Commentary. Europe’s latest adjustment to its artificial-intelligence rulebook deserves neither automatic applause nor reflexive condemnation. The European Union is right to acknowledge that regulation written faster than technology can become unworkable. But by delaying key obligations, policymakers are also testing whether flexibility can coexist with credible protection.
The change is part of the EU’s Digital Omnibus on AI, approved this year after negotiations among the European Parliament, member states and the Commission. It postpones the application of rules for stand-alone high-risk systems until December 2, 2027, and for high-risk AI embedded in products until August 2, 2028. The obligation to label AI-generated content is also delayed for some systems until December 2, 2026. The final act was signed in July and published in the EU’s Official Journal later that month.[European Parliament]
Our view is that the delay is defensible only if it is used to improve implementation, not to quietly reduce ambition. High-risk AI is not an abstract category. It can affect employment, access to essential services, education, law enforcement and other decisions where an error can change a person’s life. A postponed deadline may give companies and regulators time to build testing, documentation and oversight systems that actually work. A rushed compliance regime could instead produce paperwork without meaningful safety.
The case for breathing room
Europe’s framework is unusually broad, and its complexity creates legitimate concerns. Companies need technical standards, clear guidance and competent national authorities before enforcement begins. Smaller firms may lack the legal and engineering teams required to interpret overlapping obligations. If deadlines arrive before those institutions are ready, the law could reward the largest businesses while discouraging useful innovation.
That argument is strengthened by the fragmented debate elsewhere. In the United States, Congress has discussed multiple AI bills but, according to CNN’s recent account, has not passed comprehensive federal legislation. States are moving ahead while Washington debates whether federal action should replace or limit state rules.[CNN] Europe can reasonably conclude that durable rules require technical precision, not simply an early enforcement date.
The revised EU text also adds a prohibition on AI practices generating non-consensual intimate or sexual content and child sexual abuse material, while reinstating a simplified registration obligation for certain non-high-risk systems. Those changes suggest that the process is not merely deregulation; some protections have been clarified or strengthened.[European Parliament]
The cost of delay
Still, “implementation” can become a euphemism for postponement without accountability. The public is already asked to trust systems that generate convincing falsehoods, imitate people and influence consequential decisions. Delayed transparency makes that trust harder to earn. When users cannot reliably tell whether an image, video or statement was generated by software, the burden falls on journalists, educators and citizens to detect manipulation after it spreads.
There is also a competitive danger. A common European rulebook was supposed to prevent a race in which firms gain advantage by accepting greater social risk. If obligations remain uncertain for years, responsible companies may spend money preparing while less scrupulous competitors wait. Regulation should not punish caution.
The strongest counterargument is that overly strict rules can entrench incumbent technology companies. Compliance costs may be manageable for global platforms but prohibitive for startups, universities and small manufacturers. That concern is real, and regulators should offer shared testing infrastructure, model documentation templates and proportional requirements. Yet proportionality must not mean allowing powerful systems to escape scrutiny merely because their developers call them experimental.
What Europe should do next
The EU should publish a firm implementation timetable, measurable milestones and public progress reports. It should explain which technical standards remain unfinished, which agencies will enforce them and how complaints will be handled during the transition. Delays should expire automatically unless lawmakers make a transparent case for another change.
Europe should also distinguish between administrative readiness and immediate harm. A company may need more time to complete a complex conformity assessment; people facing non-consensual sexual imagery or discriminatory automated decisions should not have to wait for a perfect bureaucracy. The new prohibitions are a useful start, but enforcement resources will determine whether they are more than text in a regulation.
The EU’s instinct to regulate AI is sound. Its mistake would be to confuse patience with passivity. We support the delay as a narrowly justified engineering pause, not as a retreat from oversight. The credibility of the AI Act will be measured less by the elegance of its promises than by whether citizens can see, challenge and remedy the systems that govern parts of their lives.