Who Fills the Capacity Gap Decides Whose Interests Get Protected

Two months before the EU AI Act's most consequential enforcement deadline, the European Commission has announced it needs outside experts to help apply the rules. The people most exposed to high-risk AI systems — workers screened by automated hiring tools, welfare recipients assessed by algorithmic decision-making, tenants scored by credit models — are not in the room when those experts are selected. That gap is not incidental. It is a design choice, and it has consequences.

What the deadline actually covers. On August 2, 2026, obligations for high-risk AI systems become enforceable across the EU. "High risk" under Annex III of the AI Act is not a vague regulatory category. It names specific applications: AI used in recruitment and worker management, access to education, credit scoring, benefits administration, law enforcement, and critical infrastructure. These are decisions that structure life outcomes. They are also decisions made about people who rarely see the system producing them and have limited legal recourse when something goes wrong.

The decisions covered by August's deadline are not abstract governance questions. They are the moments where an algorithm determines whether someone gets the job interview, the benefit payment, or the loan.

The Commission's honest problem. The AI Office, established within the Commission's DG CONNECT directorate in early 2024, was always going to be outpaced by what it was asked to oversee. It has a small technical team relative to its mandate: evaluating frontier general-purpose AI models, advising 27 member state authorities with wildly varying expertise, and now anchoring the enforcement of high-risk rules that touch nearly every sector of the European economy. The independent expert panel announced June 1 is, in part, an admission of that gap. Formalising a technical-advisory layer two months before the most important deadline in AI regulation history is not a sign of confidence. It is triage.

The Commission's existing Scientific Panel — established under Article 68 of the AI Act to advise specifically on general-purpose AI models — offers a partial precedent. That panel includes 60 independent experts and has produced technical evaluations that were not uniformly industry-friendly. The new advisory structure could follow that model. The question is whether it will.

Panel composition is the whole question. Regulatory advisory panels in technology governance have a documented history of industry overrepresentation. The pattern has been studied in pharmaceutical regulation, in financial supervision, and in digital policy: the entities subject to regulation tend to have larger research departments, more secondees available, and stronger institutional relationships with the regulators than the public interest groups ostensibly represented. If frontier AI labs and large enterprise deployers dominate this panel, what gets called "high risk" will be shaped by the entities most invested in keeping that category narrow. Enforcement thresholds will reflect their risk tolerance, not that of the workers and welfare recipients the rules were written to protect.

The Commission has not yet disclosed the panel's composition criteria, its accountability mechanisms, or how members will be selected. That silence is not neutral. Until it is filled with specifics, the panel is a governance gesture.

The selective-loosening pattern. The panel announcement does not exist in isolation. In May 2026, the Commission's Digital Omnibus package delayed regulatory sandboxes to 2027 and pushed transparency label requirements — the obligations under Article 50 that require AI systems interacting with humans to disclose themselves as such, and require deepfakes to be labelled — to December 2026. Those delays affect some of the most publicly visible consumer protections in the Act. The panel announcement affects the enforcement infrastructure that was already largely invisible to the public.

This is not a conspiracy. It reflects how regulatory processes work when technical capacity is scarce and the entities being regulated have more resources than the regulators. The Commission's proportionality framing for the delays — targeting procedural rather than substantive requirements, protecting SMEs from compliance overload — is not dishonest. But proportionality arguments in regulatory settings almost always benefit whoever has the most lawyers.

Counterweight, honestly stated. There are real reasons to think the picture is not entirely bleak. Germany's Federal Network Agency and France's CNIL have both been building AI-specific enforcement capacity ahead of August. The existing Scientific Panel has shown genuine independence on GPAI evaluation. The August 2 deadline applies to new deployments; systems already in operation have longer transition timelines, which reduces the immediate enforcement gap somewhat. An expert panel that draws on labour economists, employment lawyers, clinical researchers, and civil-society technologists alongside industry could, in principle, produce more rigorous guidance than an understaffed in-house team subject to political pressure.

These are the better-case conditions. They are not guaranteed by anything announced June 1.

What the Colorado comparison reveals. The Colorado AI Act's enforcement deadline falls June 30, 2026 — a rough transatlantic simultaneity that is worth noting. Colorado's Act, covering consequential decisions made by algorithmic systems in consumer-facing contexts, is a subnational mechanism filling a gap that no federal US body currently fills. There is no American equivalent of the AI Office, no federal enforcement mandate comparable in scope. The EU has built architecture, however imperfect. The US has not. That contrast does not make the EU's gaps smaller; it makes them more important, because the EU mechanism is, for now, the only developed regulatory structure in the world trying to govern the decisions that affect the most people.

What to watch before August 2. Panel membership disclosures, when they come, will tell most of the story. Count the civil society seats against the industry seats. Count the employment lawyers and welfare policy researchers against the model evaluators from frontier labs. The ratio will not be arbitrary — it will reflect a choice about whose expertise the Commission believes matters in deciding what "high risk" means in practice.

National competent authority designations across member states are the second thing to watch. The expert panel advises the AI Office and can assist national authorities on request. But market surveillance — the actual enforcement of high-risk rules — sits with those national bodies. Several member states still have not fully designated or resourced their authorities. An expert panel advising an AI Office that can only act on member states that have built the institutional machinery to respond is a governance structure with visible holes.

The high-risk deadline on August 2 is the moment the AI Act stops being an aspirational framework and starts being an enforcement question. The people whose job applications, benefit claims, and credit decisions are algorithmically produced have been waiting two years for this machinery to become real. Whether the expert panel hardens that enforcement or softens it will not be decided by the announcement. It will be decided by who sits on the panel, and who does not.

Footnotes

¶