BEUC NEWS - 29 June 2026

Today, the Council formally adopted the AI Omnibus, completing the legislative process after the European Parliament's plenary vote on 16 June. Even before the AI Act is fully applicable, this deal makes several changes to these rules with serious implications for consumers.

While several key protections remain, such as stricter rules for AI used in credit scoring, access to healthcare services, pricing for life and health insurance, as well as bans on the most harmful practices, the AI omnibus introduces significant setbacks and leaves room for further deregulation in the future.

The good and the bad: what changes for consumer protections 
The most consequential change is the delay of key safeguards, particularly for high-risk AI systems. Companies using AI in sensitive areas such as hiring, credit scoring or insurance will not have to prove that their systems are safe until December 2027. Similarly, safety requirements for AI-embedded products like medical devices and toys have been postponed until August 2028.

As a result, consumers may interact with these systems for several more years without the protections that were originally expected to apply from August 2026.

At the same time, the scope of the AI Act has been narrowed, excluding machinery from stricter safety requirements. Instead, AI in machinery will have to be covered by sector-specific rules. As these rules were not designed with AI risks in mind, this could create significant gaps in consumer protection.

The Omnibus also delays the requirement to label AI-generated or AI-altered content, a safeguard that helps consumers know what is real. While labelling must be in place from 2 August 2026, systems already on the market have until 2 December 2026 to comply.

On a positive note, the deal introduces a new ban for AI systems, generating child sexual abuse material or non-consensual intimate images. This is a welcome, albeit long overdue, response to the Grok scandal, in which xAI's tool on X was used to generate thousands of sexualised images of women and children. Such tools will be illegal from 2 December 2026, marking an important step to protect consumers from serious online harms.

Looking ahead: the Digital Omnibus
The AI Omnibus is just one part of a broader simplification drive that now continues with the Digital Omnibus on the GDPR and the ePrivacy Directive.

One of BEUC's main concerns here is the proposal to use of ‘legitimate interest’ as a legal basis to process personal data for AI training and development. This would allow companies to use consumers’ data to build and improve their AI systems without needing to ask for consent. It would also make it harder for people to access information on how their data is used and to challenge any possible violations of their rights.

Taken together with the delays and loopholes introduced by the AI Omnibus, these changes risk dismantling hard-won consumer protections that took years to put in place.

Simplification should make rules easier to apply and enforce, not serve as a cover for deregulation. The Digital Omnibus must not repeat these mistakes.