The EU's AI Watchdog Just Blinked: High-Risk AI Enforcement Is Slipping Into 2027

The short version

Brussels promised to regulate AI. Now it's asking for more time — again.

The European Commission missed a February 2026 deadline to publish guidance on Article 6 of the EU AI Act, the key provision that determines whether an AI system counts as "high-risk." Now, the proposed Digital Omnibus package would push most high-risk enforcement out of August 2026 entirely — into mid-to-late 2027 at the earliest.

---

Why it matters

The EU AI Act was supposed to be the world's most comprehensive AI regulation. But enforcement infrastructure keeps slipping:

• The Commission never delivered the Article 6 guidance it owed companies by February 2, 2026
• Two technical standards bodies missed their own fall 2025 deadlines (now aiming for end of 2026)
• Member states have struggled to appoint enforcement authorities
• Trilogue negotiations on the Digital Omnibus are still ongoing — compliance teams are in limbo

What this means for you: If you use any AI tool that collects your data in the EU, or you're a company trying to determine whether your product is "high-risk" — the rulebook is still being written. The laws exist on paper, but enforcement is months or years away.

---

What is being enforced right now

Not everything has been delayed. As of April 2026:

• Prohibited AI practices (systems that manipulate or exploit) are already enforceable
• General-purpose AI model rules — transparency obligations for foundation models — are active
• The EU AI Office is conducting audits and can issue fines up to 7% of global annual turnover

The gap is specifically in high-risk AI: medical diagnostics, credit scoring, biometric identification, employment screening, and critical infrastructure — the sectors where enforcement matters most.

---

The accountability vacuum

Here's the problem: the areas of highest AI risk are precisely where enforcement is most delayed. Companies are deploying high-risk systems today with no clear regulatory accountability.

Large incumbents benefit from this ambiguity — they can afford compliance teams to navigate uncertainty. Smaller players trying to do the right thing get punished by unclear rules.

---

Bottom line

The EU AI Act remains the world's most serious attempt at AI accountability. But a law without enforcement infrastructure is just a statement of intent.

If you're wondering whether your data is being protected by the AI systems that touch your life in Europe: the answer is still "kind of, in theory, eventually."

Keep using tools that don't need a law to tell them to respect your privacy. That's why GPTAnon exists.

---

Sources: IAPP · OneTrust · LegalNodes