The AI Act's High-Risk Delay Is the Quiet Part Said Out Loud

The European Union spent four years building the world's first comprehensive AI rulebook and then, on the eve of its hardest obligations biting, agreed to push them back. On 7 May, after negotiations that nearly collapsed in late April, EU legislators reached political agreement under the Digital Omnibus revision to postpone the high-risk system obligations of the AI Act beyond August 2026. Conformity assessments for AI in healthcare, hiring, education and justice, the parts that actually constrain deployment, slip. The political agreement still needs formal adoption, but the direction is set.

I want to be careful about what this is and what it isn't. It is not, on its own, a repudiation of the AI Act. The prohibitions on unacceptable-risk uses took effect in February 2025 and remain. The general-purpose model obligations remain. What has moved is the timetable for the regime that would have forced thousands of deploying organisations through conformity assessment for the systems they are already running.

That distinction matters, because it tells you which constituency won the lobbying round, and it isn't the one most commentary will name.

The obvious reading is wrong, or at least incomplete. The convenient story is that American hyperscalers and frontier labs leaned on Brussels and Brussels folded. There is some truth in it, the lobbying was heavy, and the Commission's competitiveness anxiety post-Draghi is well documented. But the high-risk regime was never primarily a frontier-lab problem. OpenAI, Anthropic, Google DeepMind and Mistral are regulated through the general-purpose model chapter, which is not what got delayed. The high-risk regime is a deployer problem. It lands on the hospital using a triage model, the bank using a credit-scoring system, the ministry using a benefits-eligibility classifier, the HR function using a CV screener. These are the organisations that were not going to be ready, and these are the organisations whose trade bodies got the delay.

The second inversion. If you believed, as the Commission's 2021 impact assessment did, that the high-risk regime was the operative part of the Act, the part that would actually change behaviour on the ground, then delaying it is not a tweak. It is the structural concession. The prohibitions catch a narrow set of egregious uses. The GPAI chapter catches a handful of labs. The high-risk regime was supposed to catch the long tail: the thousands of deployments that quietly shape who gets hired, treated, admitted, paroled. That tail is now unconstrained for at least another cycle.

This is where the adoption-versus-capability frame actually pays off, because the EU has effectively confirmed what the deployment data already suggested: enterprises are not ready to operate these systems under the documentation, monitoring and human-oversight regime the Act envisioned. The capability has been sitting there for two years. The compliance scaffolding, internal model registries, conformity files, post-market monitoring, fundamental rights impact assessments, has not been built. The choice in front of legislators was either to let enforcement land on organisations that would visibly fail it, or to move the date. They moved the date.

The choice was either to let enforcement land on organisations that would visibly fail it, or to move the date. They moved the date.

What this tells you about the regulatory equilibrium. Three things, I think, and one of them is uncomfortable.

First, the Act as written assumed a deployer base capable of conformity assessment at industrial scale. That base does not exist. The notified bodies needed to audit high-risk systems are thin on the ground; the harmonised standards under CEN-CENELEC are still being finalised; the internal capacity at deployers to produce technical documentation against Annex IV is, generously, nascent. A regulation that requires infrastructure that doesn't exist will either be delayed or ignored. Brussels chose delayed, which is the more honest of the two options.

Second, the political coalition that built the Act has weakened. The 2024 Act passed with civil-society wind behind it and a Commission willing to spend competitiveness capital on rights protections. The 2026 Commission is operating in a different climate: Draghi's report, an industrial policy turn, an explicit competitiveness agenda, and a United States that has effectively abandoned its own AI executive order architecture. The high-risk regime was the part most exposed to that shift, because it was the part with the most diffuse beneficiaries and the most concentrated costs.

Third, and this is the uncomfortable one, the delay does not buy the time it claims to. The harmonised standards will not be finished by the new date either, on current trajectory. The notified body capacity will not have materialised. The deployer documentation culture will not have spontaneously emerged. A delay without a credible plan to fix the underlying readiness gap is a delay that will be asked for again.

What I'd watch. Three things, in declining order of how much they'll tell you.

The standards pipeline. If CEN-CENELEC publishes the core harmonised standards on risk management, data governance and human oversight within the next six months, the new timetable is plausible. If they slip again, the next delay is already priced in.

The conformity assessment market. High-risk AI conformity is meant to be a real industry, notified bodies, accredited testers, technical documentation specialists. If that ecosystem is visibly forming by year-end, the regime is becoming real. If it isn't, the Act is drifting toward the GDPR pattern of paper compliance and selective enforcement.

The member state divergence. The Act is an EU regulation, but enforcement runs through national competent authorities. France, Germany, the Netherlands and Ireland will not enforce this at the same pace or with the same temperament. The delay gives the most aggressive authorities room to publish guidance and signal their posture before obligations bite. Watch the AI office in Paris and the Dutch DPA. They will set the tone the rest of Europe converges to or rebels against.

The honest summary is that the AI Act's high-risk regime has been quietly de-prioritised in favour of keeping the rest of the Act intact and the competitiveness narrative alive. That is a defensible choice. It is not a costless one. The deployments the regime was meant to discipline are happening anyway, at scale, in exactly the sectors, health, employment, education, justice, where the costs of getting it wrong fall on people with the least recourse.

The Act will arrive. Just not in August 2026, and not, I suspect, in the form anyone in 2024 imagined.

Footnotes

¶