Brussels Just Rewrote Its Own AI Law — Weeks Before It Applies

Imagine passing the strictest AI law in the world, telling every company on the continent to get ready — and then, weeks before the hardest parts kick in, quietly changing the rules. That is more or less what just happened in Brussels, and most business owners have not caught up.

The vehicle is called the “Digital Omnibus on AI.” The Council gave it final political sign-off on 29 June 2026, the final act was signed on 8 July 2026, and it is now waiting to be published in the Official Journal before it formally applies. It amends the AI Act itself. So the law you were told to prepare for is not quite the law that will actually land.

Here is what actually got decided — the relief, the parts that did not move, and the spicier bits nobody put in a press release.

The headline: the hard deadlines got pushed

The big change is a delay. The high-risk obligations — the heavy compliance regime everyone was bracing for — have been deferred.

Stand-alone high-risk systems (Annex III) now apply from 2 December 2027.
High-risk AI embedded in regulated products (Annex I) moves to 2 August 2028.

That is real breathing room, and depending on where you sit it is either sensible pragmatism or a retreat. Industry groups wanted it. Critics argue Brussels blinked under pressure — from big platforms and from across the Atlantic — and watered down its flagship law before it even took full effect. Both readings are defensible, and you do not have to pick one to see the practical point: “high-risk got delayed” is being misheard as “the AI Act got delayed.” It did not.

The part that did NOT move — and this is the part that is yours

Read this slowly, because it is where small companies get caught.

The delay touched high-risk. It did not touch the two obligations most ordinary businesses actually fall under:

Article 4 — AI literacy. In force since 2 February 2025. If you deploy AI and your staff have had no structured training, that gap is live right now.
Article 50 — transparency. Applies from 2 August 2026, unchanged. Chatbots must be labelled as AI; AI-generated content must be marked as such. The Commission even published detailed guidelines for it on 20 July 2026.

So the deadline that dominated the headlines moved, and the two rules most likely to apply to a normal 10–249 person company did not. If you exhaled when you saw “delay,” you may have exhaled at the wrong news.

The spicy bit nobody advertised: a new ban

While Brussels was easing some rules, it quietly tightened others. The Omnibus adds a new prohibition to Article 5: AI systems designed to generate non-consensual intimate imagery — the “nudifier” apps — and child sexual abuse material.

This matters beyond the obvious moral line. Article 5 is the “prohibited practices” tier, and it carries the heaviest penalty in the whole Act: up to €35 million or 7% of worldwide annual turnover. A law that is supposedly being “simplified” just grew a new outright ban with the largest fine attached. Simplification and expansion, in the same package.

And the AI Office got more muscle

The other quiet decision: the newly operational EU AI Office picked up expanded powers, and it has already begun its first wave of scrutiny into “systemic risk” models. So even as the timeline softened, the enforcement machinery got stronger. The direction of travel is not “less oversight.” It is “later, but sharper.”

What this means for a small business

Strip out the politics and here is the operating summary:

Do not relax because of the delay. High-risk moving to 2027–2028 changes almost nothing for a typical SME — most small companies were never in the high-risk tier anyway. You are a “deployer,” and your dates are Article 4 (already live) and Article 50 (2 August 2026).
The transparency rules are locked in for 2 August 2026. Chatbot label, AI-content marking. The guidelines now exist — there is no “we weren’t sure” defence left.
The severity signal went up, not down. A new prohibition with a 7%-of-turnover ceiling, plus an AI Office actively investigating, is not a regulator winding down.

The businesses that read “delay” and stopped preparing are making a bet on a headline they misread. The ones who quietly finish their literacy record and their disclosure plan will be calm on 2 August while everyone else scrambles.

The question worth sitting with

Was the Digital Omnibus a sensible course-correction on an over-ambitious timeline — or the first sign that the world’s toughest AI law bends when the pressure is high enough? I have a lean, but I would rather you form your own.

Either way, the practical answer does not change: find out which obligations actually apply to you, before the date decides for you.

Start with the free 2-minute self-check → it tells you exactly which parts of the AI Act apply to your business, then points you to the plain-language Handbook (€35) if you want the full walkthrough. Link: linktr.ee/frelih

This article was written by me and edited with AI — the kind of disclosure Article 50 is about. It is general information on the EU AI Act, not legal advice.