EU AI Act amendments 2026: five changes coming into force
The Council of the EU and Parliament agreed the first AI Act revisions on May 7; deadlines for high-risk systems are pushed to December 2027, but a new ban on intimate deepfakes takes effect in December.
Does the EU pushing back AI Act deadlines mean the regulator has buckled under industry pressure, or is it a practical acknowledgement that the deadlines were never realistic in the first place? Realistically, more the second than the first. The Council of the EU and the Parliament agreed in Brussels on May 7 on a package of the first AI Act amendments, the first major tuning of the law since it was adopted in June 2024.
The headline change: obligations for high-risk AI systems (HRAIS) have moved from August 2 of this year to December 2, 2027. That is a 16-month delay. The reason is straightforward: the harmonised technical standards promised to industry are simply not ready. Without those standards, companies could not demonstrate conformity even when they were on the right track technically.
1. What “high-risk AI systems” actually means
These are AI tools used in areas such as employment, credit scoring, border control, medical diagnostics and management of critical infrastructure. In practice, an AI system that decides whether you get a loan or a work permit.
These systems now have an extra year and a half before they become legally bound to pass certification, meaning automated decisions can be used in these areas through 2026 and most of 2027 without the new regulatory procedure.
2. What remains in force, and it matters
Although HRAIS deadlines have moved, the Commission’s supervisory powers over providers of large AI models, the GPAI providers including OpenAI, Anthropic, Google, Mistral and others, take effect as planned on August 2, 2026. That means from August the Commission can:
- Demand documentation on how a model was trained.
- Conduct independent evaluations.
- Require changes to how a model operates.
- Impose fines of up to 35 million euros or 7 percent of global turnover, whichever is higher.
This has not been moved, and it is the part of the law that worries the major AI producers the most.
3. New bans taking effect in December
The biggest concrete novelty: the ban on AI systems used to generate or manipulate non-consensual intimate content takes effect on December 2, 2026. In practice, that means a ban on so-called “nudify” applications that turn ordinary photographs into nude images without consent.
This is a response to a wave of cases across Europe in which teenagers became victims of generated intimate content produced by peers. Italy, France and Spain pushed especially hard for the measure.
4. Labelling of AI-generated content
The obligation for AI providers to label outputs as “artificially generated” has moved from August 2 of this year to December 2, 2026. That is a four-month delay, significantly less than for high-risk systems.
In practice, by December of this year ChatGPT, Gemini, Claude and similar tools must have a visible mark or meta-tag identifying text or images as auto-generated. Technical implementation is already underway at most major providers.
5. Regulatory sandbox laboratories
The obligation on EU member states to set up at least one national regulatory sandbox for testing AI systems under controlled conditions has moved from August 2 of this year to August 2, 2027. That is a one-year delay.
The sandbox matters for small and medium-sized companies that want to develop an AI product without fear of immediate fines during the development phase. Without a sandbox, many domestic startups avoid AI projects because of regulatory uncertainty.
What this means for Serbian companies
Serbia is not an EU member, but every Serbian IT product distributed in the EU must comply with the AI Act. In practice, if your company develops an AI tool aimed at the European market (and most do, because the domestic market is small), you have to track all these deadlines.
The good news: you have more time to prepare for HRAIS certification. The less good news: the ban on “nudify” applications also hits Serbian firms that had been moving into that niche, since they often did business with European clients through payment services that will now have to block such content.
Formal adoption follows in June and July
The current amendment package has not been formally adopted yet. The European Parliament and the Council of the EU are expected to hold formal votes in June, with publication in the Official Journal of the EU planned for July. That means the deadlines just described become legally binding only from publication.
Until then, companies operate in a transitional period in which the old deadlines still technically apply, but it is understood they will not be actively enforced, because the Commission expects the amendments to be finalised. Legal practitioners in Brussels are already working to the new timeline.
What a user in Serbia needs to know
If you use ChatGPT, Gemini, Claude or another popular AI tool, nothing changes from your perspective. The big platforms keep operating, access is the same, the price is the same. The change targets producers, not users.
If you are building your own AI product or work for a company that is, it is worth checking with a lawyer whether the new deadlines apply to you fully and whether you can defer certain obligations to 2027. The next key date is July 7, when the amendment package is expected to be finally adopted.
