On June 16, 2026, the European Parliament voted 423 in favour, 57 against, with 174 abstentions, to adopt the 'Digital Omnibus' amendments to the EU AI Act (The Sofia Globe). The Council is expected to formalise the text on June 29. The headline change is a delay: obligations on stand-alone high-risk AI systems now apply from December 2, 2027, instead of August 2, 2026, and high-risk AI embedded in regulated products — medical devices, machinery, vehicles — from August 2, 2028 (Gibson Dunn).
Critics read this as Brussels blinking. We read it as Brussels admitting that a deadline it could not equip companies to meet was never a real deadline at all.
The strongest case against the delay
The objection deserves a fair hearing. Civil-society groups argue that the high-risk rules — covering AI used in hiring, credit scoring, education, law enforcement and border control — are precisely the systems that can do durable harm to individuals, and that pushing enforcement to 2027–2028 leaves people exposed for another eighteen months. Diego Naranjo of Liberties said the package "weakens fundamental rights protections in the AI Act, delays enforcement of key provisions, and empowers Big Tech companies" (Liberties). The concern that a delay sought by industry, then granted, sets a precedent for further erosion is legitimate and worth taking seriously. Predictability cuts both ways: rights-holders rely on it too.
But the original deadline was a fiction
The problem is that the August 2026 date was unenforceable on its own terms. The AI Act's high-risk obligations depend on harmonised technical standards that tell companies how to comply — and on national authorities and conformity-assessment bodies that do not yet exist in most member states. The Commission's own November 19, 2025 proposal was explicit that the delay responds to "delays in establishing standards for the AI Act's rules on high-risk AI systems, as well as in designating national competent authorities and conformity assessment bodies" (European Commission). The Parliament's own legislative tracker frames the postponement as conditional on "the necessary standards and support measures" being in place (Sofia Globe).
Holding firms to a legal obligation while withholding the standard that defines compliance is not protection — it is a trap. It would have forced companies to guess, exposed them to liability for guessing wrong, and handed the largest incumbents — the ones with compliance armies — a structural advantage over the startups the EU says it wants. A delay tied to readiness is the proportionate response, and it is the one the co-legislators chose.
What actually got cut, and what got added
The Omnibus is not a blanket rollback. The Article 4 AI-literacy duty, in force since February 2025, is softened from a hard obligation into a duty to "support the development of AI literacy" (Gibson Dunn). AI embedded in machinery products is steered toward sectoral safety law rather than facing duplicative AI Act conformity assessment — a sensible deduplication, though critics note it answered "a direct demand from the German industry" (Liberties). These are the cuts that draw fire, and reasonable people can debate whether the machinery carve-out is too generous.
What the same vote adds should temper the "deregulation" framing. The package writes a new prohibition into Article 5 banning AI systems that generate child sexual abuse material or non-consensual intimate imagery of identifiable people — the so-called 'nudifier' apps. Providers may not place such systems on the EU market unless they carry adequate safeguards against that use, and the ban reaches deployers too. Companies have until December 2, 2026 to comply (Sofia Globe). A legislature engaged in pure capitulation does not simultaneously create a new EU-wide prohibition on a live, demonstrable harm.
The contrast is instructive. The nudifier ban targets a specific, identifiable wrong with a clear victim. The high-risk regime targets categories of systems whose harms are real but diffuse, and whose compliance machinery is not built. Banning the former now while sequencing the latter is exactly the kind of evidence-proportionate prioritisation regulation should aim for. The watermarking and content-labelling duty illustrates the same logic: it is delayed only four months, to December 2, 2026, because that obligation is closer to being operational (Gibson Dunn).
The real test is what Brussels does with the time
The legitimate worry is not this delay but the next one. A postponement justified by missing standards becomes a problem if the standards are still missing in late 2027 and the clock is simply pushed again. The burden now sits squarely on the Commission and the European standardisation bodies to deliver the harmonised standards, the guidance, and the designated national authorities before December 2027 — so that the next deadline is one companies can actually meet.
Proportionate regulation is not the absence of rules; it is rules that arrive with the tools to follow them. By that standard, the Digital Omnibus is the AI Act growing up. It trades a symbolic deadline for an enforceable one, drops genuinely duplicative burdens, and still finds room to ban a concrete harm. The danger lies not in admitting the original timeline was unworkable, but in treating delay as a habit rather than a one-time correction.