Brussels rewrites ai act deadlines to keep european start-ups alive
European lawmakers just hit the snooze button on the world’s toughest AI law. A cross-party bloc rammed through the AI Act Omnibus on Wednesday, pushing compliance dates up to 30 months away and quietly shifting liability from Brussels to sector regulators.
The calendar is the battlefield
High-risk systems listed in the original 2024 text—biometric ID tools, hiring algorithms, border-control scanners—now have until 2 December 2027 to prove they are safe. Products that double as safety components get an extra eight-month cushion, with a hard stop on 2 August 2028. The excuse: harmonised technical standards will not be ready by the first deadline. The effect: a regulatory vacuum no one wants to own.
Start-ups are cheering. 35 million € fines still hang over anyone caught shipping prohibited models, but the definition of “prohibited” has been narrowed to child-sexual-abuse generators and non-consensual nudifiers. Everything else gets a grace period and a chance to embed “effective mitigation” clauses—loophole language that lawyers will feast on for years.
Child-protection groups call it a betrayal
“Delay equals danger,” snapped a policy counsel at CDT Europe. Their data show that every extra month without enforceable transparency rules adds roughly 11 million new synthetic nude images to Telegram channels, many featuring minors. The Parliament’s answer: blanket bans on nudifiers, effective immediately, with no grandfather clause. Enforcement, however, is left to under-resourced national data protection authorities already wrestling with GDPR backlogs.
Corporate lobbyists see it differently. Chipre’s deputy EU affairs minister Marilena Raouna calls the omnibus “digital sovereignty in motion,” code for keeping scarce venture capital inside the single market. The unspoken fear: California and Shenzhen racing ahead while European coders drown in paperwork.
What happens next
The full plenary votes on 26 March. If the package survives, trilogue negotiations with the Council will focus on one line: sectoral law prevails. Translation: medical-device or aviation regulators can override the AI Act if their own safety rules collide with it. Consumer groups warn this creates Swiss-cheese oversight; industry calls it regulatory clarity.
Either way, the Commission keeps the eraser. It can plug legal holes via delegated acts, a power it has used sparingly since 2024. Officials hint the first patch will land before summer, targeting general-purpose models like GPT and Gemini that straddle every sector and none.
By the time the new deadlines arrive, the average European will have uploaded another 3,000 selfies to cloud servers from companies that still have not filed mandatory risk assessments. The clock is ticking louder, even if Brussels pretends it just reset it.