Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
"This deal follows a consistent pattern in EU technology regulation. The rules target the platforms and providers that are already visible and most likely to comply, while the actual threat operates outside their reach. Banning AI generated explicit content on commercial platforms does not eliminate the capability.
“Open source and uncensored models already run locally on consumer hardware with nothing resembling oversight. The result is predictable. The worst actors move off monitored platforms and into local generation where law enforcement has no visibility. The Internet Watch Foundation identified over 8,000 realistic AI generated CSAM images and videos in 2025, including a more than 260-fold increase in AI generated CSAM video, a problem driven primarily by tools already operating beyond regulatory reach. Restricting the platforms eliminates the oversight those platforms provided.
“The watermarking mandate illustrates the same technical disconnect. Provenance controls help honest platforms label synthetic content, but they are weak as an enforcement mechanism against adversarial use. Researchers at ETH Zürich demonstrated that current text watermarking schemes can be spoofed or scrubbed for under $50 with average success rates above 80%. Mandating a brittle control burdens legitimate operators while doing little to constrain malicious ones.
“The deeper structural problem is that the EU is layering the AI Act on top of GDPR without resolving the collision between the two. GDPR tells organizations to minimize what they collect and retain less. The AI Act pushes developers toward broad training data collection and extensive documentation requirements that pull in the opposite direction. Those goals can be reconciled in theory. In practice they create legal uncertainty and operational drag for the companies actually trying to build responsibly. The bad actors do not care. They do not file impact assessments or wait for regulatory guidance.
“The delay of high risk AI system deadlines to December 2027 for standalone systems and August 2028 for embedded systems makes the case on its own. Major European technology and industrial firms including ASML and Mistral AI pushed back publicly because the compliance model was unworkable. When the companies Europe needs to compete in AI say the rules are slowing them down and the regulator responds by delaying enforcement by more than a year, that is an admission the original framework was not aligned with the technology or the market it governs.
“The most dangerous actors will trivially circumvent policy enforcement. Compliant organizations absorb the cost. Effective AI governance requires incentive structures that make responsible development the path of least resistance. Right now, Europe is still making responsible development harder than irresponsible use."
John Carberry, Solution Sleuth, Xcape, Inc.:
“The 16-month delay for "high-risk" AI compliance in the EU is a pragmatic "reality check" for a regulatory framework that was fast outpacing industrial readiness. By moving the deadline to December 2027, EU lawmakers are acknowledging that critical infrastructure - from energy grids to law enforcement - cannot be retrofitted with AI safety standards overnight, especially while simultaneously navigating the NIS2 and CER directives.
“The most significant win for industry is the removal of overlapping compliance requirements for machinery. This prevents a "regulatory pile-on" where a single industrial system would have to answer to multiple, potentially conflicting safety audits. However, the core pillars of the AI Act - transparency through watermarking and strict bans on biometric manipulation - remain non-negotiable.
“For leadership, this delay isn’t a "get out of jail free" card; it is a vital window to conduct AI inventories and ensure that the "Shadow AI" currently creeping into operational technology (OT) is documented before the 2027 hammer falls.
“It’s a rare moment of clarity when Brussels realizes that making a smart turbine comply with two different sets of laws doesn’t make it twice as safe - it just makes it twice as expensive.”
