Brussels proposes delaying parts of the AI Act

The European Commission published its Digital Omnibus package, a set of amendments touching the GDPR, the Data Act, NIS2 and the AI Act, that proposed pushing back the AI Act’s high-risk compliance deadlines. Obligations for stand-alone high-risk systems under Annex III — covering areas such as hiring, credit and law enforcement — would move from the original 2 August 2026 date to 2 December 2027; obligations for AI embedded in regulated products would move to 2 August 2028. The Commission described these as backstop dates that implementation could beat if the underlying technical standards and conformity-assessment tools, which it said were behind schedule, were finished sooner.

The proposal drew criticism on two fronts. Some argued the substance was reasonable — regulators and companies genuinely lacked the harmonised standards needed to comply — while others focused on a structural feature of the change: systems placed on the market before the new deadlines would not need to comply with high-risk rules unless significantly modified afterward, even once those deadlines passed. Green MEP Sergey Lagodinsky called the non-retroactivity provision “a weak spot” that created “an incentive to put things on the market before the Act enters into force.” Bram Vranken of Corporate Europe Observatory said a large share of deployed high-risk systems would as a result “never have to comply with the rules.” Corporate Europe Observatory and LobbyControl separately reported that a large majority of the Commission’s 2025 meetings on the topic had been with business groups rather than civil-society organisations.

As a Commission proposal, the omnibus required agreement from the European Parliament and Council before taking effect, and its final form was not settled at publication. It nonetheless marked the clearest sign to date that the EU, having positioned the AI Act as the first comprehensive AI law, was willing to trade schedule for competitiveness concerns raised by industry.