EU AI Act amendments move forward after political agreement

On 11 March 2026, European Parliament lawmakers reached a political agreement on amendments to the EU Artificial IntelligenceThe use of computer systems to perform tasks normally requiring human intelligence, such as decision-making, speech recognition, translation etc. Act (AI ActThe EU Artificial Intelligence Act was approved by the EU Council on 21 March 2024. A world-first comprehensive AI law, intended to harmonise rules for the development, deployment, and use of artificial intelligence systems across the EU.). 

The deal includes a proposal to explicitly prohibit the creation of AI-generated, non-consensual intimate images, commonly referred to as deepfakes. 

The package also includes eased compliance requirements for certain AI systems embedded within sector-regulated products, including medical devices and industrial machinery. This may provide greater clarity for manufacturers operating under existing regulatory frameworks, particularly in sectors such as Healthcare. 

These changes form part of the AI Act Omnibus package. This broader set of amendments aims to streamline aspects of the regulation and strengthen safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... as the law moves toward full applicability. 

The agreement will now proceed to a committee vote scheduled for 18 March 2026, before moving through further parliamentary and Council stages of the EU legislative processA series of actions or steps taken in order to achieve a particular end.. 

What this means for your organisation

Michael McCagh, DPO at The DPO Centre, said, 

‘If your organisation produces or uses generative AI, you should be implementing guardrails now. Establish appropriate policy documents, such as an AI Use Policy and AI Impact Assessment, and technical blockers on prohibited outputs. 

‘Organisations should also be preparing for transparency obligations under the AI Act coming into force this year. This includes requirements to clearly label AI-generated or manipulated content, such as deepfakes. 

‘Recent high-profile examples of generative AI gone wrong means that once these measures enter into force, regulators are likely to show a strong appetite for enforcement.’ 

To learn more about how to assess and manage the impacts of AI systems, read our guide to conducting an AI Impact Assessment.