EU AI Omnibus reaches political agreement — high-risk obligations delayed to December 2027, new prohibitions on non-consensual intimate AI

The European Council and Parliament reached political agreement on the AI Omnibus on May 7, 2026 — the first set of substantive amendments to the AI Act since June 2024 adoption. Headline changes: high-risk use-based obligations postponed 16 months to December 2, 2027; two new prohibited practices added (non-consensual intimate AI material and CSAM) effective December 2, 2026.

The delay is the read-the-room move. The August 2, 2026 cliff would have required most large-language-model deployments in the EU to attest high-risk compliance against a regulatory framework whose technical standards were still under negotiation. Pushing the deadline to December 2027 buys the AI Office and CEN/CENELEC time to ship the harmonized standards and gives industry a sane compliance runway.

The new prohibitions are the substantive policy expansion. Non-consensual intimate AI material and CSAM generation are now Article 5 prohibitions, not high-risk obligations — the strongest enforcement tier with criminal-referral potential. For the open-weight tier that now dominates OpenRouter, the question is how downstream deployers attest filter-and-control compliance for models whose weights they didn't train.

European Council — AI omnibus political agreement → · Inside Privacy — EU AI Act omnibus update →