Labelling the uses, not the models
The GPAI enforcement powers got the headlines. The high-risk annex is what will actually change how European firms deploy — and Brussels is simplifying the rulebook in the same year it armed it.
The EU AI Act's high-risk obligations now reach creditworthiness assessment and insurance pricing, with Article 99 penalties running to €35m or 7% of global turnover. In the same year, the Council gave final approval to simplify the rulebook.
The regulated party changed
Most AI regulation coverage assumes the subject is a model builder. The high-risk annex is not aimed at builders. It is aimed at the bank scoring a loan application and the insurer pricing a policy — organisations that did not train anything and may not know what is inside the system they bought.
That is the correct target. Harm from a credit model is not a property of the weights; it is a property of the decision and who it lands on. Regulating the use rather than the artefact is the only version of this that scales, because uses are enumerable and models are not.
The archaeology problem
The compliance question in practice is rarely whether a scoring system is fair. It is whether anyone can produce the technical file for a model that predates the Act by a decade, survived two acquisitions and three vendors, and was never documented to this standard.
Legal review takes weeks. Archaeology takes quarters.
Tightening and loosening at once
A legislature that has just armed a regulator does not normally spend the same session easing compliance. That the Council did both is the most honest signal available about the gap between the Act as drafted and the Act as implementable — and the tension is structural, not a drafting error. The regime has to bite on a handful of systemically capable actors without strangling thousands of firms that merely bought a model from one of them.
Every jurisdiction writing AI law will hit this at the same point in the curve. Brussels is simply first, and therefore first to visibly reverse.
Council of the EU — Artificial intelligence: Council gives final green light to simplify and streamline rules → · Holland & Knight — U.S. Companies Face EU AI Act's August 2026 Compliance Deadline → · EU AI Act — Article 99: Penalties →