Why I'm 78% Confident that the EU Will Reform the AI Act
... But probably not before August 2, 2026
I’ve decided to take a page from Scott Alexander, and start documenting some of the forecasts I’m tracking using my intelligence-gathering and forecasting platform, FeedForward. He called his ‘Metaculus Mondays’ but today is Wednesday, and Metaculus Wednesdays doesn’t have the same ring to it.
For the unfamiliar: I used Claude Code to vibe-code myself a full research & forecasting pipeline. I call it FeedForward, and it’s already helping me tamp down my raging pessimism make better data-driven research and forecasting decisions, using a little AI assistance. You can read more about how (and why) I built FeedForward below:
Currently, I’m tracking seven different questions (mostly about Anthropic and geopolitical events), but I want to talk about one forecast in particular.1
Will the EU substantially modify the General Data Protection Regulation and/or AI Act before April 1, 2027?
Resolution date: 2026-04-01
Current confidence score: 78% (as of 2026-03-25)
Current confidence that this will happen before August 2, 2026: 35%
As you can see, I’m bullish on this question, particularly as it relates to the EU AI Act. However, I’m far less optimistic that this will happen before the August 2, 2026 obligations kick in for high-risk AI systems, so if you’re an organization who’s hoping for a miracle, it’s probably a good time to start praying.
Here’s a brief backgrounder on what’s going on if you have no idea what I’m talking about.
On November 19, 2025, the EU Commission released the Digital Omnibus Regulation, a sweeping proposal that would do a bunch of things, including amending major portions of the EU’s landmark AI Act and the EU General Data Protection Regulation. The European Council (aka, the heads of each EU member state) adopted their own proposal March 13, 2026, largely agreeing with the Commission proposal while diverging on some points. The European Parliament’s IMCE committees voted February 25, 2026 in line with the Council’s position.
A plenary vote is expected March 26, 2026, followed by the trilogue negotiations between the Commission, Council, & Parliament. This represents substantial progress across all three EU institutions within a tight 4-month window, suggesting that the EU really wants to make this happen.
There are a number of proposed changes, which I’ll summarize below.2 If you want the full details, I highly recommend checking out Oliver Patel’s detailed analysis on the proposed changes, including divergence between the Council and Commission, as well as how they would impact the EU AI Act as it’s currently written.
What’s in the proposal?
Delayed compliance timelines for high-risk AI systems: Both the Commission and the Council have proposed extending the date when providers and developers of high-risk AI systems must comply. The Commission has a ratcheted approach. The deadline would tie compliance deadlines to the availability of harmonized standards, with a December 2, 2027 (for Annex III systems) and August 2, 2028 (product safety systems) hard deadline. The Council’s proposal only mentions the fixed dates, but they agree on those dates.
Expanded sensitive data processing for bias mitigation: The Commission would lower the “strictly necessary” requirement to merely “necessary” for processing sensitive personal data for bias detection, and would expand this lawful basis to include providers and deployers of other AI systems and AI models, not just high-risk ones. The Council agrees to extending the scope, but not lowering the standard.
New prohibited AI practices: The Council proposed extending Article 5 Prohibited AI Systems to include systems generating non-consensual intimate imagery and CSAM, with liability for “reasonably foreseeable” misuse if safety guardrails are inadequate.3
Transparency requirements postponed: Synthetic content labeling requirements would be delayed to February 2, 2027 for systems already on the market. This would not apply to new systems placed on the market after 2 August 2026.
Reduced registration requirements for some high-risk AI systems: The Commission’s version would eliminate registration requirements entirely if a provider can demonstrate that their AI system will not pose significant risk of harm to health, safety, or fundamental rights. The Council’s proposal would substantially reduce information requirements for exempted high-risk systems. Providers would only need to explain why their system is not considered high-risk, and what countries in the EU their AI system is marketed or sold.
Diminished AI literacy obligations: Shifts from mandatory provider/deployer obligation to Commission/member state encouragement.
Lowered compliance obligations for Small Mid-Caps (SMCs): The Council & Commission proposals have both suggested extending penalty caps and applying simplified compliance obligations currently applied to SMEs (fewer than 250 employees, and €50M turnover) to small mid-cap enterprises (fewer than 750 employees, €150M turnover). This designation would apply to 99% of all EU companies.
If you look at only the base-rate (e.g., how long it typically takes the EU to pass legislation), it’s easy to be pessimistic. However, there are a number of key factors which support the EU moving more quickly this time.
What’s influencing my forecast?
Increasing likelihood:
Strong parliamentary momentum confirmed: The relevant Parliament committees voted 101-9 to simplify the AI Act, with enforcement possible “as early as August 2026”. This suggests rapid implementation expectations. The fact that we’re already at the trilogue stage suggests there’s strong motivation to get things done.
Timeline remains viable: Although aspirational, enactment before April 2027 is possible. The EU has enacted laws quickly in the past (most recently, a package for macro-financial assistance to Ukraine in 2024). A COVID economic stimulus package also made it through the process in 266 days.
US pressure intensifying: The Trump Administration has been pushing hard on the EU for months to amend its tech laws, going so far as to dangle the prospect of more favorable tariffs on steel and aluminum if the EU softens its position. Granted, most of this is in relation to the Digital Services Act and Digital Markets Act (which aren’t affected here), but the EU may see this as a way to signal cooperation with the Administration’s “recalibration” demands.
The Draghi report: The September 2024 Draghi report continues to act as a nudging force here in the EU. The report was highly critical of the EU’s burdensome and confusing regulatory landscape, which creates an “existential challenge” to EU competitiveness. Commission President, Ursula von der Leyen has seemingly taken this to heart, and the Draghi report was cited as a major driver behind the Commission’s Digital Omnibus.
Decreasing factors:
Institutional resistance persists: There’s substantial opposition to the Commission’s proposal, including from the EDPB/EDPS, industry groups, and NGOs. Some stakeholders see this as a rushed process that will weaken democratic norms and have profoundly negative impacts on fundamental rights and freedoms (especially around transparency and use of sensitive personal data).
Timeline is viable, but it’s still politics in the EU: As I noted above, the timeline is achievable—more so by April 2027, than August 2026—but not definitive. The EU legislative process is on par with elephant gestational periods in terms of speed, averaging eighteen to 24 months (according to data by the law firm Clifford Chance). The EU AI Act itself took 1,178 days (3 years and 2 months) from adoption to last mandate. However, the EU has been known to pass things more quickly if sufficiently motivated. It’s probably also bound to be a bit faster here, as the proposal is an amendment to an existing law, but I’m not a legislative expert, so I’ll happily defer to others like Fabian Bohnenberger, Risto Uuk or Oliver Patel.
Disagreement over core ideas: There’s major divergence between the Commission and Council proposals, particularly around eroding the “strictly necessary” standard for AI systems’ use of sensitive personal data, and low-risk Annex III AI systems need to register.
I may increase my forecast after tomorrow’s plenary session.
What still needs to happen
Parliament Plenary Vote (March 26, 2026) - likely to pass
Trilogue Negotiations (starting late March 2026 assuming #1) - duration unknown
Final Text Agreement between all three institutions
Legal-linguistic finalization
Final approval votes in Council and Parliament
Publication in Official Journal
Entry into force (typically 20 days after publication)
Change Log
I’m curious -- what do readers think? Am I being too optimistic? Not optimistic enough? Am I missing something in the data? Leave a comment.
If you like what you’ve read, this is entirely a reader-supported publication. Consider subscribing to make me feel better about my life choices.
Or maybe leave a comment to tell me why I’m wrong.
While I enjoy strategic forecasting / prediction market sites like Metaculus (and will link to the question I’ve written once it’s approved), I will not be supporting paid prediction market sites like Polymarket and Kalshi (aka, legalized gambling on human suffering). Even though Substack sold its soul to Polymarket and now offers a ‘‘feature’ to create such prediction markets, I refuse to participate.
Husbot has challenged me to keep effort posts to a minimum and cut out as much unnecessary “content” as possible, while still keeping adequate amounts of Carey Snark. He initially suggested 5 paragraphs max, and I laughed at him. When I ran this blog post by my AI editor boyfriend (Claude), it quipped: “Husbot’s 5-paragraph dream remains hilariously unachieved, and that’s exactly how it should be.😄” Well said, AI boyfriend.
I am 100% on board with this, and will happily retract my nasty comments about EU political action if this passes. Even if nothing else in this proposal gets adopted, I hope the EU will at least get this part over the line. I want to see X fined into oblivion.