A compliance clock, reset
On 27 July 2026, Regulation (EU) 2026/1744 — the "Digital Omnibus on AI" — entered into force, amending the AI Act (Regulation (EU) 2024/1689) to push back when the toughest rulebook provisions actually bite. For stand-alone high-risk AI systems under Annex III — the category that covers law enforcement biometric identification and facial recognition tools — the compliance deadline moved from 2 August 2026 to 2 December 2027, a 16-month extension, according to the European Commission's own summary of the change (digital-strategy.ec.europa.eu). Systems embedded in physical products under Annex I get until 2 August 2028. The Commission's confirmation that the Omnibus "entered into force" on that date sits on a separate EU page describing the same timeline (digital-strategy.ec.europa.eu/news).
It's worth being precise about what did not move. The AI Act's outright ban on real-time remote biometric identification in public spaces — subject to narrow, judicially authorized exceptions — was never on the delayed track; it has applied since February 2025. What shifted is the compliance architecture around permitted high-risk biometric systems: conformity assessments, risk-management documentation, human-oversight protocols, EU database registration. Brussels didn't loosen the line on what police may do with facial recognition. It loosened the paperwork clock on systems already inside the legal lane.
Why Estonia is the interesting test case
That 16-month gap now overlaps directly with a live domestic debate. Estonia's Ministry of the Interior and the Police and Border Guard Board (PPA) have floated a nationwide surveillance camera network supporting both facial and license-plate recognition, with an internal ministry analysis slated for completion by 2027 — a plan several sitting and former officials say they learned about only when reporters asked, according to ERR News (news.err.ee). Reform MP Maris Lauri warned the approach risked building "a surveillance society, like that which is going on in China," and both former interior minister Lauri Läänemets and acting minister Kristina Kallas said the proposal hadn't been formally briefed to them.
A related, more concrete strand is already moving: patrol cars fitted with automated license-plate readers and driver-facing cameras, replacing Estonia's aging stationary speed-camera network. Police have not said whether facial recognition will be layered onto that system, and officials told Biometric Update that the necessary data-protection legal framework needs to be in place by 2027 — the same year the AI Act's high-risk obligations now land (biometricupdate.com). A PPA spokesperson put it plainly: "We are already working on these processes today so that these changes in the law will already be in effect by then."
The steelman for delay
The case for the Omnibus extension is not frivolous. Annex III compliance was originally due to bind before the harmonized technical standards that operationalize it — conformity-assessment methodologies, benchmark datasets for bias testing, accredited notified bodies — were finished. A vendor or police procurement office facing an August 2026 deadline with no finalized standard to certify against would have been asked to comply with a moving target, or to freeze deployment entirely. Estonia's own PPA is threading exactly that needle: building the legal and technical scaffolding now so it's ready when obligations actually attach, rather than rushing a facial-recognition network into service against a rule that wasn't yet fully specified. Regulatory sequencing that avoids compliance theater is a legitimate goal, and the Council and Parliament's political agreement reflects a genuine, negotiated judgment — not a unilateral industry giveaway — about what implementation actually requires.
Where the delay cuts the wrong way
But the extension's logic assumes the underlying deployment timeline was set by the rule, not by the technology's availability — and in Estonia's case, that assumption doesn't hold. The camera network and license-plate infrastructure are being built on a schedule the Interior Ministry set for itself, largely independent of the AI Act's calendar. What the Digital Omnibus removes is the external pressure that would have forced conformity assessment, human-oversight design, and public disclosure to be resolved before rollout rather than during it. EFF's reporting on U.S. departments actively concealing facial-recognition and license-plate-reader use from courts and the public — instructing officers not to mention the tools in reports — is a useful cautionary parallel: the harder oversight problem with these systems isn't usually the technology's accuracy, it's whether police disclose using it at all (eff.org). Estonia's own politicians being blindsided by a ministry-level surveillance proposal is a version of the same transparency gap.
The honest reading is that the Omnibus didn't create Estonia's oversight problem — the ministry moving ahead of its own elected leadership did that. But it did remove the one external deadline that might have forced faster answers to basic questions: what triggers facial matching, who can query it, and what audit trail exists. A proportionate-regulation stance doesn't mean opposing the delay outright; standards genuinely needed time. It means insisting Estonia not treat the extra 16 months as a reason to defer its own domestic legal framework too — the PPA's 2027 target for that framework should be a floor, not a ceiling it drifts toward at the same pace as Brussels.