EU Council Backs Delayed AI Act Enforcement as Civil Society Warns of Regulatory Retreat
The EU Council agreed to delay high-risk AI system rules to late 2027 and 2028, adding a deepfake ban while drawing civil society warnings of deregulation disguised as simplification.
The Council of the European Union on March 13 adopted its negotiating mandate on a proposal to streamline the bloc’s landmark AI Act, approving a package of amendments that would delay enforcement of high-risk AI system rules by more than a year while extending regulatory relief to a wider range of companies.
Under the Council’s agreed position, standalone high-risk AI systems — covering applications such as biometric identification, creditworthiness assessment, and law enforcement tools — would face compliance deadlines of December 2, 2027, rather than the original August 2026 target. High-risk AI systems embedded in regulated products such as medical devices and vehicles would have until August 2, 2028. The proposal forms part of the European Commission’s seventh Omnibus simplification package, a broader deregulatory effort launched in the wake of the November 2024 Budapest Declaration and informed by former Italian Prime Minister Mario Draghi’s report on EU competitiveness.
New Prohibitions and Safeguards
The Council mandate is not purely a relaxation of existing rules. Member states inserted a new prohibition targeting AI systems used to generate non-consensual sexual and intimate imagery or child sexual abuse material, addressing a gap that the original AI Act did not explicitly cover. The mandate also reinstates an obligation for AI providers to register their systems in the EU’s centralized database even when they claim exemption from high-risk classification, a transparency measure the Commission’s initial proposal had sought to remove.
On bias detection, the Council reintroduced a “strict necessity” standard for processing sensitive personal data to identify and correct algorithmic discrimination, pushing back against a Commission proposal that would have broadly expanded the use of sensitive data across all AI systems.
Regulatory Relief for Smaller Companies
The agreed text extends compliance simplifications currently available to small and medium enterprises to small mid-cap companies, a category that includes firms with up to 500 employees. The deadline for member states to establish national AI regulatory sandboxes — controlled testing environments where companies can develop AI under supervisory oversight — has been pushed to December 2, 2027. The Council also shifted the AI literacy obligation from a mandate on providers to ensure staff competency toward a softer requirement for governments to foster general AI awareness.
Parliament Divided, Civil Society Opposed
The mandate now moves to trilogue negotiations with the European Parliament, where the proposal has exposed deep political divisions. The centre-right European People’s Party, Renew, and the European Conservatives and Reformists have broadly welcomed the streamlining effort. Members from the Socialists and Democrats, Greens, and Left groups have questioned whether the delays are necessary and have raised concerns about what they describe as geopolitical pressure from the United States influencing the EU’s regulatory stance.
Outside the institutions, opposition has been more unified. When the Commission first unveiled the Digital Omnibus in November 2025, the European Consumer Organisation characterized it as deregulation that benefits large technology companies rather than European consumers or smaller firms. Finance Watch warned that delayed enforcement of high-risk rules could mean a person denied a loan by a biased AI model would have no recourse or even knowledge of the decision. A coalition of 127 civil society organizations, trade unions, and public interest groups has urged the Commission to halt the Omnibus plans entirely, arguing that the proposed changes would undermine hard-won digital rights protections.
Cyprus Deputy Minister Marilena Raouna, whose country holds the current Council presidency, framed the agreement differently. “Streamlining the AI rules is essential for ensuring the EU’s digital sovereignty,” she stated.
What Comes Next
The trilogue process is expected to move quickly given the political urgency attached to competitiveness reforms. Adoption of the final text is projected for mid-2026. If the amended timeline holds, companies developing high-risk standalone AI systems would gain roughly 16 additional months to prepare for compliance, while those building AI into regulated products would have an extra two years beyond the original schedule.
The outcome will determine whether the EU AI Act — widely regarded as the world’s most comprehensive AI regulatory framework when it was adopted in 2024 — retains its ambitions or arrives at full enforcement in a substantially softened form.