The EU delayed its high-risk AI rules to December 2027. The parts that didn't move already apply, and on 2 December 2026 more of them start to bite.
In July the EU pushed back the biggest deadline in the AI Act. A lot of executives read the headline, moved AI compliance into the 2027 column and got on with their year.
I think that's a mistake, and it's going to catch some people out on 2 December.
What actually moved
The Digital Omnibus came into force on 27 July. It delayed the obligations for high-risk AI systems. Standalone high-risk systems, which covers things like hiring tools, credit scoring, biometrics and access to essential services, moved from August 2026 to 2 December 2027. AI built into regulated products moved to 2 August 2028.
That's the part everyone heard.
What didn't move
The transparency rules started applying on 2 August this year, on schedule. If your customers are talking to a chatbot or an AI agent, they have to be told. If you're generating synthetic content, it has to be marked as AI-generated, and deepfakes have to be labelled.
And on 2 December 2026, two more things happen. The content-marking rules start applying to systems that were already on the market before August, so the grace period for older deployments ends. And a new prohibition comes into effect, on AI systems that generate non-consensual intimate imagery or child sexual abuse material.
The prohibited tier carries the largest fines in the Act: up to €35 million or 7% of global turnover. Most other breaches sit at up to €15 million or 3%.
The rules for general-purpose AI models have been running since August 2025 and weren't touched.
So the accurate version of the headline is this. The high-risk obligations moved, the biggest of them by 16 months. Almost everything else is either already live or goes live on 2 December.
Does this apply to you?
If you're a UK, US or Canadian business, you might assume not. Check before you assume. The Act follows the market, not the postcode. If you sell an AI system into the EU, or the output of your system is used there, you're in scope wherever your head office is.
For a lot of mid-sized firms in financial services, insurance and logistics, that's a yes.
Why the delay doesn't help as much as you'd think
The delay happened because the technical standards weren't ready. The core requirements for high-risk systems haven't changed. You've just got longer to meet them.
And the hard part of meeting them was never the paperwork. It's three things.
- Knowing what AI you actually have. Every system, every vendor tool with a model inside it, every agent somebody in operations switched on last quarter.
- Deciding which of those fall into a high-risk category.
- Being able to show, for each one, how it's overseen, what it decided and why.
None of that depends on a standard being finalised. All of it takes longer than people expect, because the inventory is never where anyone thinks it is.
A firm that starts that work now has an easy 2027. A firm that starts in autumn 2027 will be doing it in a panic, alongside every other firm that waited, competing for the same small pool of people who know how.
The commercial point
There's a reason to do this that has nothing to do with Brussels.
The work the Act asks for is an inventory, clear ownership, human checkpoints and a record of what each system did. That's the same work that gets an agent out of pilot and into production. Your own risk committee wants exactly what the regulator wants. They just ask for it sooner.
We build that record into every deployment: a record of every decision the system made and every person who approved one. Clients don't buy it because of the AI Act. They buy it because it's what gets their internal sign-off. The compliance position comes as a by-product.
So my advice is to stop treating December 2027 as the date. Treat 2 December 2026 as the date you check your transparency position (I've put a practical checklist for UK and North American firms on our site), and treat the next six months as the window to build your inventory while it's still calm.
I'd be interested to know how many people can say yes to this one: has your organisation actually listed every AI system it runs?
This is a business view, not legal advice.
Sources
- National Law Review (K&L Gates), Digital Omnibus enters force
- AI Act implementation timeline
- Praxikon, Regulation (EU) 2026/1744 and the new dates
- Gibson Dunn, Omnibus agreement
- Cloud Security Alliance, penalty tiers