Brussels hits pause on the AI Act's toughest rules - but not all of them

The European Union spent years building the world's first comprehensive rulebook for artificial intelligence. This spring, it decided that parts of it were arriving too soon.

On 7 May 2026, the Council of the EU and the European Parliament struck a provisional deal - branded the "Digital Omnibus" - to postpone the most demanding parts of the AI Act, the obligations governing so-called high-risk systems. The agreement still needs formal sign-off, but its direction is unmistakable: Brussels is buying its companies, and itself, more time.

What is being delayed

The AI Act (Regulation (EU) 2024/1689) was designed to phase in over several years, and its headline date was 2 August 2026 - the day the bulk of the rules, including the obligations for high-risk AI, were due to bite. High-risk covers systems used in hiring, education, credit scoring, biometrics, policing and border control. The omnibus deal moves the goalposts:

• Standalone high-risk systems (Annex III) are now due to apply from 2 December 2027, not August 2026.
• AI embedded in regulated products (Annex I) - machinery, medical devices, toys, lifts - slips from August 2027 to 2 August 2028.
• National regulatory sandboxes, the supervised testing spaces every member state must build, get an extra year, to August 2027.

What still arrives in August 2026

The delay is partial, and the distinction matters. The AI Act's transparency obligations (Article 50) still take effect on schedule on 2 August 2026. From that date, providers must tell people when they are dealing with an AI system rather than a human, and AI-generated or AI-manipulated content - including deepfakes - must be clearly labelled. The deal even adds a new prohibition: apps designed to "undress" people in images or to manufacture non-consensual intimate imagery are banned outright.

The rules that already apply are untouched too. The ban on a handful of "unacceptable" uses - social scoring, manipulative systems, most live facial recognition in public spaces - has been in force since February 2025, and the regime for general-purpose AI models, the engines behind the big chatbots, since August 2025.

Why the EU blinked

The retreat is part of a wider European pivot from regulation toward competitiveness. Through 2025, industry groups, several governments and Washington argued that the AI Act's compliance load risked smothering European AI firms before they could scale. The omnibus swaps a complicated "conditional" trigger - which would have switched the high-risk rules on only once technical standards and support tools were ready - for fixed calendar dates, giving companies the certainty they asked for. Critics retort that Europe is watering down hard-won safeguards under pressure.

Luxembourg gets its referee

For the Grand Duchy, the more tangible question is who will police the rules. Draft law 8476, before the Chamber of Deputies, designates the Commission nationale pour la protection des données (CNPD) - the data-protection regulator - as Luxembourg's central market-surveillance authority and single point of contact under the Act, working alongside sector watchdogs for finance (CSSF), insurance (CAA) and products (ILNAS).

"The implementation of the AI Act should not be seen as a constraint, but as an opportunity." - Elisabeth Margue, Luxembourg's Minister Delegate for Media and Connectivity

The CNPD's president, Tine A. Larsen, has called the looming role "a major mandate, which we approach with total commitment and genuine enthusiasm." That enthusiasm will be tested: a small national regulator is about to inherit oversight of a fast-moving technology used across the entire economy.

A test case the world is watching

The stakes reach well beyond Europe. The AI Act has been the planet's most closely watched attempt to put guardrails on the technology, and its phased rollout was meant to set a template others would copy - the "Brussels effect" in action. The decision to ease off, under pressure from a US administration hostile to foreign tech rules and from European firms afraid of falling behind American and Chinese rivals, is being read in Washington, London and beyond as a measure of how far even the EU will bend in the global race for AI. What Luxembourg's regulator and its peers do next will help answer whether Europe can still both lead on rights and compete on speed.

What it means in practice

For a Luxembourg business deploying AI, the signal is two-track. The expensive, paperwork-heavy high-risk compliance - conformity assessments, risk-management systems, mandatory human oversight - now has until late 2027 or 2028. But the transparency duties land in 2026: a chatbot must say it is a chatbot, and synthetic media must carry a label. With fines for the worst breaches reaching €35 million or 7% of worldwide turnover, the extra time is real - but it is a postponement, not a pardon.