Trilogue deal and new enforcement timelines
Lawmakers from the European Parliament and the Council of the EU reached a compromise in secret trilogue negotiations that will delay and loosen parts of the European Union's landmark AI Act. Under the deal, the law's obligations for high-risk AI use cases are now likely to be enforced starting in December 2027 rather than in August, as had been originally envisaged. Enforcement for AI systems used as safety components — cited in the deal with examples such as robot-assisted surgery — is being pushed back by one year from the original August 2027 deadline. Separately, watermarking obligations for generative AI content have been moved from August to December this year.
Industrial AI carve-out and SME relief
The compromise includes a significant exemption for industrial AI: AI used in machinery products will be subject to separate, pre-existing sectoral safety rules rather than the full requirements of the AI Act. That outcome was described as a win for the German government in the reporting. Small mid-cap enterprises that employ fewer than 750 people and report annual revenues below 150 million euros will receive the same benefits already available to smaller firms, including free access to state-run regulatory sandboxes and simplified documentation requirements.
Ban on "nudifier" apps and ongoing probes of X and Grok AI
The AI Act will be explicitly amended to ban so-called nudifier apps that depict an identifiable person's intimate parts or show them engaged in sexually explicit activities, or that generate child sexual abuse material. The ban is slated to come into force on Dec. 2. The European Commission is separately investigating Elon Musk's X and Grok AI over such content under another regulation, according to the reporting.
How CCIA Europe and BEUC reacted
Responses to the trilogue deal were mixed. The Computer and Communications Industry Association Europe, a prominent Brussels trade group, said the agreement "misses a clear opportunity to deliver genuine simplification in key areas." CCIA Europe AI policy lead Boniface de Champris criticized negotiators for rejecting a Commission proposal to remove the AI Act's requirement that even non-high-risk systems be registered in a centralized database, and said the group would have preferred watermarking requirements to be pushed back further into 2027.
Consumer advocates were also critical. The European Consumer Organization (BEUC) said the deal "rolls back key consumer protections which had barely been adopted a year ago, by removing critical AI systems from the rules and allowing for future delegated acts that could undermine current safeguards," according to BEUC director general Agustín Reyna. BEUC applauded negotiators' rejection of an exemption that would have removed consumer gadgets such as toys and medical devices from the act's scope, but warned the package opens the possibility of AI systems processing personal data to detect and correct biases and creates "dangerous loopholes and confusion for both businesses and consumers."
What this means for technologists, policymakers, and consumers
- Technologists and security teams: Implementation deadlines for high-risk controls, safety-component rules, and watermarking have been shifted, creating more time to adapt compliance programs but also prolonging uncertainty about the final rule set and which systems will fall under EU requirements.
- Policymakers and regulators: The trilogue outcome reflects a political choice to prioritize regulatory flexibility and industrial carve-outs amid concerns about competitiveness and domestic AI growth. The plan to formally adopt the compromise before the original Aug. 2 deadline signals a compressed timetable for final sign-off by both institutions.
- Consumers and advocacy groups: Consumer organizations have warned that exemptions and delegated powers could weaken protections, while the new explicit ban on nudifier apps addresses a specific content risk and has a defined entry-into-force date of Dec. 2.
The agreement follows a Commission proposal last November known as the Digital Omnibus on AI, part of several omnibus packages aimed at making the EU more competitive — a policy direction tied in the reporting to recommendations from a 2024 report by former Italian Prime Minister Mario Draghi. Another omnibus package that would change the General Data Protection Regulation has drawn less enthusiasm from privacy watchdogs and member states and may face a harder path through its own trilogue negotiations.
The trilogue compromise, reached in private talks between Parliament negotiators and ministers from member states, still requires formal adoption by both institutions — an outcome the text suggests is unlikely to be reversed. What remains open is whether the concessions and delays will deliver the regulatory breathing room proponents seek, or whether critics' warnings about weakened protections and new loopholes will shape the next phase of EU digital lawmaking.
