When frontier artificial intelligence models arrived late in Europe, or failed to arrive at all, the EU AI Act was the obvious suspect. Research published in June 2026 by the Centre for the Governance of AI went looking for it in the release data and did not find it. The study examined 375 large language model releases between June 2018 and May 2026. Measured against availability in the United States, 11 per cent were delayed or never made available in the European Union, and 7 per cent were delayed or never made available in the United Kingdom.
Of 68 recorded delays and non-releases, the researchers put regulatory factors as the primary cause in 56. They reported no strong evidence that the AI Act caused delays across the period studied, while noting that its enforcement could raise barriers later. The barrier they found most often was data protection law, and the recurring issue inside it was personal data used in training.
The instrument doing the work was the quiet one. The argument attached itself to a statute whose principal duties had not yet bitten, while rules long in force were deciding which products a European could open.
That misreading has a price, and it falls hardest on firms too small to carry two legal opinions. Take one invented here to carry the point: a software company of twenty-two people in Leeds, whose product sits inside employers' hiring systems and shortlists job applicants. It sells to British employers and to three in Germany. Nothing about it is unusual, and everything that follows applies to it twice, once under each regime.
On the British side the ground moved on 5 February 2026, when the core data protection reforms in the Data (Use and Access) Act 2025 came into force. Section 80 of that Act replaced Article 22 of the UK GDPR with four new articles. Article 22A sets the tests: a decision is significant if it produces a legal effect for the data subject or has a similarly significant effect, and it is based solely on automated processing if there is no meaningful human involvement in the taking of it. Shortlisting an applicant clears the first test without much argument. Whether the firm clears the second turns on what its customers' recruiters do with the ranked list, which is a question about the behaviour of other people, and one the firm's own code cannot settle. Article 22B restricts those decisions, stopping short of an outright prohibition, and keeps stricter limits where special category data is involved. Article 22C sets out what the controller must have in place: information about the decision, a route to make representations, human intervention on request, and a way to contest the outcome. Article 22D lets the Secretary of State move those definitions again by regulations. For the Leeds firm the effect is a door that was shut and is now open. Automated decisions on ordinary personal data can rest on legitimate interests, where the default before February was prohibition.
Sold to the Hamburg customer, the same code meets a different answer. Article 22 of the EU GDPR is unchanged and keeps the prohibition-by-default structure the United Kingdom has moved away from. The AI Omnibus, in force since 27 July 2026, left it alone. The legal basis the firm may now rely on at home is unavailable across the North Sea for identical processing, and a position that satisfies the British regulator satisfies nothing in Germany on its own.
What the European Union has added is transparency. Article 50 of the EU AI Act became applicable on 2 August 2026 and binds providers and deployers whatever the risk classification. The candidate-facing chat window the firm built has to tell applicants they are dealing with an AI system, unless that is obvious to them. The rejection letters its model drafts are synthetic text, and the outputs of a system generating such content must be marked in a machine-readable format and detectable as artificially generated. Breach carries fines of up to 15 million euro or 3 per cent of worldwide annual turnover, whichever is higher. For a company of twenty-two, the operative number in that pair is the 15 million. Systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty.
The deadline that made the news went the other way. Annex III of the AI Act lists as high-risk, at point 4(a), AI systems intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
That is the Leeds product described in the statute.
The AI Omnibus deferred those Annex III duties to 2 December 2027, and the embedded-product duties in Annex I to 2 August 2028. The coverage of that deferral is the coverage the firm read. Deferral is not exemption, and it moved nothing else. The December 2026 marking date stands. Article 22 stands. So do Articles 13 and 14, which already require the firm to say what personal data it collects, why, on what legal basis and for how long.
Scaled down to the size of a small business, that is the study's finding restated. The rule that decides what a firm may sell, and where, is seldom the rule with a name the trade press has learned. It tends to be older and quieter, already in force, filed under a subject nobody thought applied to them. The delay data had to be assembled and scored across eight years of releases before anyone could say which rulebook was doing the work, and a firm of twenty-two, reading the same headlines as everyone else, gains nothing by reading them harder.
ComplianceSME keeps a register of every EU and UK compliance deadline left in 2026 for that reason. Each date on it is checked against a primary source or two independent professional sources, and the list is reviewed monthly. The 2 December 2026 expiry of the AI Act marking grace for existing generative systems sits on it, dated and attributed, alongside the French e-invoicing mandate opening on 1 September. The quiet entries carry the same weight as the loud ones, because a register has no way of knowing which duty the coverage will pick up.
For the Leeds firm the useful move is to hold a dated list of what applies to it, know which instrument each date belongs to, and check each date against that instrument rather than against the reporting of it. The loud rulebook looks after its own publicity. The other one arrives on a Wednesday in December with a fine attached.