The European Union has agreed to delay key AI Act rules covering high-risk AI systems used in areas such as biometrics, law enforcement, border control and critical infrastructure until 2 December 2027 after businesses warned compliance costs could damage competitiveness and innovation.
EU governments and European Parliament lawmakers reached a provisional agreement on Thursday to revise several parts of the bloc’s landmark artificial intelligence framework, creating additional legal uncertainty for companies already preparing for some of the world’s strictest AI compliance obligations.
The move may intensify criticism from privacy advocates and AI campaigners that Europe is softening parts of one of the world’s toughest AI regimes before many of its most significant obligations have taken effect.
The AI Act, which entered into force in August 2024, was originally presented as one of the world’s most ambitious frameworks for regulating artificial intelligence. Supporters argued the law would establish global standards around transparency, accountability and safety, particularly in areas involving surveillance, automated decision-making, cybersecurity and public services.
Businesses across Europe, however, have increasingly warned that overlapping compliance obligations, legal uncertainty and administrative costs risk undermining investment and slowing AI development at a time when European companies are already struggling to compete with American and Asian rivals.
The European Commission defended the changes as part of a broader “Digital Omnibus on AI” package designed to simplify overlapping compliance obligations while preserving core protections around safety and fundamental rights. “Today’s agreement on the AI Act significantly supports our companies by reducing recurring administrative costs,” Cyprus deputy minister for European affairs Marilena Raouna said after negotiations concluded.
Cyprus currently holds the rotating presidency of the EU Council. The Commission separately described the agreement as creating “simpler, innovation-friendly rules” intended to make implementation easier for EU businesses while maintaining safeguards for citizens.
One of the most significant changes involves the delayed rollout of rules governing “high-risk” AI systems — among the most legally sensitive and commercially disruptive parts of the legislation. These provisions apply to technologies used in sectors such as healthcare, transport, policing, border management and critical infrastructure, where regulators fear AI failures could create significant public harm or fundamental rights violations.
For companies already investing heavily in AI governance systems, internal audits, risk classification frameworks and compliance preparation, the revised timeline creates a difficult strategic question: whether to continue preparing for obligations that could still evolve politically before enforcement formally begins.
EU governments and lawmakers also agreed to exclude machinery already governed by sector-specific legislation, including the Machinery Regulation, from overlapping AI Act obligations in an effort to avoid duplicated regulatory oversight. The agreement additionally expands access to regulatory sandboxes, including an EU-level sandbox framework intended to allow businesses to test AI systems in controlled real-world conditions before wider deployment.
Certain compliance privileges previously reserved for small and medium-sized enterprises will also extend to some small mid-cap companies, reflecting a broader attempt by policymakers to reduce regulatory friction while still maintaining the core structure of the AI Act.
Even after the revisions, however, the AI Act remains one of the strictest AI regulatory frameworks globally. EU lawmakers simultaneously agreed to prohibit AI systems that generate non-consensual sexually explicit content or child sexual abuse material, responding to growing concern over “nudifier” applications and sexually intimate deepfakes.
The restrictions follow controversy surrounding explicit AI-generated content linked to Elon Musk’s xAI chatbot Grok and wider concerns about the rapid spread of synthetic sexual imagery online. Mandatory watermarking requirements for AI-generated content will also begin later this year, alongside the new restrictions targeting synthetic intimate imagery.
Dutch lawmaker Kim van Sparrentak described the deepfake measures as a necessary response to increasingly accessible AI abuse tools, saying the changes would help prevent “horrific nudifier apps” from remaining widely available across the EU market.
The broader significance of the negotiations extends beyond the AI Act itself because they expose how difficult it may become for regulators to maintain aggressive AI oversight once economic competitiveness, industrial lobbying and geopolitical pressure begin colliding with ambitious regulatory frameworks.
For businesses, the revisions reinforce a growing reality surrounding AI governance: companies are now being asked to prepare for rules that remain politically fluid even after legislation has formally entered into force.
The agreement may also intensify wider divergence around AI regulation internationally. While the EU continues pursuing a precautionary model centred on legal accountability and risk management, other major jurisdictions including the United States and the United Kingdom have so far adopted different regulatory approaches focused more heavily on existing sectoral frameworks and commercial flexibility.
That fragmentation could create increasingly difficult compliance conditions for multinational companies operating across multiple jurisdictions, particularly in areas involving biometric systems, automated decision-making, generative AI and synthetic media.
The provisional agreement must still receive formal approval from EU member states and the European Parliament in the coming months. For now, however, the negotiations suggest that even one of the world’s toughest AI laws is entering a more pragmatic phase shaped by business pressure, enforcement practicality and the difficulty of regulating a fast-moving technology market.