The EU AI Act was supposed to be the world's regulatory template — the first comprehensive AI law, the model everyone else would borrow from. On May 7, the Council of the EU and the European Parliament agreed to delay its most consequential provisions. The template is now negotiable.
What got pushed
Under the provisional agreement — part of the European Commission's "Digital Omnibus" initiative — high-risk AI systems covered by Annex III now have until December 2, 2027 to comply. That category is the heart of the law: biometrics, critical infrastructure, education, employment, law enforcement and border control. The new deadline is a 16-month slip from the original August 2026 date. AI embedded in regulated products such as medical devices, machinery and toys gets even longer, until August 2, 2028.
What the rules actually require
The "high-risk" label is not a warning sticker — it triggers a long list of obligations, and most of them are continuous rather than one-time. A company placing an AI hiring tool, a credit-scoring model or a biometric system on the EU market would have to build a risk-management process that runs for the system's entire lifecycle; prove its training, validation and testing data is relevant, representative and reasonably free of errors; produce detailed technical documentation; keep automatic logs of how the system behaves; and run a quality-management system covering the whole development pipeline. The system also has to be designed so humans can meaningfully oversee it, and it has to meet defined thresholds for accuracy, robustness and cybersecurity.
On top of that, each high-risk system must pass a conformity assessment and be registered in a public EU database before it can launch. For a company whose product was never built with any of this in mind, that is a serious engineering and legal lift. Retrofitting an existing hiring tool or fraud-detection model to clear every bar costs money and takes time — which is exactly what the deadline fight was about.
Who asked for it, and why
The delay did not come from nowhere. Executives from ASML, Airbus, Ericsson, Nokia, SAP, Siemens and Mistral AI publicly warned that "Europe risked over-regulating itself out of the global AI race." Their objection had two parts. One was competitiveness: the obligations above slow product launches and add cost, while US and Chinese rivals face nothing equivalent. The other was more concrete and harder to wave away. The AI Act sets the goals, but the detailed technical standards that tell companies how to actually meet them — the harmonized standards still being drafted by European standards bodies — were not finished. Firms faced a 2026 deadline to comply with rules whose instruction manual did not yet exist.
Brussels officials frame the change as timing, not substance, arguing the rules were "moving faster than the standards needed to support them." That part is true. It is also the explanation a regulator reaches for when industry pressure works.
Not purely a rollback
The agreement is not a simple capitulation. The same deal adds an outright ban on AI-generated non-consensual sexual deepfakes and child sexual abuse material — a response to genuine, visible harm from generative tools. The pattern is worth noting: the EU is tightening rules where the damage is concrete and public, and loosening them where compliance is expensive and the harm is abstract.
The bigger picture
This lands in the same season as the Microsoft–OpenAI restructuring — another case of the AI industry rewriting the terms it operates under and getting what it wanted. Two years ago, the AI Act was a statement that Europe would set guardrails before the technology fully arrived. The 2026 version is a statement that the technology arrived first, the money followed, and the guardrails will wait. The EU still has the most ambitious AI law on the books. It just moved the date when anyone has to follow it.
Comments