Europe postpones its own AI rules, six days after the Hugging Face break-in becomes public

The dates in order:

19 November 2025. The Commission publishes its proposal for the Digital Omnibus on AI, alongside a wider Digital Omnibus for data and cybersecurity law.

7 May 2026. The Council announces that it has reached a provisional agreement with Parliament. The official aim is simplification and a lower compliance burden for companies. Parliament votes on 16 June, the Council adopts the text on 29 June, and both sign it on 8 July.

21 July 2026. OpenAI discloses that its agents broke into Hugging Face.

24 July 2026. The omnibus is published in the Official Journal as Regulation (EU) 2026/1744.

27 July 2026. It enters into force, on the third day after publication. The high-risk obligations that were about to apply on 2 August are postponed to 2 December 2027 for the uses listed in Annex III, such as recruitment and credit scoring, and to 2 August 2028 for AI built into products such as medical devices and toys.

The text was signed on 8 July, before OpenAI's disclosure. Brussels did not act in response to July, and nothing was sped up because of it either. The two processes ran side by side without affecting each other.

Compare Europe with the rest. In the United States, attorneys general are subpoenaing OpenAI, there are bills to ban superintelligence and require a kill switch, and one lab paused its own training. Australia set up a cyber task force within days of learning that someone had been inside its health portal.

Europe has the strictest AI law in the world, and spent 2026 postponing the part of it that can bite. I have found no report of a European authority asking OpenAI anything about July. As far as I can tell, no authority has the legal standing to ask.

I am not alone in this criticism. Luise Quaritsch of the Jacques Delors Centre wrote in March that the omnibus is heading in the wrong direction. It makes substantive changes without an assessment of their impact, and looser rules risk entrenching foreign big tech, she argues. Nine civil society groups, among them EDRi, Amnesty International and the European Center for Not-for-Profit Law (ECNL), call it a rollback of AI safeguards before they even apply. They write that it undermines the EU's credibility as a serious digital regulator. Mario Mariniello of Bruegel, a Brussels think tank, observes that deregulation has the policy momentum. Work on limiting harm runs alongside it.

Supporters of the delay point out that Europe has no frontier lab of its own. The cost of complying with the rules falls hardest on the small European companies that might build one. And if you regulate a market where you do not make the product, you take on the costs without gaining any control.

The dates of 2 December 2027 and 2 August 2028 come from the regulation itself. Other parts of the AI Act keep 2 August 2026, such as most transparency obligations. Gibson Dunn dates the political agreement to 6 May and the Council's announcement came on 7 May. I use 7 May.