On 27 July 2026, the European Union quietly moved one of the most watched deadlines in European technology. The AI Omnibus entered into force that day and pushed back the rules for high-risk AI. Systems used in hiring, credit scoring, education and the other areas listed in Annex III of the AI Act now face those rules from 2 December 2027, sixteen months later than planned. AI built into physical products such as machinery, toys and lifts gets until 2 August 2028, a year later than planned. The same law widened access to regulatory sandboxes and lets the EU’s AI Office run a sandbox of its own.
It was the most popular calendar invite of the summer. Legal teams across Europe clicked “Accept” and went to lunch.
They can enjoy the lunch. They should not enjoy the next sixteen months the same way.
Two lazy takes and a better one
The first lazy take says Brussels lost its nerve, so park the whole file until 2027. The second says Europe has started deregulating, so brace for chaos. Both treat the delay as a story about Brussels, and both miss what it does for you.
Brussels was unusually candid about why it moved. The Omnibus itself says the standards, guidance and national authorities needed to apply the high-risk rules were not ready in time, and that keeping the original date would have raised costs without good reason. I made the same point in November 2025: you can’t enforce speed limits before you’ve built the roads and posted the signs. Eight months later, Brussels wrote much the same reasoning into law and moved the speed limits.
So here is the better take. The delay buys the one thing every transformation needs and no budget line covers: room to learn. Most companies will spend it waiting, and waiting is the only way to waste it.
Field Note: what breathing room bought one agency
Over two years I worked with a large, distributed digital agency in the iGaming sector to bring AI and automation into the business. It started small and practical. We built AI pipelines for the internal work that ate the most hours: automated SEO reports, automated audits of websites, technical setups and content, and then automated proposals generated straight from those audits. On the advertising side we built a pipeline that produced ad creatives, both copy and images, generated many variations of each, published them and tested them automatically. Think of it as a test kitchen that never closes, cooking many versions of a dish so the team can taste the few that work.
Alongside the experiments, we taught everyone. What AI is, how the tools work, how to operate them, and how to use them safely. A pipeline is only as safe as the person who feeds it, and the people feeding it were the whole company.
The biggest change happened in people’s heads. The obvious move, and the trap, is to automate exactly how you work today. You get the same process, faster, with the same blind spots baked in, and very little benefit. The value came from rethinking the process from scratch and only then supporting the new version with automation and AI. Over those two years the agency took processes apart across the organisation and rebuilt them.
Some things became automated processes. Some did not, because the value was unclear, and leaving those alone was a deliberate decision. The outcome: the same teams now do about five times as much work in the same time, and spend more of that time with clients. That last part matters most. The hours that used to go into reports now go into conversations with clients.
Here is my view, and it is an opinion. If a heavy rulebook had landed on top of that journey while it was underway, the journey would have been close to impossible, or much longer and far more timid. The room to experiment was essential. Today the agency is working out its regulatory impact at its own pace, from a position of understanding.
That is what breathing room is for.
You can’t put the kitchen through the dishwasher
Decompose before you automate.
The metaphor first. A dishwasher is a fine machine for plates. Nobody tries to put the whole kitchen through it. Yet that is what most automation projects attempt: they take an entire process, with its detours, workarounds and twenty-year-old habits, and feed it to a machine in one piece.
Now an everyday scene. Picture two companies that both want to speed up client onboarding. Company A hands its current onboarding process to an automation tool exactly as it runs today: the same forms, the same approval loops, the same email that waits three days for someone in finance. Six months later it has a faster mess. Company B starts by taking the process apart. It lists every step, marks which ones need human judgment and which are pure repetition, asks what a good onboarding actually looks like for the client, rebuilds the flow around that, and only then automates the repetitive parts. Same budget, same tools. The only difference is the order of operations, and the order of operations is the whole strategy.
The agency’s five-fold gain came from exactly this: rebuilding the work before automating it, and being honest enough to leave some steps manual.
This is the same discipline as the Business-First AI Assessment I use with clients: ask what it takes to do the job well, define what good looks like, find the parts that drive success, and only then ask where technology helps without losing what makes the work good.
Companies skip this step because they are watching the wrong clock.
The Three Clocks
Every company facing the AI Act now has three clocks on the wall, and they run at different speeds.
The law clock has moved. High-risk rules for Annex III uses now apply from 2 December 2027; for AI inside regulated products, from 2 August 2028. This is the clock everyone checks, because Brussels winds it and the press reports it.
The learning clock is yours. It runs only while someone in your company is experimenting, taking processes apart and writing down what they learn. Nobody else will wind it for you, and on the day the law clock rings, it decides whether you meet the rules from understanding or from panic.
The contract clock never paused. The multi-year agreements you sign this quarter with AI vendors, customers and partners will still be running in December 2027. Whatever they say about who provides what, who uses what, what data flows where and what gets logged will quietly become your compliance position. A clause signed for convenience in October can turn into an obligation in December 2027.
The law clock got all the headlines this summer. The contract clock sits in procurement, ticking politely. The learning clock is the one nobody is winding, and it’s the one a CEO should watch.
If you sell into Europe from somewhere else
The sixteen months belong to American and Asian companies too.
The AI Act reaches providers that place AI systems on the EU market wherever they are based, and providers and deployers outside the EU whenever the output of their system is used in the EU (Article 2). A US software company selling an AI hiring tool to a German retailer is in scope. So is the retailer.
The penalties are set in Article 99. Breaking the outright bans can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most failures to meet the high-risk obligations can cost up to €15 million or 3%. Those numbers now arrive later. They have not shrunk.
For a global company the delay works like a long runway at a foreign airport. Nice to have. Still has an end.
Breathing room is a European habit
Europe has used this design before, outside AI. Since 23 March 2023 the DLT Pilot Regime has let market infrastructures test blockchain-based trading and settlement with temporary exemptions from some of the usual financial rules, under supervision. On 21 September 2026 the Eurosystem launched Pontes, which settles wholesale trades in tokenised assets in central bank money, and operators authorised under that pilot regime are among those eligible to use it. Full implementation is expected by 2028.
Supervised room first, rulebook second, real infrastructure third. Next week’s Brief explains what Pontes is, and why your treasurer may mention it before your CTO does.
What the next sixteen months are for
Here are four unglamorous moves, in the order I would make them.
Start by picking two or three processes and taking them apart. For each one, write down the owner, the steps, the points where a human makes a judgment call, and the data it touches. Rebuild the process on paper before anyone buys a tool. If a step exists only because the old system needed it, delete it now and save yourself the cost of automating it later.
Next, run small experiments and keep a learning log. A few weeks per experiment, a clear question, a clear stop rule. Kill fast, and share what failed as loudly as what worked, because the failures are the cheapest lessons you will ever buy.
Then write down your role under the AI Act for each system you build or use: provider, deployer, importer or distributor. List anything that might fall under Annex III, such as recruitment, worker management or credit decisions. It is a short exercise, and it means the law clock will not surprise you.
Finally, put AI terms into every new multi-year contract: who is provider and who is deployer, what data goes where, what is logged and kept, and how you hear about model changes. The contract clock is already running, so make it work for you.
Brussels, Translated
Deployer: you, if your company uses an AI system in its work. The Act defines a deployer as anyone using an AI system under its authority outside personal, non-professional use. Many companies are deployers long before they ever become providers.
Annex III: the list that decides whether a use counts as high-risk. It covers areas such as recruitment and worker management, access to education, creditworthiness checks and life and health insurance pricing. If your HR team screens CVs with AI, that tool is on this list.
Regulatory sandbox: a supervised space to test AI with a regulator watching and helping. The Omnibus widened access to national sandboxes and lets the AI Office set up one at EU level.
Systems already in use: under the amended Article 111, high-risk systems placed on the market before the new dates come under the rules only if their design changes significantly afterwards; those used by public authorities must comply by 2 August 2030. Ask your counsel what “significant change” means for your roadmap before you redesign anything.
The blink
Brussels blinked. The companies that use the blink will be the ones ready when it opens its eyes.
One question for your next board meeting: “Which two processes will we take apart and rebuild before December 2027, and who owns the experiment?”
Tell me which process you would start with. I read every reply.
David
Sources
European Commission, “AI Omnibus enters into force”, 27 July 2026. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, 24 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
Regulation (EU) 2024/1689 (AI Act), Official Journal, 12 July 2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
Regulation (EU) 2022/858 (DLT Pilot Regime), Official Journal, 2 June 2022. https://eur-lex.europa.eu/eli/reg/2022/858/oj/eng
European Central Bank, “Eurosystem brings central bank money to tokenised finance”, 21 September 2026. https://www.ecb.europa.eu/press/pr/date/2026/html/ecb.pr260921~e754847a7b.en.html
European Central Bank, Pontes. https://www.ecb.europa.eu/paym/target/pontes/html/index.en.html
David Nagtzaam, “Europe’s AI Regulation Pivot”, 20 November 2025. https://davidnagtzaam.com/blog/europes-ai-regulation-pivot
The field note comes from my own client work and is anonymised. The two-company onboarding example is illustrative.