AI Regulation Tracker / Council final adoption

Brussels Buys High-Risk AI Two More Years and Bans AI Sexual Deepfakes

Regulatory summary: On 29 June 2026 the Council of the European Union gave final adoption to the Digital Omnibus on AI (PE-CONS 30/26), a Regulation amending the AI Act, Regulation (EU) 2024/1689. It pushes delayed high-risk obligations to two new fixed dates: 2 December 2027 for stand-alone Annex III high-risk systems and.

The Council of the EU gave final adoption to the Digital Omnibus on AI, deferring the toughest AI Act obligations to 2027 and 2028 while fast-tracking new prohibitions. The instrument is adopted but not yet in the Official Journal.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Brussels Buys High-Risk AI Two More Years and Bans AI Sexual Deepfakes regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

Three moving parts. First, the high-risk application dates that were set to bite on 2 August 2026 are replaced by 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I regulated products. Second, a new Article 5 prohibition bans AI systems that generate non-consensual intimate imagery and AI-generated child sexual abuse material. Third, the watermarking and transparency application date is set at 2 December 2026.
AI governance leads, compliance officers, and product counsel in regulated industries (health, HR, finance, biometrics, critical infrastructure), plus trust and safety teams at any platform or model provider whose systems can produce or edit images of real people.
Status: Adopted by the Council on 29 June 2026 after the European Parliament's approving vote.
Split your AI Act tracker into two lanes. Lane one: high-risk conformity work re-dated to 2 Dec 2027 or 2 Aug 2028 by system type. Lane two: an immediate control review confirming your systems cannot generate non-consensual intimate imagery or CSAM, plus watermarking and transparency readiness for 2 Dec 2026.

Regulatory Briefing

Bindingness: Regulation adopted by the Council of the EU, pending Official Journal publication (not yet in force). Once published, it is directly applicable in all 27 member states without national transposition.
Scope: Providers and deployers of high-risk AI systems under Annex III and Annex I of Regulation (EU) 2024/1689; providers of general-purpose and generative AI subject to transparency and marking duties; any provider whose systems can generate synthetic intimate imagery or child sexual abuse material. Extraterritorial reach follows the AI Act.
What Changed: Three moving parts. First, the high-risk application dates that were set to bite on 2 August 2026 are replaced by 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I regulated products. Second, a new Article 5 prohibition bans AI systems that generate non-consensual intimate imagery and AI-generated child sexual abuse material. Third, the watermarking and transparency application date is set at 2 December 2026.
Who This Affects: AI governance leads, compliance officers, and product counsel in regulated industries (health, HR, finance, biometrics, critical infrastructure), plus trust and safety teams at any platform or model provider whose systems can produce or edit images of real people.
Current Status: Adopted by the Council on 29 June 2026 after the European Parliament's approving vote. Awaiting signature and publication in the Official Journal. No CELEX number exists yet because the OJ text has not been published.
Effective Date: Enters into force on the third day following publication in the Official Journal (not yet published). New high-risk application dates: 2 December 2027 (Annex III stand-alone) and 2 August 2028 (Annex I embedded). Watermarking and transparency: 2 December 2026.
Primary Source: https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/
Secondary Analysis: The deferral is a political concession to industry and to member states that argued the high-risk conformity infrastructure, harmonised standards, notified bodies, and guidance, was not ready for an August 2026 start. The prohibitions on synthetic intimate-image abuse and CSAM travel on a faster clock because they carry no standards dependency.
Workflow Impact: Compliance calendars built to the original 2 August 2026 high-risk trigger are now wrong by 16 to 24 months. Conversely, any roadmap that treated all new obligations as deferred is also wrong: the nudifier and CSAM prohibitions and the marking duties land in December 2026.
Operational Next Step: Split your AI Act tracker into two lanes. Lane one: high-risk conformity work re-dated to 2 Dec 2027 or 2 Aug 2028 by system type. Lane two: an immediate control review confirming your systems cannot generate non-consensual intimate imagery or CSAM, plus watermarking and transparency readiness for 2 Dec 2026.
Last Verified: July 9, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	European Union	Three moving parts. First, the high-risk application dates that were set to bite on 2 August 2026 are replaced by 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I regulated products. Second, a new Article 5 prohibition bans AI systems that generate non-consensual intimate imagery and AI-generated child sexual abuse material. Third, the watermarking and transparency application date is set at 2 December 2026.	AI governance leads, compliance officers, and product counsel in regulated industries (health, HR, finance, biometrics, critical infrastructure), plus trust and safety teams at any platform or model provider whose systems can produce or edit images of real people.	Adopted by the Council on 29 June 2026 after the European Parliament's approving vote. Awaiting signature and publication in the Official Journal. No CELEX number exists yet because the OJ text has not been published.

Frequently Asked Questions

Is the Digital Omnibus on AI now in force?

No. The Council gave it final adoption on 29 June 2026, but it has not yet been published in the Official Journal. It enters into force on the third day after OJ publication. Until then it is adopted but not applicable, and no CELEX number exists.

What are the new high-risk deadlines?

2 December 2027 for stand-alone Annex III high-risk AI systems, and 2 August 2028 for high-risk AI embedded in Annex I regulated products. These replace the original 2 August 2026 application date.

Are the nudifier and CSAM bans deferred too?

No. Those prohibitions were added to Article 5 of the AI Act and are on the near timeline, with compliance required by 2 December 2026, alongside the watermarking and transparency obligations. Only the standards-heavy high-risk obligations were deferred.

Does this replace the AI Act?

No. It is a Regulation that amends the existing AI Act, Regulation (EU) 2024/1689. The core AI Act remains; the Omnibus adjusts application dates and adds prohibitions.

What should we do before Official Journal publication?

Re-baseline your compliance calendar to the new dates, review controls against the new prohibitions and the December 2026 marking duties, and keep tracking the OJ so you can confirm entry into force and record the CELEX number when it publishes.