Brussels approves AI Act compromise: intimate deepfake ban and a delayed deadline

The European Parliament and the EU Council have finally agreed on a long-awaited update to the AI Act, one of the strictest pieces of AI legislation in the world. After two failed rounds of negotiations, the two sides reached a compromise that delays the compliance deadline for high-risk systems, eases requirements for startups, and introduces a long-awaited ban on creating intimate images without consent.

Key changes

Both sides made concessions to reach the deal. The Parliament accepted softer timelines for small businesses, while the Council agreed to stricter rules on non-consensual intimate imagery. The final deal covers three key points:

• Delayed deadlines — the compliance deadline for high-risk AI systems (biometric facial recognition, social scoring, hiring algorithms) has been pushed to December 2027. Companies get an extra two years to adapt in areas critical to society.
• Relief for small businesses — startups and small-to-mid-sized companies will face reduced documentation, monitoring, and audit requirements. The European Commission pushed for this provision, arguing that young companies shouldn't drown in the same bureaucracy as the tech giants.
• Ban on non-consensual intimate imagery — the law prohibits creating, distributing, and using intimate images (photos, video, audio) without consent. It covers both real material and synthetic (deepfake) content. Offenders can be held liable under European law.

Two years of negotiations

The road to agreement was long and difficult. The Parliament and the Council met twice in trilogues (three-way negotiations with the Commission), and both times failed to reach a compromise. The disagreements were about details, not principles: how exactly to apply the restrictions, on what timeline, which exemptions to allow for scientific research, and how to avoid stifling innovation in the AI industry. The line between protecting human rights and preserving freedom of expression was also at the center of the dispute.

On the third attempt, negotiators found a balance that satisfied all parties. The European Commission confirmed the compromise at a press briefing on Wednesday. Formal ratification will take several weeks, but all parties have already agreed on the core framework, and it is final.

Protection against deepfake porn

The ban on non-consensual intimate imagery is a historic win for human rights advocates and women's organizations, which have campaigned for such a ban for decades. In recent years, deepfake technology has become cheaper and more accessible, and synthetic porn featuring real people is spreading online at an accelerating pace. According to research, more than 90% of deepfake content depicts women, often without their consent or even their knowledge.

Platforms that host such content and developers that build tools to produce it can now be held liable under European law. Fines and enforcement mechanisms are still being finalized ahead of the law's official publication, but the principle is locked in and will not change. Experts expect the ruling may inspire other countries to introduce similar bans.

What it means

For European startups, the compromise is good news: more time to adapt and less bureaucracy in the first few years. For large platforms and international AI companies, it's another sign that the EU has no intention of loosening its requirements on the industry.

Most importantly, European law now explicitly bans, at the legislative level and for the first time, one of the most harmful forms of digital abuse. This could set a precedent for other countries and establish a new international standard for global regulation of AI technologies.