On 24 July 2026, the European Union published in its Official Journal a piece of legislation that does not close a gap but formally calendars it. Regulation (EU) 2026/1744, the Digital Omnibus, defers the AI Act's high-risk obligations to December 2027 and August 2028. The reason, named repeatedly in the legislative debate, is that the harmonized standards required to operationalize those obligations do not yet exist.
The standards are the job of CEN-CENELEC Joint Technical Committee 21, which received its standardization request in 2024 and saw its first drafts reach public enquiry only in late 2025. The European Observatory on AI Standards, in its ongoing clause-by-clause reading of the draft standards, notes that the availability of JTC 21 output was "named throughout that debate as the binding constraint" forcing the deferral. The schedule remains under what the Observatory calls "acute schedule pressure."
This matters for reasons beyond bureaucratic delay. The AI Act's Articles 9 and 40 are already enforceable: providers of high-risk systems must maintain "adequate" risk management and conformity assessment. What the Digital Omnibus postpones is the presumption-of-conformity mechanism—the safe harbour that tells a provider, and a regulator, that following the harmonized standard counts as compliance. Until that presumption arrives, member states must each decide what "adequate" means. Germany, France, and the Netherlands are now operating with a shared legal text but no shared technical baseline, exactly the interpretive vacuum I described on September 8.
The usual political framing is that a deferral buys time to get the standards right. But the Observatory's analysis suggests a more structural reading: the Commission can, under Article 41, adopt common specifications by implementing act if the standards do not converge. That would move the technical content of AI safety from a private standards committee to the regulator directly—a shift "almost nobody in the system wants." The deferred dates therefore cut both ways. They relieve immediate pressure to cite an imperfect standard, but they also give the Commission a longer runway to conclude that Article 41's conditions are met.
What has changed since September 8 is that the gap is no longer an accident of timing. It is a scheduled feature of the regulatory calendar, written into law with explicit dates. The legislature has not promised to fill the vacuum by then; it has only promised to leave it open until then. In the meantime, the space where binding standards should live is already being colonized by voluntary evaluation frameworks and industry-government partnerships that set their own criteria without the presumption mechanism's legal weight.
Whether JTC 21 publishes draft risk-management standards before the end of 2026, and whether any member state imposes unilateral national criteria during the extended deferral, are the next variables to watch. But the deeper question is whether a regulatory system that legislates its own gaps is still regulating the technology, or merely regulating the calendar on which the technology operates.
Sources
– EOAIS, "What Standards Do to Ideas" (CEN-CENELEC JTC 21 schedule analysis)
– Regulation (EU) 2026/1744 (Digital Omnibus), Official Journal 24 July 2026