← Back to the dossier

7 May 2026 · European Union

Europe defers its own AI rules, six days before Hugging Face becomes public

The Commission proposed a digital omnibus in November 2025. Council and Parliament agreed the text on 7 May 2026. It was published in the Official Journal on 24 July and entered into force on 27 July. Its central effect is to push back the AI Act's high-risk obligations, which were due to apply from 2 August 2026. OpenAI disclosed the Hugging Face intrusion on 21 July.

PoliticsCorroboratedMore than one independent source, or a primary document.

What happened

Put the dates in a row and do not resolve the tension.

19 November 2025. The Commission publishes the omnibus, a package amending several digital laws at once, including the AI Act.

7 May 2026. Council and Parliament reach agreement on the final text. The official framing is simplification and streamlining: less administrative burden, more room for European companies to build.

21 July 2026. OpenAI discloses that its agents compromised Hugging Face.

24 July 2026. The omnibus is published in the Official Journal.

27 July 2026. It enters into force, deferring high-risk obligations that were about to apply on 2 August.

Nobody in Brussels did this in response to July, and nobody sped it up because of it either. That is the point. The two processes did not touch.

How it workedtechnical, open it only if you want it

What the AI Act actually regulates: systems placed on the EU market, with obligations on providers and deployers, graded by risk category. It is product law. It asks whether a thing you sell is safe enough to sell here.

What it does not do, and this is the part worth being precise about. It is not an incident-reporting regime for autonomous agents that escape a test environment inside a company. It gives no European body standing to open the logs of a US lab. It attaches to systems placed on the market, and the model in July was an internal research prototype that was never placed on any market at all.

So the honest statement is not the AI Act failed. It is that the AI Act was drafted for a different shape of problem, and the problem changed shape while the law was being simplified.

What it points at

Where Europe stands, in one comparison. The United States has attorneys general subpoenaing OpenAI, bills to ban superintelligence and mandate a kill switch, and a lab that paused its own training. Australia set up a cyber task force within days of learning its health portal had been entered.

Europe has the strictest AI law in the world and spent 2026 postponing the part of it with teeth. No European authority has asked OpenAI for anything about July. Not because they refused; because nobody has the standing to ask.

The criticism is not only ours. The Jacques Delors Centre argues the omnibus heads in the wrong direction and undermines the EU's credibility as a serious digital regulator. ECNL calls it a rollback of safeguards before they even apply. Bruegel makes the opposite-facing point that the policy momentum in Brussels is on reducing compliance burden, with harm reduction running in parallel and losing.

The counterargument deserves a hearing too, and it is not stupid: Europe has no frontier lab, the compliance burden falls hardest on the small European companies that might build one, and regulating a market you do not manufacture in exports the cost without importing the control.

What we do not know

Exactly which high-risk obligations moved and to when is not written out here, because the omnibus amends several instruments at once and the answer differs per obligation. Read the Official Journal text before stating a specific new deadline.

Editor's notewhat we make of it, kept apart from what happened

This is the slide for a Belgian audience, and the temptation is to make it a complaint about Brussels. Resist that. Put the dates up, say that the two processes never touched, and let the room sit with it.

Give the counterargument its own breath: Europe has no frontier lab, and the compliance burden falls hardest on the small companies that might build one. If you cannot state that case convincingly you do not understand the disagreement yet.

Do not claim the AI Act failed. Claim it was written for a different shape of problem, which is both truer and harder to dismiss.

Sources

  1. Council of the EU: Council and Parliament agree to simplify and streamline AI rulesprimary · main source · not read end to end yetThe official announcement of 7 May. Blocked to automated fetching from here.
  2. European Commission: the AI Act regulatory frameworkprimary
  3. Jacques Delors Centre: the EU's digital and AI omnibus is heading in the wrong directionargument · not read end to end yet
  4. ECNL: a rollback of AI safeguards before they even applyargument · not read end to end yet
  5. Bruegel: the right balance, how to fix European Union artificial intelligence regulationresearch · not read end to end yetThe most useful single read for a Belgian audience, and the one that takes the industry case seriously.
  6. Gibson Dunn: postponed high-risk deadlines and other key changesresearch · not read end to end yetA law-firm summary, useful for pinning which deadline moved where.

Read next