The EU AI Act's Quiet Reprieve, and Why Model Choice Is Now a Trust Decision
Brussels just bought enterprise teams twelve more months on a key AI obligation, even as Copilot Studio adds another foreign model to its roster. Trust is becoming a procurement checklist.
Two things happened this week that change how working teams should think about AI trust: the EU pushed back obligations for a swath of "assistive" AI systems by a year, and Microsoft folded Mistral Medium 3.5 into Copilot Studio with in-region data controls front and center. Read together, they signal that the trust conversation is shifting from abstract safety debates to concrete procurement questions — which model, hosted where, governed how.
What actually changed
The AI Omnibus package, summarized by Travers Smith on 27 May 2026, clarifies that AI components that merely assist users or optimize performance — without creating health or safety risks — fall outside the high-risk category. Obligations for those systems are delayed twelve months. That is a meaningful reprieve for the long tail of internal copilots, summarizers, and routing agents that teams have been quietly shipping while waiting for compliance clarity.
On the same beat, Microsoft announced on 28 May 2026 that Mistral Medium 3.5 is now selectable inside Copilot Studio, with the pitch leaning hard on in-region data control and multilingual performance. The interesting part is not the model — it is that Microsoft is openly positioning model choice as a governance feature, not just a performance one.
Why this matters for builders
For teams shipping agents, the practical effect is that "which model" is now a defensible audit answer rather than a taste preference. A European customer asking where their prompts get processed has a real answer if you picked Mistral in-region versus a US-hosted frontier model. The Omnibus delay buys time to get that selection right without rushing a compliance posture you cannot defend.
It also raises the bar for how teams train and tune. Practitioner resources like the LLM fine-tuning curriculum circulating this week walk through LoRA, DPO, and RLHF — the techniques that let you adapt a chosen base model without shipping your data to a third party. Pairing a regionally-hosted base with in-house preference tuning is becoming the default trust story for regulated buyers.
The risk is complacency. A twelve-month delay is not a repeal, and "assistive" is a narrower carve-out than vendor marketing will suggest. Teams that treat the Omnibus as permission to skip documentation will face a harder conversation in mid-2027.
The bottom line: Use the next twelve months to lock in model choice, hosting region, and tuning provenance as documented decisions — because by the time the delayed obligations bite, retrofitting that paper trail will cost more than building it now.