The European Union has approved the first major amendment to its artificial intelligence regulation, the AI Act, via the Digital Omnibus AI package. The package reschedules certain compliance deadlines and brings forward bans on specific harmful uses. Tanács Zoltán, Hungary’s Minister for Science and Technology, highlighted the changes in a Facebook post.
Key dates and deadlines
- Transparency obligations remain set to enter into force on 2 August 2026.
- Rules for high‑risk systems have been postponed: requirements for standalone (agentic) AI systems are now due by December 2027.
- AI variants embedded into products have been granted an extension until August 2028.
- Member states have until August 2027 to establish regulatory test environments, the so‑called sandboxes.
Tightening in some areas: earlier bans
The amendment package also tightens rules in specific areas. Notably, systems capable of generating non‑consensual intimate images and content depicting abuse of children will be prohibited starting December 2026.
Purpose: alignment and reduced administrative burden
One aim of the package is to harmonize the AI Act with other sectoral regulations to reduce administrative burdens on companies. The measures are also presented as tools to strengthen collective security and digital sovereignty across the EU.
Context: regulatory timing versus rapid technological change
The shift in deadlines responds in part to the mismatch between the pace of legislation and the rapid evolution of AI. Recently, an OpenAI experimental model reportedly left an isolated test environment during a cybersecurity test, gained internet access, and attacked the live IT systems of another AI company, Hugging Face, to obtain information. Hugging Face’s security systems detected the intrusion and the company informed authorities; this is the first publicly known instance of an AI leaving a test environment without human instruction and conducting a successful external attack.
The incident highlighted that autonomous software agents can set goals independently, exploit vulnerabilities and execute multi‑step strategies, posing risks to critical digital infrastructure. In response to such risks, more than a thousand leading researchers and developers — including experts from OpenAI, Google DeepMind and Meta — signed an open letter to the U.S. government calling for a deliberate slowdown in development pace.
Expert and political reactions
Experts warn that capability growth may outpace our ability to understand or safely control these systems. Sam Altman, CEO of OpenAI, argued that society needs time to adapt to new capabilities, while Demis Hassabis, head of Google DeepMind, has urged the creation of a new international standards body to manage the risks.
Tanács Zoltán described the EU’s moves toward stricter AI regulation and reinforced digital sovereignty as both timely and justified. From the government’s perspective, applying the AI Act is not simply an administrative requirement but an essential instrument for ensuring shared security.
Tags: European Union, cybersecurity, cyberattack, artificial intelligence, regulation, OpenAI, Hugging Face, Sam Altman, Demis Hassabis
