Europe Didn’t Cut AI Rules. It Moved the Deadlines
Simplification Is Not Deregulation
When Brussels unveiled its “Digital Omnibus” on 19 November 2025, many read it as a retreat from strict digital regulation. The reality is more nuanced. The package was designed to reduce overlap and duplication between rules, not to lower the bar. The duties companies already carry on privacy, transparency, and risk management are untouched. What changes is how the pieces fit together and when they start to apply.
The AI Part Is Now Law
The AI-specific portion has moved from proposal to reality. The AI Omnibus entered into force on 27 July 2026, and it resets the calendar. Stand-alone high-risk systems, such as AI used in hiring, education, or access to essential services, were due to comply from 2 August 2026. That date is now 2 December 2027. AI embedded in regulated products like machinery, toys, and lifts follows on 2 August 2028. The reason is practical: the technical standards and conformity assessment tools companies need were not ready in time.
Relief for the Middle of the Market
Some of the most useful changes help companies that are no longer small but not yet large. Simplified obligations once reserved for SMEs now reach small mid-cap companies, a group that includes many technology and industrial firms. Duties around AI literacy and registration are lighter, and sandboxes for testing AI under supervision expand, including a new EU-level one.
Safeguards Got Firmer, Not Softer
The package tightens in places too. It prohibits AI systems that generate non-consensual intimate content or child abuse material, and the AI Office takes a bigger supervisory role over AI built on general-purpose models, especially when it runs inside major platforms and search engines. Not everything slipped either: several transparency obligations still applied from 2 August 2026.
Why a Later Deadline Is a Trap
Extra time invites waiting, and that is a mistake. The broader direction of the omnibus is toward coordinated enforcement, with data protection, cybersecurity reporting, and AI rules assessed together at product level. Gaps in governance and documentation are likely to surface earlier, not later. The organizations that gain most will use the breathing room to build compliance into design decisions now, not retrofit it under pressure in 2027.
The Takeaway for Leaders
The hard part used to be finding the right rulebook. Now it is reconciling several of them on a single product. Map your AI systems, classify the risk, and assign clear ownership across legal, security, and engineering. The deadline moved. The expectation did not.
