Brussels Pushed Its Hardest AI Rules Back 16 Months

The EU’s AI Act promised that systems used to hire people, grade students, score credit, police borders and run courts would face strict rules from 2 August 2026. In July the date moved. Those obligations now apply from 2 December 2027, sixteen months later.

The delay is law. The Digital Omnibus on AI was signed on 8 July 2026 and entered into force on 27 July, according to a compliance vendor’s summary that readers should check against the Official Journal. Its critics say the law was reopened before its main safeguards had a chance to apply.

What slipped

Two deadlines moved. High-risk systems in areas such as employment, education, law enforcement, migration, access to essential services and the administration of justice, go from 2 August 2026 to 2 December 2027. High-risk AI built into regulated products such as medical devices and machinery goes from 2 August 2027 to 2 August 2028.

The path was short. The Commission proposed the delay on 19 November 2025 as part of a Digital Omnibus meant to simplify the EU’s digital rules. Parliament and Council reached a provisional agreement in early May 2026. Parliament approved the text on 16 June and the Council adopted it on 29 June.

The reasons given

The Commission cited a lack of implementation by member states and the time companies need to adapt to complex rules. There is substance in that.

Hanane Taidi, director general of the TIC Council, which represents testing and certification bodies, pointed out that many member states missed the August 2025 deadline to designate the competent authorities, which blocks the notification of the bodies that assess conformity. A rule that nobody is authorised to check is a rule on paper.

The industry lobby CCIA, whose members include Amazon, Apple, Google and Uber, welcomed the delay and asked for bolder changes, among them raising the compute threshold for models considered to carry systemic risk.

Read also: When Any Video Can Be Fake, Who Tells the Court?

What did not slip

Transparency duties still apply from 2 August 2026, with a grace period until 2 December 2026 for watermarking by generative systems already on the market. And the omnibus added something new: a ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a transition to 2 December 2026.

Few will argue against that ban, and it also hands the Commission a headline while the commercially expensive obligations wait.

What the critics say

The consumer organisation BEUC, through its director general Agustín Reyna, called the proposal deregulation that mainly benefits Big Tech and said the pause goes too far. Peter Norwood of Finance Watch called it a “deregulate to accelerate” approach and warned that a person could be denied a loan because of a biased AI model. Francine Cunningham of the law firm Bird & Bird said the omnibus process bypassed the usual impact assessments and consultations.

The digital rights network EDRi goes further. In a July 2026 statement it said the Commission “did not produce a proper impact assessment for this Omnibus” and called the package “a deregulation agenda sold as simplification”, arguing that the AI Act was reopened before its key safeguards applied and that this “sent a dangerous message” that rules can be weakened when they prove difficult.

EDRi also points to changes in the AI omnibus on AI literacy, fundamental rights oversight, transparency and the processing of sensitive data for bias correction.

Who gains sixteen months

The companies that deploy hiring tools, credit scoring and similar systems. The omnibus also stretches simplified documentation and priority access to sandboxes to small mid-cap firms, defined as fewer than 750 employees and turnover up to 150 million euros.

Who bears the delay? Job applicants screened by software, loan applicants scored by it, students graded by it. For sixteen months more they sit under a regime that has the rules written but not applied.

An Investigate Europe report based on more than 100 documents from closed-door ambassador meetings showed that, while the Act was being negotiated, France led a group of governments, supported by Italy, Hungary, Romania, Sweden, the Czech Republic, Lithuania, Finland and Bulgaria, that pushed for a national security exemption.

Denmark, the Netherlands, Portugal and Slovakia were among those critical of widening the prohibitions to law enforcement. A source in the Parliament told the reporters: “This battle was one of the toughest and we lost it.”

The systems that are already running

It is easy to treat the high-risk list as a technical annex. It describes software that already sits between people and money, work and benefits, and some of it has a record.

Read also: Brussels Fined Big Tech 2.46 Billion. Washington Threatens Tariffs

The Dutch childcare benefits scandal is the best known. Amnesty International’s 2021 report “Xenophobic Machines” describes how the tax authority used a risk-classification algorithm, introduced in 2013, that treated nationality as a risk factor when assessing childcare benefit claims.

Tens of thousands of families were falsely accused of fraud and pushed into debt, and the Dutch government resigned over the affair in January 2021. A benefit-fraud scoring tool of that kind could fall within the Act’s high-risk category for access to essential public services, which is the category that waits until December 2027.

The enforcers are late too

A rule needs a referee. The Future of Privacy Forum notes that only a limited number of member states had notified their single points of contact at the time of writing. The AI Office gains more powers, including as the market surveillance authority for AI in very large online platforms and search engines. Each member state has to have at least one regulatory sandbox running by 2 August 2027.

What protects you in the meantime

The sixteen-month gap is not a legal vacuum. The GDPR already gives people a right not to be subject to a decision based solely on automated processing when it has legal or similarly significant effects on them, with exceptions, and the right to ask for human review in those cases. It applies to a bank refusing a loan or an employer filtering applicants by algorithm today, whatever the AI Act says about dates.

The catch is enforcement. Most people never learn that software was involved, so they never ask. The AI Act’s transparency and documentation duties were meant to change that by forcing the question into the open before a decision is made.

What the delay leaves open

Between now and then, an employer in Europe can use software to rank you without telling you how. The law that will stop it exists. It waits until December 2027.