When the European Union's Artificial Intelligence Act came into force in August 2024, it was widely regarded as the world's most stringent framework for governing AI. Less than two years later, Brussels has already agreed to revise it.
On May 7, negotiators from EU member states and the European Parliament reached a deal on the so-called "AI omnibus," a package of targeted amendments embedded in a broader digital simplification drive. The stated goal: reduce bureaucratic burdens, resolve overlaps with existing legislation, and give businesses more flexibility without dismantling the law's core risk-based architecture.
The result is a retooled rulebook that extends deadlines, narrows obligations, and reshapes enforcement. Whether this amounts to smart course-correction or quiet deregulation depends on whom you ask.
What Changed
The most immediate shift is time. High-risk AI systems listed under Annex 3 of the AI Act—covering employment, education, and health insurance—now face a compliance deadline of December 2, 2027, pushed back from summer 2026. AI embedded in physical products such as medical devices or industrial machinery receives even more leeway, with obligations delayed until August 2028.
The definition of "high-risk" has also been tightened. Only AI systems whose failure would pose genuine health or safety risks now trigger the heaviest obligations. Tools that assist users or optimise performance no longer automatically fall under the full regime—a change welcomed by manufacturers but viewed with suspicion by consumer advocates.
Overlaps with other EU laws have been trimmed. Where sector-specific legislation already regulates AI functions in aviation, medical devices, or financial services, companies will no longer face parallel assessments under both regimes.
One of the more contested moves: machinery has been entirely carved out of the AI Act and is now governed by its own sector-specific regulation. Companies like Siemens and ASML had lobbied hard for this change. For Sergey Lagodinsky, a Green MEP and a key voice on digital regulation in the Parliament, it is a warning sign.
"By having excluded machinery, we're making a first step into fragmenting AI regulation," Lagodinsky told Euronews. He pointed to the United States as a cautionary tale, where the absence of clear federal guardrails has left a patchwork of conflicting state rules.
The deal also adds one significant new prohibition: a ban on AI tools that generate non-consensual sexually explicit images, including deepfakes, taking effect December 2. This closes a gap that existing rules had failed to address, and aligns with broader EU efforts to combat digital abuse, as seen in the EU Bans AI Nudification Apps in Landmark Deepfake Crackdown.
What It Means for Businesses
For companies, the package offers more time and less paperwork. SMEs and small mid-cap firms benefit from simplified technical documentation, extended deadlines, and broader access to regulatory sandboxes where AI systems can be tested under temporarily relaxed rules.
The changes are proportional by design: a small company using an off-the-shelf chatbot faces far less burden than one selling high-risk AI for hiring decisions. But compliance still brings real costs, and fines remain on the table for those who fall short.
Lagodinsky said he can live with the overall outcome. "The final agreement is something that we can be okay with. I do not belong to those who say this is a catastrophe." But he was pointed about the limits of this kind of legislating. "We cannot constantly reopen the legislative process and try to take shortcuts. There is a process which is lengthier, and the integrity of this process should not be put into question."
The Core Challenge
Beneath the technical adjustments lies a harder question: can any law keep pace with AI? Lagodinsky was candid. "I am concerned that our legislative processes are much slower than the fast pace of innovation," he said, calling on the EU AI Office and the Commission to act as regulators-in-between, filling gaps through guidance, codes of conduct, and enforcement action faster than full legislative cycles allow.
"The commission is sometimes very timid or slow or late on acting, and that's why it's even more important that the commission and AI Office take their responsibilities even more seriously."
The AI Act remains, even after these changes, the world's most comprehensive AI law. Its risk-based framework is intact. But the deal sets a precedent: the rulebook can be reopened. The next test is whether the AI Office and member states enforce what remains, or whether delays and carve-outs quietly hollow out the law's ambitions. For a deeper look at how proportionality shapes EU digital rules, see EU Short-Term Rental Rules: Why Proportionality Matters for Europe's Tourism and Housing.
