EU delays AI Act high-risk rules by a year under US and industry pressure

The European Commission will on Wednesday propose a minimum one-year postponement of the Artificial Intelligence Act's high-risk obligations, effectively conceding that the bloc's landmark regulatory framework cannot be implemented on schedule. The rules, which cover AI systems used in recruitment, credit scoring, education assessment and other areas deemed to pose significant risks to health, safety or fundamental rights, were originally set to take effect in August 2025. They will now not apply before August 2026, assuming the European Parliament and member states approve the delay.

A regulatory retreat framed as technical adjustment

The Commission will present the postponement as a technical necessity rather than a political concession. Officials argue that harmonised standards, the technical specifications that companies rely on to demonstrate compliance, will not be ready until 2026 after the European standardisation bodies CEN and CENELEC missed two successive deadlines. A representative of those bodies acknowledged in September that the original timeline was "a bit ambitious from the start." Yet the decision follows months of intense lobbying from the Trump administration in Washington and from corporate lobby groups in Brussels, both of which have argued that the EU's digital rulebook threatens competitiveness at a moment when Europe is falling behind the United States and China in AI deployment.

The shift is striking. When the AI Act was adopted in August 2024, Commission President Ursula von der Leyer described it as a "historic moment" that would make people safer and set a global benchmark. Less than fifteen months later, the same executive is proposing to hit pause on the legislation's most consequential provisions. The unacceptable-risk prohibitions, covering predictive policing, social scoring and a handful of other practices, remain in force since February 2025. Rules for general-purpose AI models such as OpenAI's GPT series have applied since August 2024. But the high-risk regime, which affects thousands of companies deploying AI in hiring, lending, education, critical infrastructure and law enforcement, is the part of the law with the broadest economic reach.

The standards bottleneck

The formal justification centres on the standards gap. Under the EU's New Legislative Framework, harmonised standards developed by CEN and CENELEC give companies a presumption of conformity: if a firm follows the standard, it is deemed to comply with the law. Without those standards, companies face legal uncertainty and regulators lack clear benchmarks for enforcement. The standardisation request was issued in May 2023 with an original deadline of early 2025. That deadline was missed. A revised target of mid-2025 was also missed. The bodies now indicate delivery in 2026. Industry associations including DigitalEurope and DIGITALEUROPE have described the original compliance timeline as "unworkable" without standards in place.

Critics argue the standards delay was foreseeable and that the Commission could have acted earlier to accelerate the process or to design the law with less dependence on harmonised standards. Natali Helberger, professor of law and digital technology at the University of Amsterdam, said the episode sends a damaging signal: "A part of the message that Europe is giving to the rest of the world is that it is open to pressure from tech companies and other nations. I would say this harms the credibility." She also noted that member states have a self-interest in the delay: many have not yet designated or resourced the national market surveillance authorities required to enforce the Act. "Hitting pause will give them more time to get their act together at the national level," she said.

Member states break cover

Germany and France publicly endorsed a one-year pause on Tuesday, joining Sweden, Poland, the Czech Republic and Denmark, which had already called for a delay or grace period. Karsten Wildberger, Germany's Digital Minister, framed the move as pragmatic: "If we only could take the foot off the brake and give innovation a bit more chance, I think that's all we need." He added that the extra time must be used to "get certain things right" rather than simply postponing. France's position aligns with its long-standing push for a more innovation-friendly interpretation of the Act, particularly regarding general-purpose AI models where French companies such as Mistral AI are active.

The coalition of member states supporting the delay reflects a broader shift in the Council. Since the Act's adoption, the political conversation in several capitals has moved from regulatory leadership to competitiveness anxiety. The Draghi report on EU competitiveness, published in September 2024, warned that Europe's regulatory burden risks stifling the very technologies needed for productivity growth. That argument has gained traction as the US accelerates AI investment under the new administration and China continues state-directed deployment at scale.

Parliament concedes ground but draws a line

Within the European Parliament, even lawmakers who opposed the delay have privately accepted that it cannot be blocked. Michael McNamara, an Irish MEP from the Renew group, said last week: "Unfortunately, a pause now seems inevitable given the delay in developing the standards." He warned, however, that "there should be no further delays, because if there were, it would undermine regulation and rule of law beyond just the AI Act." The Parliament's Internal Market and Consumer Protection (IMCO) and Civil Liberties, Justice and Home Affairs (LIBE) committees, which share competence on the file, will scrutinise the Commission proposal. Their rapporteurs are expected to push for a strict sunset clause, ensuring the delay cannot be extended further, and for interim transparency requirements during the grace period.

The legislative procedure is not trivial. The Commission's proposal will take the form of a delegated act or an amendment to the Act's implementation timeline, requiring approval by qualified majority in the Council and a simple majority in Parliament. There is a hard deadline: the original Act stipulates that high-risk obligations apply from 2 August 2026 at the latest. If the institutions cannot agree on a formal postponement before that date, the rules take effect regardless, creating a cliff-edge scenario that both sides want to avoid.

Civil society warns of a precedent

Digital rights organisations have reacted sharply. Daniel Leufer, senior policy analyst at AccessNow, accused the Commission of "destroying fundamental rights safeguards and setting us up for months, if not years of infighting and legal uncertainty without any tangible gains for EU competitiveness." The concern is not only about the immediate delay but about the precedent: if the EU's most ambitious digital regulation can be paused because standards bodies missed deadlines and industry lobbied hard, other files, the Data Act, the Cyber Resilience Act, the Digital Markets Act, may face similar demands. Leufer argued that companies have had since August 2024 to prepare and that the standards gap was known well before the final text was agreed.

Other changes expected in Wednesday's package include exemptions for more companies from certain documentation and conformity assessment requirements, and a grace period for watermarking obligations on AI-generated visual content. The watermarking rules, intended to combat deepfakes and synthetic media, were among the Act's most visible consumer-facing provisions. Their postponement further dilutes the near-term impact of the legislation.

What the delay actually changes

For companies deploying high-risk AI systems, the practical effect is a reprieve from conformity assessments, risk management systems, data governance requirements, transparency obligations and post-market monitoring. Providers of general-purpose AI models are unaffected, their obligations remain on the original timeline. National authorities gain breathing room to hire specialists, build IT systems for registration and market surveillance, and coordinate cross-border enforcement. But the regulatory vacuum also means that for at least another year, there is no legal requirement for a bank using AI to assess loan applications to demonstrate non-discrimination, or for a hiring platform to prove its algorithms do not systematically disadvantage protected groups.

The Commission will argue that voluntary compliance during the grace period, combined with the existing unacceptable-risk prohibitions, provides sufficient protection. Sceptics counter that without enforcement teeth, voluntary compliance will be limited to companies that were already inclined to follow best practice. The next twelve months will test whether the EU can use the extension to fix the standards pipeline and build enforcement capacity, or whether the delay becomes a permanent weakening of the Act's ambition.