On 2 August the European Union began requiring companies to tell people when they are speaking to a machine. That same date was meant to bring protection from machines deciding whether they get a job, a loan, a school place, a welfare payment, or bail. The second set of obligations will now arrive in December 2027. The Union deferred them six days before they were due.

The Instrument

The instrument was the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July and in force from 27 July. It pushed the stand-alone high-risk regime under Annex III back by sixteen months, to December 2027, and the regime for systems embedded in regulated products to August 2028.

Article 50, covering chatbot disclosure, machine-readable marking of synthetic content, and deepfake labelling, took effect as written. The European Commission’s own service desk sets out what that provision requires, and it is worth reading against what Annex III would have required.

The Case for Delay

The stated reason is readiness. The harmonised technical standards against which high-risk compliance is measured do not yet exist, two years after the Act entered into force. That is a real problem, not a pretext.

Enforcing obligations against standards nobody has written would produce arbitrary results and a regime firms could satisfy only by guessing. The Parliament that voted the deferral through by 423 to 57 was not acting in bad faith.

A Capacity Failure, not a Pause

But the readiness problem is the Union’s own. It legislated in 2024 and then failed to produce, within two years, the measuring instruments its own law depends on. That is not a reason for delay so much as an account of a capacity failure, and it should be reported as one.

Europe wrote the world’s first comprehensive law on artificial intelligence and then discovered it could not yet tell whether anyone was obeying the part that matters. Legislatures elsewhere have been drafting against that European text on the assumption it would be in force. They now have a European precedent for waiting.

The Part that Matters

Because the deferred part is the one that matters. It covers recruitment and worker management, credit scoring, access to education, essential public services, law enforcement, migration, and the administration of justice. These are the settings in which an automated decision reaches into a person’s life and is hardest to contest.

The obligations deferred with them are not paperwork: conformity assessment, human oversight, logging, and, for public bodies, fundamental rights impact assessments. Sixteen months is not a pause. It is a cohort of applicants, borrowers, and asylum seekers processed under no European rule at all.

Consider what that means in practice. A candidate screened out by a model that ranks curricula vitae has, until December 2027, no European right to human review, no assessment of the system before deployment, and no logged record to contest. A public authority may run an automated risk score across a benefits population without first conducting a fundamental rights impact assessment.

The Netherlands has shown where that leads. In the childcare benefits scandal, algorithmic risk scoring wrongly branded thousands of families as fraudsters and brought down a government in 2021. Annex III exists because that happened. Its obligations now arrive four years late.

The Case for Industry

Industry’s case is not frivolous, and it deserves stating before it is answered. Compliance without standards means compliance by guesswork, and firms that guess wrong face penalties for conduct no regulator had defined.

The provider and deployer boundary is genuinely unclear, since fine-tuning a bought-in model can convert a company from one into the other overnight. Smaller firms lack the legal capacity to resolve such questions, and the relative cost would have fallen hardest on them.

The Turn

Each point is sound. None explains why the response was to move the deadline instead of publishing the standards. Legal certainty cuts both ways: a regime deferred six days before it applies teaches every regulated party that European deadlines are provisional, which is a worse foundation for planning than a hard date.

And the argument about cost is really an argument about who carries risk in the interval. Deferral did not remove that risk. It moved it from firms to the people their systems decide about.

What Survived

What survived is disclosure. Labelling is the cheapest obligation in the Act, and the one whose effect on outcomes is least demonstrated. A person told that a chatbot is a chatbot is better informed.

A person refused credit by a model nobody has assessed is not helped by a watermark. The Union has kept the requirement that costs industry least and deferred the requirements that would have constrained it most, and it did so in the same instrument.

The real gains

The Omnibus was not only retreat. It added to Article 5 a prohibition on artificial intelligence used to generate non-consensual intimate imagery and material depicting the sexual abuse of children, and it widened the AI Office’s supervisory reach over vertically integrated providers. Those are real gains and they should be acknowledged.

From 2 August the Commission can also fine providers of general-purpose models up to fifteen million euros or three per cent of worldwide turnover. The enforcement architecture exists. It is the substantive protections that were moved.

What should follow

Three things should follow. The Commission should publish a dated schedule for the harmonised standards, so that December 2027 is a commitment rather than a hope, and so that a second deferral is politically costly.

The AI Office should report publicly, before the end of this year, on Article 50 compliance, because a transparency rule that goes unenforced is worse than no rule, teaching firms that deadlines in this Act are provisional.

And member states should say plainly whether they intend to legislate nationally in the interval. Silence at Union level will otherwise be filled by twenty-seven national answers, and the single market in artificial intelligence will fragment exactly as the law was written to prevent.

Europe’s claim in this field has never rested on having the largest models. It rested on writing the rules first, and on the argument that a market of 450 million people could set a standard others would follow. That claim survives only if the rules bind.

On 2 August the Union required a label and postponed the safeguards. A rule nobody must meet yet is not a standard. It is an intention, and intentions do not travel.