The bans are agreed. Not enacted. That gap matters.
On approximately May 7, 2026, negotiators from the European Parliament, the Council of the EU, and the European Commission reached provisional agreement on the Digital Omnibus on AI, the first set of amendments to the EU AI Act since its adoption in June 2024. Among the agreed changes: two new horizontal prohibitions inserted into Article 5, targeting AI systems designed to generate non-consensual intimate imagery (NCII) and child sexual abuse material (CSAM). These aren’t narrow product restrictions. They’re absolute bans applied horizontally across the regulation.
Earlier coverage on this hub documented the nudifier ban discussion before the provisional agreement was reached. That’s the update: it’s no longer under discussion. All three EU institutions have now agreed to it.
Law firm analysis of the provisional agreement confirms the Article 5 additions sit alongside the regulation’s existing prohibited practices, social scoring, biometric manipulation, subliminal techniques. The NCII and CSAM prohibitions are structured as horizontal bans, meaning they apply regardless of the system’s risk classification under Annex III or Annex I.
Article 5 Compliance Preparation Steps (Generative Content Providers)
- Map system capabilities against NCII and CSAM prohibition language
- Assess whether general-purpose model scope analysis is needed
- Monitor EU Official Journal for enacted text publication date
- Hold August 2, 2026 Article 50 baseline deadline as active
The real question is who this touches beyond the obvious targets. Nudifier apps and CSAM generators are the named use cases. But the prohibition language, per analysis from Orrick, targets AI systems that “generate or manipulate realistic non-consensual intimate material of identifiable” individuals. Generative image and video model providers, and the platforms that host them, need to assess whether their systems’ capabilities fall within that scope. The provisional agreement doesn’t carve out general-purpose models with downstream misuse; that’s a question practitioners should be asking now, before the enacted text publishes.
The catch is timing. Provisional agreement means the three institutions have aligned on terms. The text still moves through formal legal-linguistic review before publication in the EU Official Journal. Until that happens, the prohibitions aren’t enforceable. Compliance teams can plan. They can’t treat this as effective law today.
What to watch
the Official Journal publication date, which triggers the enforcement clock. The Digital Omnibus provisional agreement covers multiple changes, deadline extensions, new prohibitions, technical amendments, and the publication timeline affects all of them simultaneously. Don’t expect a partial rollout. The enacted text publishes as a package.
Verification
Partial Law firm analysis of provisional agreement (Covington & Burling, Gibson Dunn, Orrick) Provisional agreement, not enacted law. Prohibition details derive from T3 legal interpretation, not official published text. Human legal review required before compliance decisions.The August 2, 2026 baseline transparency deadline under Article 50 was not affected by the Omnibus. Compliance programs watching the deadline landscape should hold that date firm while treating the Article 5 additions as confirmed-in-principle, not yet legally binding.
Generative content providers shouldn’t wait for the Official Journal to begin scope analysis. The three institutions have agreed. Reversal at this stage would require reopening trilogues. Organizations that start now, mapping their systems’ capabilities against the NCII and CSAM prohibition language, will have more time to respond when the enacted text publishes. Those that treat “provisional” as “optional to prepare for” will compress their own runway.