‘Companies should not be regulated twice’: EU reaches tentative deal to simplify AI rules

Companies should not be regulated twice’: EU reaches tentative deal to simplify AI rules

Companies should not be regulated twice – The European Union has made progress in harmonizing its approach to artificial intelligence regulation, with member states and the European Parliament arriving at a temporary consensus to streamline the bloc’s AI rules through an omnibus legislative package. This agreement, announced on May 7, 2026, aims to address concerns about overlapping obligations and ensure clarity for businesses operating within the EU. Key provisions of the deal include adjustments to compliance timelines and the introduction of simplified frameworks for smaller entities, reflecting a broader effort to balance regulatory rigor with practical implementation.

Delaying Key Obligations to Reduce Uncertainty

One of the central elements of the agreement is the postponement of certain major requirements for AI systems, designed to alleviate legal and commercial confusion. European Parliament officials emphasized that this delay will provide companies with more time to adapt to new rules without facing redundant compliance burdens. The shift comes amid growing criticism of the EU’s existing AI legislation, which some argue has created a fragmented regulatory landscape that complicates operations for businesses across the bloc.

The Digital Omnibus on AI, introduced five months prior, was intended to modernize the EU’s approach to AI governance by reducing the complexity of the Artificial Intelligence Act. This act initially categorized AI systems based on risk levels, ranging from minimal to unacceptable, with corresponding compliance measures. However, its implementation sparked debate, particularly over the inclusion of products like smart home appliances under the “high-risk” category. Critics contended that this classification could stifle innovation by imposing overly strict rules on a broad range of technologies.

Clarifying Rules to Prevent Duplication

Arba Kokalari, the rapporteur for the European Parliament’s Internal Market committee, defended the changes, stating, “We are not weakening any safety rules; we are clarifying the rules for companies in Europe.” She highlighted the confusion companies face when determining whether they must adhere to the AI Act or sector-specific legislation. “Companies should not be regulated twice for one thing,” she added, underscoring the need for a unified regulatory framework.

“We wanted to have clarity on what we think about [nudification apps] in Europe and that we are not accepting of it,” said Kokalari. The revised rules now target AI systems generating explicit content without consent, such as “nudification apps” that digitally remove clothing from individuals. These systems are prohibited from creating images, videos, or audio that expose a person’s intimate parts, provided the content clearly depicts a human being. Michael McNamara, a Renew Europe lawmaker, noted that the scope of the ban excludes synthetic AI characters, ensuring the regulation remains focused on real individuals.

The agreement also extends compliance deadlines for high-risk AI systems embedded in critical areas like infrastructure, education, and border control. Previously, these systems had to meet stringent obligations by December 2026, but the new timeline now allows an additional year, with compliance due by December 2027. For AI used in products such as lifts or toys, the deadline is pushed further to August 2, 2028. These adjustments aim to give companies time to integrate new standards into their operations without disrupting market dynamics.

Simplified Framework for SMEs

To ease the transition for small and medium-sized enterprises, the agreement introduces simpler rules that minimize duplication between sectoral legislation and the AI Act. This approach is intended to lower the administrative and financial hurdles for smaller businesses, which may lack the resources to navigate complex regulatory requirements. The European Commission highlighted this as a crucial step toward fostering a competitive AI ecosystem within the EU.

Additionally, the proposal establishes a “EU-level sandbox” for companies developing AI systems. This initiative allows businesses to test their products in a controlled environment, reducing the risk of premature market entry and providing valuable insights for regulatory adaptation. The sandbox mechanism is part of the broader effort to create a more flexible and innovation-friendly framework for AI governance.

Broader Implications for AI Regulation

The Digital Omnibus also mandates mandatory watermarking for AI-generated content, ensuring transparency in the creation and distribution of synthetic media. Companies will now have until December 2 to align their systems with these updated regulations. This requirement aims to combat the spread of misleading content while preserving the ability of AI systems to function efficiently within the market.

Renew Europe lawmaker Michael McNamara reiterated the importance of the new rules, particularly their application to content generated by AI chatbots like Elon Musk’s Grok. He explained, “The rules will apply to any photos where the person’s ‘intimate parts’ are exposed,” emphasizing that the focus remains on content clearly depicting humans rather than AI characters. This distinction is critical in ensuring the regulations do not inadvertently restrict the use of AI in creative or technological applications.

Next Steps and Final Approval

While the tentative deal has garnered support, it still requires formal approval from the European Parliament and EU member states. This step is essential to solidify the changes and ensure they are implemented consistently across the bloc. The agreement reflects a compromise between regulatory strictness and the practical challenges of enforcing AI rules in a rapidly evolving technological landscape.

Industry stakeholders have welcomed the adjustments, particularly the extended deadlines and simplified compliance measures. However, some remain cautious, fearing that the changes might reduce the effectiveness of oversight in high-risk areas. As the EU moves forward with its AI strategy, the balance between innovation and safety will continue to be a focal point of debate. The Digital Omnibus represents a significant step in this direction, offering a more coherent framework while addressing the concerns of businesses and regulators alike.

Overall, the agreement signals a shift toward a more adaptable and company-friendly approach to AI regulation. By delaying certain obligations and clarifying the rules, the EU aims to create a regulatory environment that supports growth without compromising standards. The outcome of this process will shape the future of AI governance in Europe, setting the stage for a more unified and efficient implementation of the bloc’s artificial intelligence policies.

Thomas Jackson

Cyber Defense Strategist | Threat Intelligence Analyst Thomas Jackson is a cyber defense strategist with experience in threat intelligence analysis and security operations center (SOC) workflows. He has supported organizations in building proactive detection capabilities. At CyberSecArmor, Thomas writes about cyber threat intelligence, SIEM optimization, SOC best practices, and advanced cyber defense methodologies.

81 article(s) published