APREX · EST. 2026
Since its adoption, the EU AI Act has been a contentious piece of legislation. Now the European Commission is attempting to defuse criticism with a sweeping simplification exercise — but the process is sparking fresh debate about whose interests the regulation actually serves.
Digital Omnibus: What Has Changed?
The European Commission has launched what it calls the "Digital Omnibus" package — a set of amendments designed to reduce administrative burdens and give businesses more time to adapt. The single most significant change is that obligations for standalone high-risk AI systems have been pushed back from August 2026 to December 2027, according to the Digital Watch Observatory.
In addition, the European Commission is set to receive authority to resolve overlapping regulatory requirements — so-called "double regulation" — where companies integrating artificial intelligence into products such as medical devices or industrial machinery risk having to navigate two parallel regulatory frameworks simultaneously. Delegated acts on this point are expected by August 2027.
"Reopening the text now creates total uncertainty. It is utterly disrespectful to businesses." — Marianne Tordeux-Bitker, France Digitale
Industry Backlash: Too Costly and Too Complex
Reactions from the business community are mixed — but criticism dominates. More than 45 senior executives from major European companies, including Siemens and SAP, signed an open letter warning that the EU risks falling behind in the global AI race due to regulatory complexity. Siemens CEO Roland Busch reportedly described the law in its current form as "toxic for digital business models," according to the research material.
The price tag is concrete. An analysis by the Centre for European Policy Studies (CEPS) estimates that a single SME could spend between €216,000 and €319,000 on initial compliance costs alone for one high-risk AI system — with ongoing expenses on top of that. Industry association DIGITALEUROPE has calculated that the regulation could cost European companies in the region of €3.3 billion per year.
S&P Global Ratings points to a potentially unintended consequence of the simplification effort: if requirements are eased to help small businesses — which account for 99 percent of all European companies — the result could be that those very actors bring high-risk AI systems to market without adequate risk management procedures, simply because they lack the resources to implement them.
NGOs: Safety Guarantees Have Been Weakened
From the other side of the debate, the concerns are equally serious. Digital rights organisations, including The Future Society, argue that the simplification round — particularly the work on a code of conduct for general-purpose artificial intelligence — has erased key safety mechanisms.
Nick Moës, Executive Director of The Future Society, stated according to the research material that a weakened code of conduct leaves European citizens and businesses in a worse position, and fails to seize the opportunity to strengthen safety and accountability globally. The organisation further claims that American technology vendors influenced the final outcome through closed-door negotiating rounds.
Another point of criticism is the so-called "publish first, ask questions later" approach for large AI models, whereby risk evaluation reports are only shared after the model has been deployed in production. Critics argue this could allow potentially harmful systems to reach users before they have been adequately assessed.
What Does This Mean for Norway?
Norway is not an EU member, but through the EEA Agreement it is obliged to implement EU legislation within the scope of the internal market — and the AI Act falls within that scope. This means that Norwegian businesses developing or deploying artificial intelligence face, in practice, the same requirements as their European counterparts.
The postponement to December 2027 therefore also gives Norwegian companies a little more breathing room. But the fundamental uncertainty around interpretation, overlapping regulations, and compliance costs is the same on both sides of the Kattegat.
The debate over the EU AI Act mirrors a broader tension in European technology policy: how to build trust in AI systems without crushing innovation potential. The answer remains elusive, and with the Digital Omnibus, a process that appears to have just as many critics on the left as on the right of the political centre continues to unfold.