DEV Community

Ganesh Sivakumar
Ganesh Sivakumar

Posted on

The EU just delayed the AI Act's hardest part. That's not a reprieve.

#ai #leadership

If your AI compliance roadmap has a red circle around "2 August 2026: high-risk obligations apply," it is out of date. Under the Digital Omnibus on AI, which amended the EU AI Act with effect from 27 July 2026, the heavy high-risk obligations for Annex III systems - the AI used in hiring, credit, education and similar sensitive calls - now apply from 2 December 2027, not August 2026. High-risk AI embedded in regulated products (Annex I) moved with them, to 2 August 2028. That is a sixteen-month postponement of the hardest part of the law, and it is quietly rendering most English-language summaries of the AI Act timeline wrong.

This is all verifiable at the source. The Commission's AI Act Service Desk publishes the consolidated Article 113 text with the amendments marked, plus an official implementation timeline. Both are worth bookmarking, because they are now the only version of the calendar that counts.

What actually applies today

The delay is surgical, not general. Reading the official timeline, a large share of the AI Act is already live:

  • Since 2 February 2025: the general provisions - definitions and the Article 4 AI literacy obligation - plus the first prohibited practices.
  • Since 2 August 2025: the rules for general-purpose AI models, the governance structure, and the penalties framework.
  • Since 2 August 2026: the transparency obligations of Article 50 (including labeling of synthetic content), the innovation-support measures, and - critically - the start of enforcement at national and EU level for GPAI models, prohibitions, transparency rules and AI literacy.

And one date lands before the postponed high-risk wave: 2 December 2026, a month from now, when new prohibitions take effect for AI systems generating non-consensual sexual deepfakes and child sexual abuse material, alongside the transitional deadline for providers of synthetic-content systems already on the market before August 2026 to comply with Article 50(2).

Why Brussels blinked

The Commission's own FAQ is candid about the motivation: stakeholder consultations through 2025 "revealed implementation challenges" in rolling out the Act, and the Digital Omnibus is framed as a simplification measure to make compliance workable - part of a broader competitiveness push. Reading between the lines, the standards, guidance and national machinery needed to enforce Annex III were not going to be ready in time, and industry was not either.

My read

Deadline relief is not risk relief. Three things did not move with the dates. First, enforcement is already running for everything except high-risk systems, and the December 2026 deepfake prohibitions are weeks away. Second, the harms Annex III targets - a discriminatory hiring screen, a biased credit decision - are not legal until December 2027; they are enforceable reputational and legal problems right now under existing discrimination, consumer-protection and data-protection law, and no board should treat the Omnibus as permission to ship them. Third, the amendment itself is the lesson: this law will keep changing. The companies that memorized the 2024 timeline built compliance programs around dates that no longer exist. The durable capability is not a deadline on a slide; it is an inventory of your AI systems, a named owner for each, and a standing habit of checking the consolidated text rather than the conference talk. Sixteen extra months is enough time to build that muscle slowly and cheaply. It is also exactly enough time to waste and end up crash-buying consultants in the autumn of 2027. The Omnibus bet is that most companies will do the second. It is worth deciding, explicitly, to be the counterexample.

Sources

Top comments (0)