On 19 November 2025, the European Commission announced a significant delay to parts of its landmark AI Act, postponing stricter obligations for high-risk AI systems to December 2027 instead of the initially planned August 2026. This announcement, made as part of the so-called “Digital Omnibus” package, reflects Brussels’ attempt to streamline regulatory burdens, respond to industry concerns, and ensure that the necessary standards and guidance for enforcement are fully developed. While the Commission emphasizes that this move is about simplification rather than deregulation, it nonetheless reshapes the regulatory landscape, with major implications for businesses and European law firms advising on AI compliance.
The delay specifically targets high-risk AI applications in sensitive areas such as biometric identification, credit assessment, healthcare, recruitment, law enforcement, and critical infrastructure. Under the proposal, the delayed rules will only come into force once the Commission formally adopts decisions confirming that the relevant technical standards and guidance materials are ready. If these decisions are not finalized, a “backstop” mechanism ensures that rules in Annex III will become enforceable by 2 December 2027 and those in Annex I by 2 August 2028.
According to Henna Virkkunen, the European Commission’s Executive Vice-President for Digital, the postponement is essential to guarantee that enforcement can be both effective and proportionate. Without fully developed standards and guidance, companies may struggle to comply, and regulators may find it difficult to enforce rules consistently. The broader “Digital Omnibus” initiative is designed to simplify the EU’s digital rulebook, clarifying and updating existing legislation such as the GDPR, the e-Privacy Directive, and the Data Act, with the aim of fostering innovation without compromising safety.
The decision has generated a mix of reactions. Civil society groups and digital rights organizations have expressed concern that the delay could weaken protections, particularly regarding accountability and transparency for AI systems. Liberties.eu has warned that postponing these rules risks rolling back critical safeguards embedded in EU law. Consumer advocates echo these concerns, cautioning that high-risk AI applications in areas such as healthcare and lending could operate with insufficient oversight during the extended interim period. Conversely, industry groups, including the Computer & Communications Industry Association (CCIA), have welcomed the delay, noting that the additional time allows companies to prepare compliance programs without stifling innovation.
For European law firms, the delay presents both challenges and opportunities. On one hand, it provides firms with more time to advise clients on compliance strategies, develop phased implementation roadmaps, and interpret forthcoming technical standards. Companies now have the space to embed robust governance and risk management practices into their AI operations, rather than rushing to meet a looming deadline. On the other hand, the delay introduces a degree of regulatory uncertainty. Firms must guide clients on the implications of the “backstop” mechanism, monitor the adoption of final standards, and prepare for potential divergence in enforcement approaches across member states. Advising clients on how to navigate this uncertainty, while positioning themselves competitively in the European AI market, will be a key service area for law firms in the coming years.
Strategically, the delay signals a shift in the European approach to AI governance. It emphasizes a more innovation-friendly stance, recognizing that overly rigid regulation could hamper Europe’s competitiveness in the global AI market. For law firms, this means advising clients not only on compliance but also on how to leverage the regulatory environment to support innovation and business growth. Firms will also play a crucial role in supporting client engagement with policymakers, including contributing to consultations, participating in industry roundtables, and monitoring legislative developments to anticipate changes in obligations.
In conclusion, the European Commission’s postponement of the high-risk AI rules under the Digital Omnibus package represents a significant recalibration of the EU’s AI regulatory framework. While it eases immediate compliance pressures, it also introduces new uncertainties and legal challenges. For law firms, the period leading up to the new enforcement dates presents a valuable opportunity to provide strategic counsel, help clients future-proof their AI operations, and navigate a complex and evolving legal landscape.
