Posted on

EU AI Act: high-risk obligations deferred to December 2027 – what still applies now

Under the EU’s AI Omnibus package, finalised in mid-2026, the compliance deadline for high-risk AI systems has moved. Stand-alone high-risk systems now have until 2 December 2027, and high-risk AI embedded in regulated products until 2 August 2028. Both were previously set for 2 August 2026.

The package also removes some duplicative requirements for AI embedded in products already regulated elsewhere, and introduces relief for smaller mid-cap companies. Separately, providers of generative AI models must label artificially generated output by 2 December 2026.

Our take

A deferral is not a repeal, and we would be cautious about treating it as one. Three points for anyone with EU exposure:

  • The obligations did not get easier, only later. Risk management, data quality, transparency, human oversight and technical documentation are all still coming. For a system already in development, eighteen extra months is a planning benefit, not a reason to stop.
  • Other parts of the Act are already in force. The prohibited-practice rules and the general-purpose model provisions were never part of this deferral, and the labelling obligation for generative output has a 2026 date.
  • Classification takes longer than people expect. Working out which of your systems are high-risk, who you are in the supply chain – provider, deployer, importer or distributor – and what evidence you would need to produce is months of work in a large estate. It is also work you will need regardless, because UK and sector regulators are moving in a similar direction.

Our advice to clients has not changed with the date: build the AI inventory and the classification now, while there is time to do it properly, and treat the extension as headroom for quality rather than an excuse to defer the whole programme.

Sources