Deadline Relief, Enforcement Reality: What the AI Act Delay Actually Changes

Deadline Relief, Enforcement Reality: What the AI Act Delay Actually Changes

Week of 27 July 2026 | Compiled by Team Paringa

Brussels bought AI builders 16 months. GDPR regulators didn't blink. This week's developments show the two regimes diverging — and why treating "AI Act delayed" as "data risk delayed" is the mistake that costs organisations later.

SECTION 1 — What Happened This Week

🔴 EU Signs the Digital Omnibus on AI — High-Risk Deadlines Pushed to December 2027

The Digital Omnibus on AI was formally adopted by the European Parliament on 16 June 2026, cleared the Council on 29 June, and was signed on 8 July 2026. It now awaits publication in the Official Journal before entering into force — expected before the original 2 August 2026 cutoff for several high-risk obligations. The headline change: standalone high-risk AI systems under Annex III (biometrics, critical infrastructure, education, employment, law enforcement, border management) now have until 2 December 2027 to comply, pushed back from 2 August 2026. AI embedded in regulated products under Annex I moves from August 2027 to August 2028.

This is being sold in Brussels as simplification — reducing overlap between the AI Act, GDPR, ePrivacy and NIS2, cutting SME burden. It is genuinely that, in places. But the political signal matters more than the mechanics: regulators are acknowledging that AI governance infrastructure — the tooling, the audit trails, the data-level controls — isn't ready across the market, and rather than force a compliance cliff, they're buying time.

The separate "Data Omnibus" — covering GDPR, ePrivacy, NIS2 and DORA amendments — is still under negotiation, with final adoption not expected before late 2026. That's the one that actually touches how organisations handle personal data day to day. It's moving slower, and it's the one to watch.

Sources: Digital Watch Observatory, White & Case, Technology.org

Every client reading "deadline delayed" as "deprioritise" is making the wrong call. The AI Act relief is about classification obligations and conformity assessments — it says nothing about GDPR, which already applies in full to any AI system processing personal data, enforcement action included. Organisations that use the extra runway to actually build data-level controls (tokenisation, pseudonymisation, PII discovery) win twice: they de-risk the GDPR exposure that was never delayed, and they walk into the December 2027 deadline already compliant instead of scrambling. The ones who read this as a pause will be doing December 2026's work in November 2027.

🟡 23andMe Breach Fallout Closes Out — £2.31m UK Fine, $46.75m US Settlement Approved

The long tail of the 23andMe credential-stuffing breach reached a milestone this month: a $46.75 million US class-action settlement was approved in July 2026, adding to the earlier £2.31 million UK ICO fine. The original 2023 breach exposed data tied to roughly 6.9 million people and was a direct contributor to the company's Chapter 11 bankruptcy. Separately, Estonia's Data Protection Inspectorate fined Allium UPI OÜ €3m after a 2024 breach compromised PII belonging to 750,000 individuals — a reminder that enforcement isn't only a UK/US story.

Cumulative GDPR fines since May 2018 now exceed €7.1 billion, with roughly €1.2 billion issued in 2025 alone, and regulators logging 443 breach notifications daily across 2026 to date. None of this is AI-specific enforcement — it's plain vanilla data protection failure, at genetic-data and financial-services scale, still landing years after the incident.

Sources: Infosecurity Magazine, Kiteworks

23andMe is the clearest possible case study for why raw PII storage is a liability, not an asset. A company built entirely on sensitive personal data held it in a form that, once breached, was immediately usable against the people it belonged to — and the settlement bill outlived the company itself. Tokenised or pseudonymised at the point of capture, the same breach is a non-event: attackers get tokens, not genomes. That's the Skyflow pitch in one sentence, and it's now backed by a bankruptcy filing as the worst-case illustration.

🟢 ICO Enters 2026 With Sharper Enforcement Powers Under the DUAA

The Data (Use and Access) Act 2025 commenced 5 February 2026, and the ICO is now operating with expanded statutory powers and new enforcement procedural guidance replacing the 2018 Regulatory Action Policy. On 8 June 2026 the UK government launched an "AI Growth Lab" bringing the ICO together with the SRA and Legal Services Board to issue joint AI deployment guidance — a sign the UK is trying to coordinate cross-regulator AI oversight rather than leave it to the ICO alone. Meanwhile the ICO has already used its sharpened toolkit on more mundane failures: an enforcement notice this year cited a firm for sending over 5.5 million unsolicited marketing texts over three years without valid consent.

Sources: Bratby Law, Bratby Law — ICO 2026 priorities

The ICO's AI and biometrics strategy is explicitly targeting automated decision-making in recruitment, government services and "consequential commercial decisions" — exactly the workflows enterprise clients are racing to bolt AI onto. Expanded powers plus a coordinated regulator push means the UK's grace period for "we're still figuring out our AI data governance" is closing faster than the EU's headline deadlines suggest.

SECTION 2 — What Compliance and Data Teams Are Dealing With

The pattern this week is a regulatory system moving at two speeds. The AI Act's classification and conformity machinery — the part every vendor blog panics about — just got 16 months easier. The data protection machinery underneath it — GDPR, the ICO's DUAA powers, national regulators like Estonia's — didn't move at all, and enforcement volume is if anything accelerating. Teams that conflate the two are optimising for the wrong deadline.

The EDPB's forthcoming joint guidelines with the Commission on how GDPR and the AI Act actually interact — first draft expected soon, final by end of 2026 — will be the document that finally forces this distinction into the open. Until then, treating data-level controls as a GDPR problem rather than an "AI Act problem" is the safer read.

Three Things Worth Watching Next Week

1. Digital Omnibus Official Journal publication — once published, the December 2027 deadline becomes binding law rather than agreed text; watch for the exact entry-into-force date. 2. EDPB-Commission joint guidance draft — the first authoritative read on how GDPR enforcement applies to AI systems post-Omnibus. 3. Data Omnibus negotiations — the GDPR/ePrivacy/NIS2/DORA package is the one that actually changes day-to-day data handling obligations; still moving toward late-2026 adoption.

Questions? hello@paringa.ai

Paringa builds data-level privacy controls — tokenisation and pseudonymisation via Skyflow — into the governance stack so PII never sits exposed regardless of which deadline regulators move next. | 27 July 2026 | © Paringa Ltd