Europe Delays, America Argues: Where AI Rules Stand for Science

The calendar changed in Brussels, and the argument continues in Washington#

If you build or use AI in research, two sets of rules are shaping your next few years: the EU's AI Act and a patchwork of US federal orders and state laws. This autumn, both moved. In Europe, a new regulation pushed back the most demanding obligations. In the US, executive orders keep trying to set a national direction while states carry on legislating and a divided Congress prepares to take its seats.

The European change is the more concrete. Regulation (EU) 2026/1744, signed on 8 July 2026 and published in the Official Journal on 24 July, amends the AI Act as part of a "Digital Omnibus on AI" meant to simplify implementation (Regulation (EU) 2026/1744, EUR-Lex). It is the single most consequential AI-regulation development for the global scientific community in recent months, because its dates decide when compliance work becomes mandatory for anyone placing AI on the EU market.

This article explains what changed, what did not, how the US picture compares, and what researchers should do. A note on sourcing: we rely on the legal texts themselves wherever possible. For fast-moving US political questions, such as the effects of the November midterm elections, primary sources do not yet exist, so we cite a law-firm analysis and label it as such. None of this is legal advice.

Background: the terms you need#

The EU AI Act is a regulation that sorts AI systems by risk. It bans a short list of practices outright, imposes detailed duties on high-risk systems (such as those used in hiring, credit or critical infrastructure), and sets transparency rules for others. A harmonised standard is a technical specification that, once recognised, lets companies show they meet the legal requirements. Market surveillance authorities are the national bodies that police the rules.

An omnibus is a legislative package that amends several laws at once, usually to simplify them. Preemption is a US legal concept: when a federal law or valid federal action overrides conflicting state law. It is central to the American argument, because the question is whether Washington can displace the state AI laws now on the books. Frontier models are the most capable general-purpose AI systems.

One more term matters for scientists: placing on the market. The AI Act mostly regulates systems at the point where they are sold or put into service. As the Commission's AI Act service desk reproduces the text, the Regulation does not apply to any research, testing or development activity regarding AI systems or models prior to their being placed on the market or put into service, although such work must follow other applicable Union law (AI Act Service Desk, Article 2).

What the EU Digital Omnibus changed#

The headline change is timing. Article 113 of the AI Act is amended so that the high-risk requirements in Chapter III apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for systems classified under Article 6(1) and Annex I (Regulation (EU) 2026/1744, EUR-Lex). Annex III covers stand-alone uses such as employment or education decisions, while Annex I covers AI embedded in products that are already regulated, such as machinery or medical devices.

The earlier date for Annex III systems had been 2 August 2026, according to a professional summary of the regulation (EY, 2026). The same summary notes that postponing high-risk deadlines does not suspend obligations already in force, including the prohibited practices and the transparency requirements in Article 50 (EY, 2026).

The regulation entered into force on the third day after its publication, which EUR-Lex records as 27 July 2026 (Regulation (EU) 2026/1744, EUR-Lex). A delay is not a repeal. The risk-based structure remains, and the legal text keeps the same list of high-risk categories while moving the dates.

The deadlines that did not move#

Several obligations arrive sooner than the high-risk rules. The omnibus adds two new prohibitions to Article 5. One covers AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts or sexually explicit activities without the person's consent. The other covers systems that generate material of the kind described in the EU directive on child sexual abuse (Regulation (EU) 2026/1744, EUR-Lex). Those bans apply from 2 December 2026 (Regulation (EU) 2026/1744, EUR-Lex).

Transparency has a date too. Providers of AI systems, including general-purpose systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026 (Regulation (EU) 2026/1744, EUR-Lex). Article 50(2) concerns marking synthetic output so that it can be detected as machine-generated.

For research groups that release generative tools, such as image or text generators, this is the date to note. A lab that trains a model for internal work is outside the scope until it places the model on the market. A lab that publishes a model for others to use may be treated as placing it on the market, so the boundary deserves a careful legal read.

Other changes that touch research and start-ups#

The regulation rewrites the AI literacy duty in Article 4. Providers and deployers must take measures to support the AI literacy of staff and others who operate or use AI on their behalf, taking into account their knowledge, experience and the context of use, with the Commission and member states required to support the effort (Regulation (EU) 2026/1744, EUR-Lex). That shifts part of the burden from a flat company obligation to a supported, context-sensitive one.

It also creates a category of "small mid-cap enterprise", extending innovation measures, sandbox priority access, simplified technical documentation and a lower-of cap on fines to these firms alongside small and medium-sized enterprises (Regulation (EU) 2026/1744, EUR-Lex). Spin-outs and growing biotech companies may find this relevant.

Two further changes stand out for scientific work. A new Article 4a lets providers, and in some cases deployers, process special categories of personal data where strictly necessary to detect and correct bias, under specific safeguards (Regulation (EU) 2026/1744, EUR-Lex). That matters for health data and fairness audits. And the AI Office gains exclusive supervisory competence over certain systems, including those built on general-purpose models where the model and system share a provider, plus new investigation and fining powers (Regulation (EU) 2026/1744, EUR-Lex).

Is Europe ready to enforce?#

Enforcement depends on national authorities, and here the picture is uneven. Member states were required to designate market surveillance authorities by 2 August 2025, and the Commission states that if a member state fails to do so, it may launch a formal infringement procedure (European Commission, Digital Strategy). The Commission's page, last updated on 9 November 2026, still marks the national designation decision as pending final adoption for a number of member states (European Commission, Digital Strategy).

We could not find an official count of how many member states are late, and press reports differ, so we do not give a number. The practical point stands: the delay to the high-risk rules gives national regulators time, but the machinery is not yet complete everywhere.

The US picture, order by order#

American AI governance runs on three tracks: executive orders, state laws and a Congress that has not passed a comprehensive statute.

On the federal track, Executive Order 14365, signed on 11 December 2025, directs the Attorney General to set up an AI Litigation Task Force to challenge state AI laws considered inconsistent with federal policy (Executive Order 14365, Federal Register). It asks Commerce to evaluate existing state laws, and it ties certain broadband funding to states not having "onerous" AI laws, to the extent the law allows (Executive Order 14365, Federal Register). It also calls for a legislative recommendation that would preempt conflicting state laws while not proposing to preempt state rules on child safety, AI compute and data centre infrastructure, or state government use of AI (Executive Order 14365, Federal Register).

A second order, Executive Order 14409 of 2 June 2026, takes a different tack. It focuses on cybersecurity and sets up a voluntary framework in which developers can give the federal government access to covered frontier models for up to 30 days before release to other trusted partners (Executive Order 14409, White House). It states that nothing in it authorises mandatory licensing, preclearance or permitting for developing or releasing AI models (Executive Order 14409, White House).

On the state track, a legal summary notes that California's frontier AI transparency law took effect on 1 January 2026, and that Illinois and New York laws of similar kind take effect on 1 January 2027, requiring developers of the most advanced models to publish safety frameworks and report critical incidents (Jenner & Block, 2026). This is a law-firm summary rather than the statutes themselves.

On the congressional track, the same law-firm commentary argues that after the midterm elections Democrats will control both chambers when the new Congress convenes in January, which makes broad preemption considerably less likely (Jones Walker, 2026). That is analysis, not law, and the picture could shift.

Putting the two systems side by side#

What researchers and biotech teams should do now#

First, work out whether you "place on the market". Internal research is largely outside the AI Act, but publishing a tool for others, or selling a service built on a model, changes the analysis. The service desk text is clear about the pre-market boundary (AI Act Service Desk, Article 2).

Second, mark 2 December 2026. If you release generative models that were already on the market before 2 August 2026, Article 50(2) compliance is due then (Regulation (EU) 2026/1744, EUR-Lex).

Third, do not treat the 2027 date as a reason to stop. The high-risk requirements still apply from December 2027 for Annex III uses, and standards and documentation take time to prepare (Regulation (EU) 2026/1744, EUR-Lex).

Fourth, in the US, follow state law and keep an eye on federal developments rather than assuming one will override the other. An executive order cannot by itself repeal a state statute, as a legal commentary on a New Jersey chatbot bill notes, and Congress has not enacted preemption legislation (National Law Review, 2026).

Frequently asked questions#

Has the EU AI Act been cancelled or paused? No. Regulation (EU) 2026/1744 amends it and moves the high-risk application dates to 2 December 2027 and 2 August 2028, but the Act remains in force (Regulation (EU) 2026/1744, EUR-Lex).

What starts on 2 December 2026? New prohibitions on certain sexually explicit deepfake and child abuse material generators, and the Article 50(2) deadline for generative systems already on the market (Regulation (EU) 2026/1744, EUR-Lex).

Does the AI Act apply to my university research? Research, testing and development before an AI system or model is placed on the market or put into service falls outside the Regulation, though other EU law still applies (AI Act Service Desk, Article 2).

What is the new Article 4a? It allows processing of special categories of personal data where strictly necessary to detect and correct bias, subject to safeguards (Regulation (EU) 2026/1744, EUR-Lex).

Is there a US federal AI law? Not a comprehensive one. Federal policy runs through executive orders such as 14365 and 14409, and Congress has not passed preemption legislation (Executive Order 14365, Federal Register).

Does the US executive order override state AI laws? An executive order cannot itself repeal state law, and commentators note that Congress has not enacted preemption (National Law Review, 2026).

Must US developers submit frontier models for testing? Not under EO 14409, which creates a voluntary framework and states that it does not authorise mandatory licensing or preclearance (Executive Order 14409, White House).

References#

1. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI). Official Journal L, 24 July 2026. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
2. European Commission. AI Act Service Desk, Article 2: Scope. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2
3. European Commission. Market Surveillance Authorities under the AI Act (page updated 9 November 2026). https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act
4. Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence. Federal Register, 16 December 2025. https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence
5. Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security. The White House, 2 June 2026. https://www.whitehouse.gov/wp-content/uploads/2026/06/eo-14409.pdf
6. EY. Regulation (EU) 2026/1744 Digital Omnibus on AI (professional summary, secondary source), 6 November 2026. https://www.ey.com/en_gr/technical/tax/tax-alerts/regulation-eu-2026-1744-digital-omnibus-on-ai
7. Jenner & Block. Blue Wave Will Reshape State Tech and AI Regulation in 2027 (law-firm analysis, secondary source). https://www.jenner.com/en/news-insights/client-alerts/blue-wave-will-reshape-state-tech-and-ai-regulation-in-2027
8. Jones Walker. AI After the Midterms, or "What Divided Government Changes for Companies" (law-firm analysis, secondary source), November 2026. https://www.joneswalker.com/en/insights/blogs/ai-law-blog/ai-after-the-midterms-or-what-divided-government-changes-for-companies.html?id=102o8mx
9. National Law Review. New Jersey Bill Would Treat AI Chatbots as Products and Impose Strict Liability on Chatbot Providers (secondary source), 10 November 2026. https://natlawreview.com/article/new-jersey-bill-would-treat-ai-chatbots-products-and-impose-strict-liability