Proposed changes to the EU artificial intelligence act and what they mean for non EU companies

The European Commission has proposed targeted changes to the EU artificial intelligence act that extend compliance timelines, reduce some registration requirements, and expand flexibilities, with practical implications for non EU companies offering artificial intelligence services into the bloc.

The article explains how proposed changes to the EU artificial intelligence act could affect companies based outside the European Union, including those in the United Kingdom. The EU artificial intelligence act is designed to create a common regulatory and legal framework for the development and use of artificial intelligence in the EU. Non EU businesses can fall within scope where they provide artificial intelligence powered services or tools into the EU, for example where a website offers a chatbot function to users in member states and is therefore subject to transparency obligations. The latest changes form part of the European Commission’s Digital omnibus on artificial intelligence regulation proposal, which is framed as supporting a clear, simple and innovation friendly implementation of the regime.

A key update concerns timing for compliance, especially for high risk artificial intelligence systems. Under the current rules, the provisions on high risk artificial intelligence systems are due to apply from 2 August 2026. Under the draft, compliance will take effect 6-12 months after new standards are approved or support tools have been put in place, or by 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). This extended timeline is presented as removing the need for businesses to rush towards implementation. The proposal also reduces the registration requirement in the EU public database for some systems. If providers document that an artificial intelligence system is not high risk, they no longer need to register it, although they must still prepare and retain internal documentation to support that assessment for potential regulatory scrutiny, tightening the expectations around internal risk management.

The draft reform broadens the scope for controlled pre market real world testing for Annex I high risk artificial intelligence systems such as medical devices and radio equipment, giving companies more flexibility to run supervised live trials before full certification, subject to safeguards. Proportionality measures are expanded by extending small and medium sized enterprise style flexibilities to small mid cap enterprises, defined as an enterprise which employs fewer than 750 people and which has an annual turnover not exceeding EUR 150m or an annual balance sheet total not exceeding EUR 129m. This change is described as lowering potential fines and easing compliance for such firms, creating a more supportive environment for scaling artificial intelligence driven products and services in the EU. The proposal also adjusts the rules on bias detection, so that providers and deployers of all artificial intelligence systems and models, not just high risk ones, may process special category personal data for detecting and correcting bias, subject to safeguards, which is presented as enabling fairer and more reliable systems.

The article highlights that the highest tier of penalties under the EU artificial intelligence act allows for fines up to the higher of EUR35 million or 7% of global annual turnover. Against this backdrop, the law firm outlines how it can support affected businesses, including reviewing and drafting contracts and policies to ensure alignment with the proposed changes, conducting risk assessments to identify gaps in existing contractual arrangements, and providing regulatory updates so organisations remain informed about the evolving EU framework. Companies are encouraged to contact the firm to discuss practical options for preparing for the artificial intelligence act, particularly where they are developing, deploying or integrating high risk or data intensive artificial intelligence systems that could be in scope of the regulation.

50

Impact Score

UK and EU Artificial Intelligence regulatory outlook for May 2026

The UK is moving ahead with targeted Artificial Intelligence measures in policing, online safety, cyber security and copyright policy, while the EU is refining how the EU Artificial Intelligence Act will apply in practice. Consultations, new offences and implementation deadlines are shaping the next phase of compliance on both sides.

Germany sets out national implementation of the Artificial Intelligence Act

Germany has published a draft law to implement the European Artificial Intelligence Act through new supervisory structures, clearer institutional responsibilities, and measures designed to support innovation. The proposal puts the Federal Network Agency at the center of enforcement while preserving sector-specific oversight in sensitive fields.

ECB warns banks about new Artificial Intelligence security risks

The European Central Bank has called major banks to an emergency meeting over cybersecurity risks tied to advanced Artificial Intelligence models. Regulators want banks to speed up security updates as newer tools make it easier to find and exploit vulnerabilities.

Anthropic keeps Mythos restricted after vulnerability findings

Anthropic says its cybersecurity model Mythos is powerful at uncovering software flaws but remains too risky for broad release. Early testing found large numbers of vulnerabilities across major software and open source projects, while fixes have lagged far behind discoveries.

Contact Us

Got questions? Use the form to contact us.

Contact Form

Clicking next sends a verification code to your email. After verifying, you can enter your message.