EU Digital Rulebook: Compliance Changes Ahead

The EU Digital Rulebook in Motion: Brussels Blinks, Then Doubles Down

Brussels delayed the AI Act's toughest rules to 2027–2028 — but fined X, Meta and Apple over $900m and locked in a compliance calendar every global tech firm now has to plan around.

Brussels has just quietly rewritten the compliance calendar for every company that touches European users — and the headline concession is not what it looks like. On June 16, 2026, the European Parliament approved the Digital Omnibus on AI by 423 votes to 57, pushing full application of high-risk AI rules to December 2, 2027 for stand-alone systems and August 2, 2028 for AI embedded in products, according to the European Parliament Research Service. Read as a retreat, that is wrong. The delay is the price Brussels paid to keep the rest of the digital rulebook — the Digital Services Act, the Digital Markets Act, the Cyber Resilience Act, NIS2 — moving into hard enforcement while Washington and Silicon Valley were still pressing to gut it. The winners are the compliance-heavy incumbents that can absorb €200,000-a-year audit bills; the losers are European mid-caps that lobbied for simplification and got a two-year reprieve on a bill that still lands.

What actually changed on paper

The Digital Omnibus on AI is a narrow instrument. It amends Regulation (EU) 2024/1689 — the AI Act itself — to link the entry into force of Chapter III's high-risk obligations to the availability of harmonised standards, but with hard backstop dates. The provisional agreement, published by the Parliament's IMCO/LIBE committees on May 13, 2026, sets application at "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I," according to the provisional agreement text.

The Council of the EU's March 13, 2026 press release framed this as "streamlining" rather than retreat, arguing the delay reflects the fact that CEN-CENELEC's harmonised standards — the JTC 21 workstream of roughly 35 technical specifications — are not ready. As the Council of the EU put it: streamlining "is essential for ensuring the EU's digital sovereignty." That is not a rollback; it is a bet that if the standards land, the rules stick.

Three other pieces of the package matter more than the delay itself. First, Parliament and Council added a new prohibition on AI systems that generate non-consensual intimate imagery and child sexual abuse material — a substantive expansion, not a simplification. Second, the deadline for marking AI-generated content was pushed to December 2, 2026, but only for legacy systems placed on the market before August 2, 2026; anything shipped from August 2 forward carries the transparency duty from day one. Third, the Commission retained — and reinforced — the AI Office's centralising powers over general-purpose AI models, according to the EPRS briefing.

The pressure that produced this

The concession did not come cheap and it did not come first. In July 2025, a coalition of European CEOs — SAP, ASML, Airbus, Mistral among them — publicly urged Ursula von der Leyen to impose a two-year pause on the AI Act, the Financial Times reported. By November 2025, the Commission had proposed an omnibus that Al Jazeera characterised as "the culmination of a showdown between tech companies aggravated by red tape and privacy advocates fearful of an erosion of digital rights," according to Al Jazeera. NOYB's Max Schrems called it "the biggest attack on Europe's digital rights in years."

The Trump administration weighed in loudly. Marietje Schaake, in a July 2026 conversation with Brookings, noted that "the Trump administration takes most issue" with the Digital Services Act, and warned that "the sort of credibility and the legitimacy of the laws … begins to corrode" when enforcement wobbles. The Commission's answer, judged by what it actually adopted, was to trade timing for substance: give industry breathing room on high-risk AI, and use the same period to press cases under the DSA and Digital Markets Act.

The enforcement counter-move

Here is what Washington and Silicon Valley did not get. Between April 2025 and April 2026, the Commission moved from theoretical enforcement to actual penalties. Apple was fined roughly $584 million and Meta $233 million under the Digital Markets Act for anti-steering rules in the App Store and the "pay or consent" advertising model, respectively, according to NPR. In December 2025, the Commission imposed a €120 million ($140 million) DSA fine on Elon Musk's X for deceptive blue ticks, an unusable ad repository and obstructing researcher access, the BBC reported. That is small money against 6% of global turnover, but it establishes the DSA as a live instrument.

Then on April 29, 2026, the Commission issued preliminary findings that Meta had failed to keep under-13s off Facebook and Instagram — a case that opens the door to a penalty of up to 6% of Meta's worldwide revenue, according to NPR. Henna Virkkunen, the Commission's executive vice-president for tech, put the doctrine plainly in her statement on the Meta case: "The DSA requires platforms to enforce their own rules: terms and conditions should not be mere written statements, but rather the basis for concrete action."

The pattern is unmistakable. On AI, where standards are not ready and lobbying was most intense, Brussels blinked. On platforms, where the DSA and DMA are already in force and civil-society constituencies are engaged, it did not.

The compliance cost nobody wants to talk about

The Bruegel think tank has documented what the AI Act does to firm-level economics. Compliance costs for a single AI system run €14,623 to €29,277 — roughly 9% to 17% of the development cost of an average €170,000 AI system, according to Bruegel. Because "requirements do not scale with developer size," the AI Act "risks favouring large firms that can absorb compliance costs and entrenching incumbent dominance" — the same distortion GDPR produced.

A more granular study in the European Journal of Risk Regulation, based on interviews with AI providers, put anticipated annual compliance costs at roughly €100,000 for dedicated compliance staff, "with one medical tech company estimating certification costs exceeding €200,000, while others in legal tech report annual costs between €200,000–300,000," according to Cambridge University Press. The paper flags a "temporal, structural and operational" mismatch: standards expected in early 2026, compliance originally required by August 2026, but companies typically need 12 months to implement a single standard.

The Digital Omnibus fixes the temporal problem for high-risk systems by moving the goalposts to 2027–2028. It does not fix the structural one. CEN-CENELEC's JTC 21 remains dominated by large-enterprise representatives; SMEs still lack resources to shape the standards to which they will then be held. Reading the fine print, the winner of "simplification" is not the European scale-up. It is the compliance-mature multinational — the same class of firm that made peace with GDPR by hiring 400-person privacy teams.

Why the Brussels effect is narrower than advertised

The consensus that the AI Act will export EU rules worldwide — the so-called Brussels effect — is looking thinner than its authors claim. Cameron Kerry's Brookings analysis concluded that the AI Act will produce "only targeted extraterritorial impact, and a limited Brussels effect." Rules on high-risk AI in regulated products will bite globally because product markets are integrated; rules on locally-deployed AI in human services — the hiring engine that reads CVs in Marseille — can be regionalised in code.

That matters for the strategic read on the Digital Omnibus. A two-year delay on high-risk AI is unlikely to shift the global regulatory equilibrium, because outside a narrow band of internationally traded products, non-EU deployers will simply run EU-compliant configurations for EU users and something else everywhere else. The rules that actually export are the DSA transparency obligations and the DMA's structural remedies against gatekeepers — precisely the rules the Commission has doubled down on, not diluted.

Real Instituto Elcano, in a June 2026 analysis, went further: the AI Act's exclusion of personal, non-professional uses and its reliance on member-state law means it is likely to be "superseded by alternative frameworks that better address" cross-border AI risks, according to Elcano. Translation: the Brussels-as-standard-setter story oversells European leverage on AI specifically, while understating it on platform regulation.

What multinationals should actually do

The corporate playbook that lawyers at Eversheds Sutherland and Dentons are now selling comes down to five moves. First, treat August 2, 2026 as a real deadline for chatbot disclosures, deepfake labelling and generative content marking on any system launched from that date; the transparency obligations were not postponed. Second, use the delay window on high-risk classification to run Annex III inventories — hiring, credit, education, biometrics, critical infrastructure — because the substantive obligations return on December 2, 2027 unchanged in scope. Third, stand up Cyber Resilience Act incident response by September 11, 2026: manufacturers must notify ENISA of actively exploited vulnerabilities within 24 hours, per CSIS's tracking of the regulation. Fourth, treat DSA and DMA enforcement as the near-term risk — that is where the fines are landing. Fifth, watch the Digital Fitness Check, the Commission's second-stage review of cumulative digital-rules impact whose consultation closed March 11, 2026, per the Commission's digital-strategy site; it will decide whether GDPR, the Data Act and NIS2 face their own omnibuses.

For non-EU firms, the strategic question is whether to bifurcate. LinkedIn-style global platforms will comply universally because segmentation is expensive. Local-market AI vendors — a US HR-tech startup selling into Germany, a Chinese vision-model provider selling into France — will increasingly ship an "EU build" and a "rest-of-world build," accepting fragmentation as the cost of doing business. That is the quiet story of European digital sovereignty: not global standards, but a durable regional carve-out.

Diplomat View

The Digital Omnibus is not the story of Brussels backing down. It is the story of Brussels choosing which battles to fight. The Commission traded 16 months of AI-Act enforcement — on rules that could not have been complied with anyway, because the standards were late — for political room to keep pressing X, Meta, Apple and Google under the DSA and DMA. That trade will look smart if two things happen: CEN-CENELEC delivers usable harmonised standards before end-2026, and the Meta under-13s case produces a headline fine that hardens the DSA as precedent. It will look like capitulation if either fails.

Our forecast: the December 2, 2027 high-risk deadline holds, because the Council-approved text builds in hard backstop dates rather than open-ended linkage to standards. But expect a Digital Omnibus II on data and cybersecurity by mid-2027, targeting GDPR's consent architecture and NIS2's overlapping reporting duties — the areas industry lobbied hardest and privacy groups least effectively. The falsifier for this call is a Trump-Von der Leyen tariff deal that explicitly conditions US concessions on EU digital-law rollbacks; that would move the Commission from tactical delay to structural retreat.

What to watch:

• Mid-to-late July 2026: Publication of the Digital Omnibus on AI in the Official Journal of the EU; entry into force three days later, unlocking the amended timeline.
• August 2, 2026: AI Act transparency obligations become directly enforceable; first litigation over chatbot disclosure and deepfake labelling expected within 90 days.
• September 11, 2026: Cyber Resilience Act incident-reporting duties activate; the first 24-hour ENISA notifications will show whether manufacturers are actually ready.
• Q4 2026: Commission decision on the Meta under-13s DSA case — the single largest test yet of the 6%-of-global-turnover penalty structure.
• Early 2027: Digital Fitness Check conclusions; the trigger for a possible Digital Omnibus II covering GDPR and NIS2.