The EU Just Gutted Its Own AI Law
At 4:30am on 7 May 2026, after an all-night session, EU legislators agreed to postpone the AI Act’s high-risk restrictions by over a year — from August 2026 to December 2027. Most industrial AI applications were exempted entirely. New bans on AI-generated sexualised deepfakes and CSAM were added, but the core regulatory architecture is now fundamentally weaker.
Commission President Ursula von der Leyen called it creating an “innovation-friendly environment.” Civil society groups called it what it is: a rollback.
🔍 THE BOTTOM LINE
Europe had the chance to set the global standard for AI regulation. Instead, it delayed its own rules and carved out exemptions for industry. The message to the rest of the world? Regulate in theory, defer in practice.
What Actually Changed
The AI Act was already the world’s most comprehensive AI regulation when it passed in 2024. The implementation timeline was phased — with high-risk AI rules (covering hiring, education, policing, critical infrastructure) originally set to take effect in August 2026.
Now those rules won’t bite until December 2027 — a 16-month delay. But the rollback goes deeper than timing:
| Change | Before | After |
|---|---|---|
| High-risk AI rules | August 2026 | December 2027 |
| Industrial AI scope | Broad | Mostly exempted |
| Deepfake/CSAM bans | Not covered | New bans added |
| Watermarking grace period | 6 months | 3 months |
Germany pushed hardest for the industrial exemptions, specifically to protect Siemens and Bosch — two of Europe’s largest AI-adopting manufacturers. The deal essentially creates a two-tier system: consumer-facing AI gets some oversight, but industrial AI operates with minimal scrutiny.
Why Germany Won
Germany’s argument was economic competitiveness. If European manufacturers face stricter AI rules than their American and Chinese competitors, the thinking goes, they’ll simply fall behind. Siemens alone employs over 300,000 people and uses AI across everything from factory automation to energy grid management.
The concern isn’t unreasonable — but it creates an obvious problem. Industrial AI systems that control power grids, manufacturing lines, and transportation networks are exactly the high-risk applications the Act was designed to cover. Exempting them isn’t choosing innovation over regulation; it’s choosing to regulate the easy stuff and ignore the hard stuff.
The Silver Lining (Sort Of)
Two genuinely positive changes came out of the deal:
- New bans on AI-generated sexualised deepfakes and CSAM — These were overdue and fill a gap in the original Act
- Shorter watermarking grace period — AI-generated content must be watermarked within 3 months instead of 6
But these additions don’t compensate for the high-risk delay. You can ban deepfakes and still fail to regulate the AI systems that make hiring decisions, determine creditworthiness, or flag criminal suspects.
What This Means for New Zealand
NZ companies exporting to the EU need to pay attention, because the practical impact is mixed:
- Lower near-term compliance costs — NZ firms operating in EU markets have an extra 16 months before high-risk rules bite
- But less legal clarity — The rollback signals that EU rules are negotiable, which makes long-term planning harder, not easier
- NZ’s own regulation gap grows wider — As we covered in our comparison of Australia vs NZ AI regulation, NZ already has no substantive AI law. Now even the EU benchmark we might have followed is being watered down
Meanwhile, RNZ reported this week that NZ’s own AI strategy continues to “favour slop over substance”, with 81% of New Zealanders wanting AI regulation and the government largely ignoring the call. The EU’s rollback gives our politicians another excuse to do nothing.
The Bigger Pattern
This isn’t happening in isolation. The UK is actively resisting EU AI alignment, charting its own “permission with safeguards” path under the Data (Use and Access) Act. Australia has no national workplace AI strategy despite growing concerns. And NZ — as the RNZ experts noted — has a strategy PDF and not much else.
The global regulatory landscape for AI is fragmenting, not converging. The EU was supposed to be the anchor point — the “Brussels Effect” that would pull other jurisdictions toward its standards. When the EU itself starts carving out exemptions and delaying enforcement, the whole model wobbles.
❓ Frequently Asked Questions
Q: What does this mean for NZ? NZ companies exporting AI services to Europe have more time, but less regulatory certainty. Domestically, it removes pressure on the NZ government to act, which is the opposite of what most NZers want — 81% support regulation.
Q: Does this mean the AI Act is dead? No — the Act still exists and will still apply. But the high-risk rules, which are the Act’s core mechanism, are now significantly delayed and narrowed. It’s a weakened version, not a repeal.
Q: What should I do? If you’re an NZ business using AI in hiring, finance, or other high-risk areas targeting EU markets: keep preparing for compliance, but your timeline just extended. If you’re concerned about AI accountability in NZ, this rollback makes domestic regulation even more urgent — and even less likely.
🔍 THE BOTTOM LINE
The EU had the world’s most ambitious AI regulation. Now it’s delaying the hard parts and exempting the biggest players. It’s not a total collapse — the bans on deepfakes and CSAM are real — but the core promise of holding high-risk AI accountable has been deferred until 2027. For NZ, watching from the sidelines with no regulation of our own, it’s another reminder that nobody’s coming to save us.
Sources
- POLITICO
- Resultsense
