After the Ratchet: How the EU's AI Act Rollback Reverses the Brussels Effect

A weak signal in EU digital policy: the May 2026 AI Act Omnibus is read as a pragmatic compliance delay, but it is an early rollback of a flagship EU digital law and the seventh of ten standing "simplification" packages, signalling that the one-way Brussels Effect ratchet has reversed on a 2026-2028 horizon.

The consensus on the AI Act Omnibus is that Brussels has bought industry breathing room: standards slipped, deadlines moved, architecture intact. The non-obvious signal is that this is not a one-off delay but an early rollback of the bloc's flagship digital law, inside a standing programme of ten "simplification" Omnibus packages driven by the Draghi competitiveness agenda and US trade pressure. After two decades in which "build to Brussels" was the global ceiling, the ratchet has begun to run the other way; the strategic question is what stops it.

Signal Identification

This is a regulatory pivot. The one-way ratchet by which strict EU digital rules became the global default via extraterritorial reach and supply-chain conformity is being deliberately loosened on competitiveness grounds while still in its first implementation cycle. A doctrine shift, not a technical correction.

Time horizon: 2-5 years (AI Omnibus deal May 2026; postponed high-risk deadlines to December 2027 and August 2028; "digital fitness check" planned for Q1 2027; 25% admin-burden cut target by 2030) Plausibility band: Medium-High Geographic / Jurisdictional Scope: Primary: the EU-27 and the global firms that build to EU digital rules. Spillover: the United States, as the competitiveness and trade-pressure driver, and jurisdictions that previously mirrored EU rules. Sectors exposed: AI providers and deployers, machinery and industrial-equipment manufacturers, large cloud and platform operators, in-house compliance functions, standards bodies, data-protection regulators, civil-society and fundamental-rights bodies.

What's Changing

On 7 May 2026 the Council and Parliament reached a provisional deal on the AI Omnibus, part of the seventh simplification package (Council of the EU, 07/05/2026). High-risk AI obligations were postponed to 2 December 2027 and 2 August 2028, watermarking to 2 December 2026; "safety component" was narrowed, machinery carved out, SME exemptions extended to small mid-caps, and an EU ban on nudifier apps and AI-generated CSAM added. Parliament framed the deal as "maintaining its main provisions and risk-based approach" (European Parliament, 07/05/2026).

The standing mode is now simplification. The Jacques Delors Centre catalogues ten Omnibus packages launched in 2025 under the competitiveness agenda, a Q1 2027 "digital fitness check", and a 25% admin-burden cut by 2030, with the Digital and AI Omnibus advanced without impact assessments despite substantive rule changes (Jacques Delors Centre, 30/03/2026). Specialist analysis judges the postponement was driven by harmonised standards "widely deemed unworkable for industry", that core obligations "remain substantively unchanged", and that the AI Omnibus is "only a precursor" to a GDPR/Data Omnibus with deeper rights implications (Tech Policy Press, 08/05/2026).

The external driver is open. CEPA traces a "Washington Pull" in which US Commerce Secretary Lutnick tied steel and aluminium tariff relief to the EU softening DSA and DMA, with recent developments "suggesting the Brussels Effect is slowly disappearing" (CEPA, 03/12/2025). Practitioner readouts echo the framing: CCIA Europe and the Business Software Alliance call the deal short of meaningful simplification, while the TUV Association warns the machinery carve-out risks fragmentation and slower industrial-AI standards (Taylor Wessing, 08/05/2026).

Seven of ten Omnibus simplification packages now landed

EU "simplification" Omnibus programme to date (Jacques Delors Centre, 30/03/2026; AI Omnibus deal 07/05/2026).

Disruption Pathway

The pathway runs in three stages. First, doctrine shift: the Draghi competitiveness frame replaces "high standards travel" as the Commission's operating logic, formalised in the ten-Omnibus programme and 2030 burden-cut target (Jacques Delors Centre, 30/03/2026). Second, file-by-file rollback: the AI Act is the first flagship rolled back before its core obligations bind, with a GDPR/Data Omnibus next (Tech Policy Press, 08/05/2026) and DSA/DMA softening tabled under US tariff pressure (CEPA, 03/12/2025). Third, mirror-jurisdiction recalibration: regulators that copied EU drafts step back from "Brussels-plus" positions as the ceiling itself moves.

Stress concentrates at three points. Standards capacity: harmonised standards are the load-bearing layer the Act delegates to, and their non-delivery made the original deadlines untenable. Sectoral carve-outs: the machinery exclusion risks fragmentation and legal uncertainty rather than less bureaucracy (Taylor Wessing, 08/05/2026). Enforcement architecture: deleting the Article 49(2) registration obligation for self-declared non-high-risk systems, for a per-firm saving the Commission estimates at about EUR 100 risks "transforming the AI Act into a form of self-regulation", sixty civil-society groups warn (EDRi, 11/02/2026). Adaptations follow at two levels: regulatory (a moving Brussels baseline, Q1 2027 fitness check) and operational (firms built to a 2026 ceiling now hold compliance optionality, not a binding bar).

Why This Matters

For boards, general counsel, compliance leads and policy teams that built global digital playbooks on top of EU rules, the assumption to revise is that "build to Brussels equals the global ceiling". On the available evidence, the EU level is now itself a variable, set by a standing simplification programme and shaped by transatlantic trade leverage. Firms that hard-coded EU rules into global product, contracting and supplier-audit baselines should expect the bar to move down, not just slip; mirror jurisdictions will recalibrate as Brussels recalibrates. The next eighteen months, through the fitness check and the GDPR/Data Omnibus, will set how far the rollback runs.

Decision-action posture for this signal: Prepare. The direction is clear and the next packages are scheduled, but the depth of rollback on GDPR, DSA and DMA is unresolved; firms should re-baseline global compliance assumptions and scenario-plan now, and commit on the GDPR/Data Omnibus text.

Counter-Argument

The strongest objection is that this is a pragmatic delay, not a rollback. Parliament insists the deal maintains the Act's "main provisions and risk-based approach" (European Parliament, 07/05/2026), specialist analysis judges that core requirements "remain substantively unchanged" (Tech Policy Press, 08/05/2026), and the Omnibus simultaneously bans nudifier apps and AI-generated CSAM, hardly a deregulating move. The postponements respond to a real standards bottleneck industry could not meet.

Yet the trajectory is what matters. Seven of ten simplification packages have landed, a fitness check is scheduled for Q1 2027, GDPR is on deck, and the doctrine has shifted from rule-export to competitiveness defence under US trade leverage. Even if the AI Act's text survives this cycle largely intact, the standing programme around it has moved the ceiling, and the next files (GDPR, DSA, DMA) are where the rollback will be measured.

Implications

Taken together, the sources point to a durable reversal of the Brussels Effect's one-way logic, not a single-file delay. The inflection window is 2026-2028, defined by the GDPR/Data Omnibus, the fitness check, and how mirror jurisdictions react when the Brussels ceiling moves. Winners build flexible, jurisdiction-tiered compliance architectures and lobby on substance; losers stay over-built to a 2026 EU baseline the EU itself is dismantling. The frame for "EU as global digital regulator" is shifting from ratchet to negotiation (CEPA, 03/12/2025).

Early Indicators to Monitor

Publication of the draft GDPR/Data Omnibus text and the scope of consent, purpose-limitation and data-subject-rights changes.
Commission scoping paper for the Q1 2027 "digital fitness check" naming files in scope (DSA, DMA, ePrivacy).
A mirror jurisdiction (UK, Brazil, South Korea, Japan) explicitly rebenchmarking AI rules to the post-Omnibus EU level rather than the original AI Act.
EU-US trade communique linking further tariff relief to specified DSA or DMA enforcement softening.
Council of the EU adopting a further Omnibus package (eighth, ninth or tenth) on a digital file.

Disconfirming Signals

The harmonised AI Act standards are finalised in 2026 and the postponed high-risk obligations bind on or near the original 2026-2027 dates.
The GDPR/Data Omnibus is dropped or limited to genuine technical clean-up, with no rollback of substantive data-protection rights.
A mirror jurisdiction adopts "Brussels-plus" AI rules in 2026-2027, treating the EU level as a floor rather than a ceiling.
EU-US trade talks decouple digital-rulebook concessions from tariff relief.
The Commission's Q1 2027 fitness check concludes with no further simplification of DSA, DMA or AI Act core obligations.

Strategic Questions

Should global firms re-baseline compliance to the post-Omnibus EU rules now, or hold the 2026 ceiling as a hedge?
At what GDPR-rollback threshold does the Brussels Effect reversal cross from Prepare to Decide for the board?
Which mirror jurisdictions will set the new global ceiling if the EU steps back from rule-export?

Keywords

EU AI Act; AI Act Omnibus; Brussels Effect; Draghi report; simplification packages; Digital Omnibus; GDPR; DSA; DMA; harmonised standards; competitiveness; Washington Pull; digital sovereignty; regulatory rollback

Bibliography

Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.

Tier 1 Artificial Intelligence: Council and Parliament agree to simplify and streamline rules. Council of the EU (07/05/2026).
Tier 1 AI Act: deal on simplification measures, ban on "nudifier" apps. European Parliament (07/05/2026).
Tier 2 Is the Brussels Effect Fading? Center for European Policy Analysis (CEPA) (03/12/2025).
Tier 2 The EU's Digital Omnibus is heading in the wrong direction. Jacques Delors Centre (Hertie School) (30/03/2026).
Tier 3 What the EU AI Omnibus Deal Changes for the AI Act and What Lies Ahead. Tech Policy Press (08/05/2026).
Tier 3 The EU Digital Omnibus on AI: What the political deal means. Taylor Wessing (08/05/2026).
Tier 4 AI Omnibus: Reject the proposals to undermine transparency in the AI Act. European Digital Rights (EDRi) (11/02/2026).

Analyst inferences and editorial framing

Claim-fidelity self-disclosure. The framing that the AI Omnibus is an "early rollback" of a flagship EU digital law (not a pragmatic delay) and that the one-way Brussels Effect ratchet has "reversed" is analyst synthesis across the Council and Parliament releases, CEPA, the Jacques Delors Centre, and the Tech Policy Press and Taylor Wessing readouts. The "seventh of ten Omnibus" count, the Q1 2027 "digital fitness check", and the 25% admin-burden-cut by 2030 are faithful summaries from the Jacques Delors Centre policy brief (March 2026). The postponed deadlines (2 December 2027, 2 August 2028, 2 December 2026), the machinery carve-out, the SME / small mid-cap extension, the nudifier and AI-CSAM bans, and the "maintaining its main provisions and risk-based approach" verbatim are from the European Parliament press release (May 2026). The "remain substantively unchanged" and "only a precursor" verbatims, and the framing that harmonised-standards non-delivery drove the deal, are from Tech Policy Press (May 2026). The "Washington Pull" verbatim, the Lutnick steel and aluminium tariff linkage, and the "Brussels Effect is slowly disappearing" framing are from CEPA (December 2025), used as the single structural anchor in the 3-6 month band per house convention and cited unflagged. The CCIA Europe, Business Software Alliance and TUV Association positions are faithful summaries from Taylor Wessing (May 2026). The "transforming the AI Act into a form of self-regulation" verbatim, the Article 49(2) deletion, the sixty civil-society organisations figure and the EUR 100 per-company saving estimate are from EDRi (February 2026); EDRi is a Tier 4 advocacy source carrying treat_directionally, used only as corroboration alongside the Tier 1 deadline detail and Tier 2-3 framing sources, never as the sole anchor of a board-level claim. The "doctrine shift / file-by-file rollback / mirror-jurisdiction recalibration" three-stage pathway, the "moving Brussels baseline" framing, and the "ratchet to negotiation" closing image are analyst editorial framings labelled as such.