point had left some unresolved issues. “Parliament wanted to extend the AI exemption to twelve sectors to address the confusion reported by a great many European companies,” she explained. “However, we were only able to reach an agreement with the Council on the machinery sector,” she added, before saying she was “disappointed that Member States did not share our ambitions.”

The rest of the simplification measures proposed by Parliament in March, however, were accepted in full by the Council.

In particular, it has been agreed to postpone the entry into force of the rules setting new safety standards for AI systems classified as “high-risk” (biometric devices or machinery used in critical sectors such as infrastructure and healthcare). The current version of the AIA requires companies to comply by 2 August this year, while the agreement announced today extends the deadline to 2 December 2027 for high-risk systems explicitly listed in the regulation (such as biometrics, critical infrastructure, education and border control) and to 2 August 2028 for those used as “security components” in certain industrial products and already subject to other EU regulations on safety and market surveillance. On this point, the proposal by the Parliament and the Council also narrows the definition of “security components” in order to limit the scope of AI systems considered high-risk and therefore subject to stricter regulation. “We are all waiting for the Commission to publish the necessary guidelines to determine which systems will be considered high-risk and which will not,” Kokalari urged.

Among the other amendments agreed upon are those extending the entry into force of the obligations regarding watermarking (certificates indicating when content is generated by AI) and which allow companies to use personal data to correct distortions or biases in AI systems, “only when strictly necessary.”

Finally, exemptions from certain obligations set out in the AIA are envisaged for small and medium-sized enterprises, and the aim is to centralise the management and oversight of general-purpose AI models (such as those used for writing text or answering questions) under the authority of the European AI Office.

The Cypriot Presidency of the Council of the EU is pleased: “Today’s agreement on the AI act significantly supports our companies by reducing recurring administrative costs. It ensures legal certainty and a smoother and more harmonised implementation of the rules across the Union, strengthening EU’s digital sovereignty and overall competitiveness,” summed up the Deputy Minister for European Affairs in Nicosia, Marilena Raouna. “At the same time, we are strengthening the protection of minors by addressing the risks associated with artificial intelligence systems,” she added.

Finally, a statement was also issued from the Berlaymont Building by the President of the European Commission, Ursula von der Leyen. “The agreement
provides a simple, innovation-friendly environment for our European AI ecosystem to grow.

At the same time, we are strengthening protections for our citizens” she wrote on X.

It is worth reiterating that today’s agreement is provisional in nature: it must be formally adopted by the Parliament and the Council before it can enter into force in full. The European Parliament’s press release sets the target of completing the process by 2 August 2026, the first of the new deadlines set by the proposal for the entry into force of the AIA rules.