Commentary. Artificial-intelligence policy has reached the stage at which lawmakers must stop confusing motion with progress. Europe’s AI Act is now moving from legislative ambition toward enforcement, but its implementation also illustrates a troubling pattern: when rules collide with commercial pressure and administrative complexity, protections for the public are the first things to be postponed.
The European Union’s framework is not toothless. Prohibitions on certain AI practices entered application in 2025, while enforcement powers and transparency obligations began taking effect in August 2026. The rules require, among other things, that people be informed when they interact with AI and that synthetic content and deepfakes be identified. The Council of the EU says the bloc has also approved measures intended to simplify the system and streamline compliance.
Yet simplification has come with delay. High-risk obligations for standalone systems have been moved to December 2027, while some systems embedded in regulated products face an August 2028 deadline. Those dates may be defensible as a practical response to unprepared regulators and businesses. They are also a reminder that a right without timely enforcement is often only a policy aspiration.
The case for patience
The strongest argument for phased implementation is not industry lobbying; it is competence. High-risk systems used in employment, education, housing, finance and essential services cannot be governed responsibly through rushed checklists. Regulators need technical staff, testing standards and procedures for handling complaints. Small companies, in particular, may struggle to meet complex requirements designed with large technology firms in mind.
That concern is reflected in the EU’s effort to reduce compliance burdens for smaller businesses and in the broader debate over whether overlapping digital, privacy and cybersecurity rules can be made coherent. A framework that nobody can understand—or that drives useful innovation out of the market—will not protect citizens effectively.
There is a legitimate economic concern, too. Europe does not want to regulate away its ability to build competitive AI companies while American and Asian rivals move faster. Excessively prescriptive rules could encourage investment and talent to leave. Flexibility can therefore be a feature of good regulation, not evidence of surrender.
Why delay still carries a cost
But flexibility must not become an indefinite waiting room. AI systems already influence hiring, credit, education, policing and access to services. Errors in these settings are not abstract technical glitches: they can deny a person a job, a loan or an opportunity to challenge an official decision. The Centre for Democracy and Technology reports that 2026 legislation in the United States has continued to focus on automated decisions in employment, housing, finance and education, even as comprehensive federal action remains stalled.
This fragmented landscape strengthens the argument for enforceable baseline rights: notice, meaningful explanation, human review and a route to appeal. Companies should know what is required, but affected people should know who is accountable. Voluntary commitments and internal audits may help; they cannot substitute for independent oversight when incentives point in the opposite direction.
The OECD’s 2026 Climate Action Monitor offers a useful parallel. It finds that policy frameworks are associated with better outcomes, but that implementation remains uneven and momentum has slowed. AI governance faces the same test. Announcing principles is easier than funding regulators, publishing enforcement decisions and measuring whether rules change real-world behavior.
A better standard
Our view is straightforward: governments should simplify the paperwork while preserving the protections. Delayed obligations should come with public milestones, interim safeguards and transparent explanations of what regulators are doing in the meantime. Firms should not face contradictory rules, but neither should citizens be asked to wait years for basic accountability.
The EU’s experiment deserves neither blanket praise nor dismissal. It is an important attempt to govern a powerful technology across borders, and its willingness to revise the framework is sensible. But revision must make rules clearer, not weaker; implementation must become more credible, not merely more gradual.
The question is no longer whether AI needs governance. It is whether governance will arrive before the harms it is designed to address become normal. Public trust will be earned through visible enforcement, not another declaration of intent.