Today, July 27, 2026, the EU's AI regulatory rulebook changes again.

The Digital Omnibus on AI, formally published in the Official Journal of the European Union on July 24, takes effect today. The core of this amendment can be summed up in one sentence: more time for companies, but tighter power at the center.

Delay Doesn't Mean Relaxation: The Truth About High-Risk AI Postponement

The most eye-catching change is that the applicability timeline for high-risk AI systems has been pushed back.

Standalone high-risk AI: delayed to December 2, 2027. Embedded high-risk AI (like AI in medical devices or automobiles): delayed to August 2, 2028. All told, companies have gained roughly 12 to 18 months of breathing room.

On the surface, this looks like regulatory loosening — giving the industry more time to prepare. But look closer and you'll find that while the timeline has been pushed back, the scope and enforcement of the rules have actually grown stronger.

How to make sense of this logic? Imagine: if the goal of regulation were “get rules in place as soon as possible,” you'd enforce on schedule or even early. But if the goal is “build a set of rules that actually work and actually hold up,” then spending more time refining the rules and building out enforcement mechanisms means regulation will be stricter and more durable. The EU isn't going easy on AI — it's making sure that when it strikes, it strikes decisively.

Power Flows Upward: The Commission Gets Four New Trump Cards

The truly important change in the amendment isn't how long the delay is — it's what new powers the European Commission has gained. Four trump cards, all pointing in the same direction: regulatory power is centralizing from member states to the EU level.

Card one: strengthened rule coordination power. The Commission can coordinate the application of the AI Act with sectoral legislation like machinery and medical device regulations through implementing acts, reducing overlap. In plain language: if AI regulation conflicts with other regulatory domains, the Commission decides. This solves the old “too many cooks” problem of AI regulation, but it also means the Commission's voice gets much louder.

Card two: expanded quasi-legislative power. The Commission can add new AI health and safety requirements through delegated acts under the Machinery Regulation. Put simply: the Commission can impose new safety requirements on AI without going through the full parliamentary legislative process. This is “quasi-legislative” power — efficient, but with relatively weaker democratic oversight.

Card three: enhanced centralized enforcement. The EU AI Office gets explicit oversight authority over general-purpose AI model systems, pushing AI regulation from fragmented member-state enforcement toward EU-level centralization. Previously, each member state did its own thing with inconsistent enforcement standards, and companies could “pick the softest target.” Now power converges at the EU AI Office — one standard, one team, across the whole bloc. Enforcement intensity will increase significantly.

Card four: strengthened soft-law interpretation. The Commission is required to issue guidance coordinating the AI Act with sectoral legislation. “Guidance” sounds soft, but in the EU legal system, these guidance documents often become the de facto basis for enforcement — both companies and regulators follow them.

Put the four cards together, and the picture is clear: the decision-making center of AI regulation is shifting from “27 member states each doing their own thing” to “unified command from Brussels.” For companies, the good news is no more 27 different rulebooks. The bad news? That one unified rulebook might be stricter than any single member state would have written on its own.

See you tomorrow.