Commission proposes a digital omnibus that delays high-risk AI rules

Background

The European Union's rules for artificial intelligence were adopted in 2024. Under that act, the obligations attached to high-risk AI systems — the systems that carry the heaviest set of compliance duties under the law — were to start applying from 2 August 2026 or 2 August 2027 ^[2]. Those dates were written into the legislation, but the machinery needed to make them work was not yet in place. The Commission identified delays in designating national competent authorities and conformity assessment bodies, and a lack of harmonised standards, as the reasons for its proposal ^[2]. Without designated bodies and agreed standards, companies would have had to demonstrate compliance against benchmarks that did not yet exist.

What the Commission proposed

On 19 November 2025 the European Commission published a digital package that included a digital omnibus on AI ^[1]. An omnibus, in EU usage, is a single instrument that amends several laws at once rather than regulating from scratch; here the vehicle was used to adjust the AI rules together with other digital legislation.

The central change concerned timing. The Commission proposed linking the entry into application of the rules governing high-risk AI systems to the availability of support tools, including the necessary standards ^[1]. In practice, the obligations would no longer begin on a fixed calendar date regardless of whether the standards and guidance needed to comply were ready. The timeline for applying the high-risk rules was adjusted to a maximum of 16 months ^[1].

Key details

The proposal goes beyond the calendar. It provides for an EU-level AI regulatory sandbox from 2028 and for broader real-world testing ^[1]. A regulatory sandbox is a supervised setting in which developers can try out systems with the regulator involved, and real-world testing extends that idea to deployment outside a laboratory. The proposal would also reinforce the powers of the AI Office, the Commission's in-house AI unit, and centralise oversight of AI systems built on general-purpose AI models — models trained broadly and then adapted to many downstream uses ^[1].

On the administrative side, the Commission estimated that its simplification efforts would save up to €5 billion in administrative costs by 2029 ^[1]. Part of that comes from extending to small mid-cap companies the simplifications previously granted to small and medium-sized enterprises; that extension alone was expected to save at least €225 million per year ^[1].

Why it matters

For companies building high-risk AI systems, the proposal turns a fixed compliance date into a condition: obligations start when the supporting tools, including standards, are available, within a ceiling of 16 months ^[1]. For national authorities, the picture shifts in a different direction, since oversight of systems built on general-purpose AI models would be centralised and the AI Office's powers reinforced ^[1]. The Commission's simplification estimate of up to €5 billion by 2029, and the €225 million per year expected from extending SME treatment to small mid-caps, are the figures it attaches to the administrative side of the package ^[1].

The text is a Commission proposal, and the dates, powers and savings described above are what the Commission has put forward.