EU's AI Act Hits Awkward Phase: Rules in Force, But Nobody Knows What Happens Next

The European Union’s Artificial Intelligence Act has entered that awkward teenager phase where it is technically in force, but no one is entirely sure how it’s going to behave in the wild. The law has been live since August 2024, yet the real crunch comes with the 2025–2028 rollout: bans already active, general-purpose AI rules kicking in, and high-risk obligations looming while the clock and the politics both wobble. Here is the tension: on paper, August 2026 was supposed to be the big bang for high-risk AI systems, from biometric ID to hiring tools to credit scoring. Compliance guides from companies like heyData and Repello tell you to treat that date as the point when your AI governance, documentation, and monitoring must be fully operational. They talk about inventories of models, training data, metrics, post‑market surveillance – essentially an AI bill of materials wrapped in risk management. But in Brussels, the implementation story has become much messier. JD Supra recently highlighted that the European Commission already missed its February 2026 deadline to publish guidance on what exactly counts as “high-risk.” That delay rides on top of another problem: the European standardization bodies, CEN and CENELEC, also slipped their timeline for the technical standards that are supposed to anchor compliance. Without those standards, the Act’s elegant risk-based architecture starts to look like a half-built bridge. Enter the so‑called Digital Omnibus package. Ecija and AI CERTs describe how Parliament and Council are now trying to retune the AI Act mid‑flight: explicitly adding AI agents to the definition of AI systems, expanding banned practices to tackle things like non‑consensual sexualized deepfakes, and – crucially – decoupling high‑risk obligations from that fixed August 2026 date. Instead, key duties would only bite once harmonized standards and detailed guidelines actually exist, with backstop deadlines stretching into late 2027 and 2028. This is more than bureaucratic housekeeping. At Harvard’s Petrie‑Flom Center, scholars warn that in domains like medical AI, overlapping regimes – the AI Act plus medical device law – risk either strangling innovation or hollowing out protections if simplification goes too far. Bruegel, in turn, argues that enforcement capacity is becoming a geopolitical weapon: the EU wants to police Big Tech and general‑purpose models via the new AI Office, but without veering into protectionism or paralysis. So listeners are watching a live experiment in regulatory choreography. On one side, startups and SMEs, represented by groups like SMEunited, complain they cannot comply with rules that are still being written. On the other, civil society fears that every delay hardens the power of foundation model providers and surveillance vendors before the guardrails lock in. The real question for you, as someone building or deploying AI, is not whether the EU AI Act will matter, but whether you treat this uncertainty a This content was created in partnership and with the help of Artificial Intelligence AI.