← All Insights

The EU Just Gave You More Time on AI Compliance. The Requirements Got Harder.

regulationenterprise-adoptionimplementation

The EU Parliament’s Digital Omnibus on AI amendments have pushed high-risk AI system deadlines back to 2027, and the Council has agreed its own position on streamlining the rules. If your compliance team just exhaled, tell them to breathe back in.

The delay is real. The complexity increase is bigger.

Two additions matter most for anyone deploying AI in a business context:

  • A proposed ban on AI-generated non-consensual sexual content. This was driven directly by the Grok scandal and represents a shift from “regulate outputs” to “criminalize specific generations.” If you’re running any image or video generation tools internally, your acceptable use policies need updating regardless of jurisdiction.

  • A European register listing every copyrighted work used to train AI models, with opt-out status. This is the one that should have enterprise AI teams paying attention. If this survives trilogue negotiations, it could determine which foundation models are even available in the EU market. A model trained on opted-out works without compliance could face market access restrictions.

The copyright register proposal matters because it shifts the compliance burden upstream. Today, if you deploy an AI tool in Europe, you worry about how you use it. Tomorrow, you may need to verify how it was trained. That’s a vendor due diligence problem most procurement teams aren’t equipped for yet.

The practical read for business professionals:

  • Don’t treat the 2027 deadline as a reason to wait. The organizations that use this window to build compliance infrastructure — documentation, risk assessments, vendor audits — will be ready. The ones that celebrate the reprieve will be scrambling in late 2027.
  • Start asking your AI vendors about training data provenance now. If the copyright register becomes law, “we don’t disclose training data” stops being a privacy stance and becomes a market access risk.
  • Watch the trilogue. Parliament and Council positions differ. The final text will be negotiated, and the copyright register is one of the most contested provisions.

Integration over capability: the question isn’t whether your AI tools are powerful enough. It’s whether they’ll still be legally deployable in your market eighteen months from now.

Are you building compliance infrastructure, or just running out the clock?