Proposed Changes to the EU AI Act – Practical Implications for Israeli Companies

The European Union announced that agreement had been reached on material amendments expected to be introduced into the EU AI Act as part of the Digital Omnibus legislative amendment intended to simplify data-related regulation and strengthen competitiveness in the AI field.

At present, formal legislative steps must still be completed before the changes become final. Nevertheless, this is a significant regulatory development that provides a clear indication of the direction in which European law is evolving. 

Key Anticipated Changes to the EU AI Act

Under the agreed framework, the effective date of the obligations applicable to organizations developing or using AI systems classified as high-risk will be deferred. This is intended, in part, to allow for completion of the drafting and implementation of the standards required for the practical application of the Act.

The deferral will apply both to systems already in use and to new systems developed or deployed before the new commencement date. In this respect, the compromise creates a meaningful window for preparation. It is also important to note that AI systems placed into use before the AI Act becomes applicable will benefit from additional time to complete their compliance processes.

The AI Act’s applicability is expected to be deferred as follows:

• The rules applicable to high-risk AI systems will be postponed until December 2027. This category includes, among other things, real-time biometric identification and emotion recognition systems, AI used in critical infrastructure, education and employment decision-making, access to public goods and services, and additional use cases.
• The rules applicable to AI systems that are safety components and already covered by sector-specific EU harmonization legislation will be postponed until August 2028. For some of these systems, enforcement is expected to be carried out through existing sectoral regulation rather than as part of the AI Act.
• The obligation to label and watermark AI-generated content will likewise be postponed until December 2026.

Additional Changes: Sensitive Data, Prohibited Content, and Relief Measures for Companies

In addition to postponing the effective dates, the agreements include several other material changes:

• Relief measures permitting the use of sensitive data for the training of AI systems where such use is necessary to prevent or mitigate algorithmic bias, provided that appropriate safeguards are in place.
• A prohibition on material documenting or depicting minors in an explicit sexual context, as well as a prohibition relating to systems that depict the intimate body parts of an identifiable person, or that person engaged in explicit sexual activity, without their consent.
• A narrowing of the definition of a “safety component” – products incorporating AI solely for user assistance functions or performance optimization will not automatically be subject to the obligations imposed on high-risk systems, provided that a malfunction would not create a risk to human health or safety.

At the same time, certain relief measures have been expanded to include small mid-cap companies, i.e., companies with fewer than 1,000 employees or annual turnover of less than EUR 200 million.

In addition, supervisory and enforcement powers relating to general-purpose AI (GPAI) systems are expected to be concentrated in the AI Office, except in sensitive areas where national authorities will retain their powers.

How Will These Changes Affect Israeli Companies?

The EU AI Act also applies to non-EU companies whose activities are connected to the European market or whose AI systems are used within the EU. Accordingly, the AI Act may also apply to Israeli companies developing or marketing AI systems.

In the short term, the proposed changes materially ease the compliance burden on companies:

• Companies developing or using high-risk AI systems, including biometric systems and systems used in critical infrastructure, education, employment, and similar contexts, will effectively receive an additional 18 months to prepare for compliance, until December 2027.
• The AI Act’s obligations will not apply to systems placed into use before that date, enabling companies to focus on internal structural adjustments and embedding an organizational culture that supports compliance.
• AI systems used as safety components in products will benefit from a postponement until August 2028. In addition, the narrowing of certain definitions and the effort to avoid duplicative requirements may remove some systems from the high-risk category and reduce the obligations applicable to developers.

Nevertheless, it is important to emphasize that this is not intended as a waiting period, but one of accelerated preparation. The additional time is intended to enable regulators to formulate standards, and enforcement mechanisms. In parallel, companies should align internal governance processes, workflows, documentation, and control frameworks with the regulatory direction now taking shape.

Recommended Next Steps

We recommend that companies begin acting now and use this window for genuine operational preparation, as well as for business-level assessment of the development, launch, and deployment of AI systems. If the legislation is enacted substantially in its current form, no major changes are expected thereafter.

In this context, companies should undertake a compliance risk assessment in relation to the European legislative framework, including the various elements of the legislation, the company’s data processing practices, with particular emphasis on personal and sensitive data, and the existence of documentation evidencing internal governance processes.

To that end, we recommend the following steps:

• Mapping the company’s AI use cases.
• Assessing applicability of the AI Act to the company’s operations.
• Conducting a gap analysis against the AI Act’s requirements and evaluating associated risks.
• Adopting an organizational policy for the development and deployment of AI systems.
• Implementing a staged compliance plan through the AI Act’s effective date, including a clear work plan and internal milestones for execution and rollout.

The proposed amendments reflect the European legislator’s attempt to strike a more workable balance between robust protection of data and rights, on the one hand, and the promotion of innovation, on the other. They do so by reducing the burden and restrictions imposed on companies, allowing a reasonable period for adaptation, and decreasing regulatory uncertainty.

***

The firm’s Privacy, Cyber & AI Department is available to assist with compliance processes relating to the EU AI Act, including assessment of the AI Act’s applicability and requirements, preparation of internal policies and governance frameworks, and alignment with regulatory requirements in Israel and internationally.

Dr. Avishay Klein is a partner and head of the firm’s Privacy, Cyber and AI Department.

Adv. Masha Yudashkin is an associate in the firm’s Privacy, Cyber and AI Department.