EU AI Act high-risk rules delayed to December 2027 and August 2028

High-risk deadlines move

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is the first substantive amendment to the AI Act.

Stand-alone high-risk systems listed in Annex III moved from 2 August 2026 to 2 December 2027, a delay of sixteen months. The annex covers AI used in employment, education, credit assessment, law enforcement and critical infrastructure. Systems embedded in products covered by EU product safety law, among them medical devices, machinery and toys, moved to 2 August 2028.

What did not move

Rules for general-purpose AI models, including transparency, reporting and systemic risk obligations for the largest models, stayed on the original timetable. Transparency duties for AI interaction, deepfake labelling and notifications for emotion recognition and biometric categorisation applied from 2 August 2026.

The 2 December 2026 deadline

Two things happen on 2 December 2026. New prohibitions on systems built to generate or manipulate realistic intimate imagery or child sexual abuse material take effect. A four-month grace period also ends for certain machine-readable marking of generative AI systems already on the market before 2 August 2026.

The grace period covers only certain marking requirements, not the wider transparency duties. Providers of generative systems already in service must meet the Article 50(2) marking duty by then. Systems placed on the market after 2 August 2026 must comply from the start.

AI literacy stays, with softer wording

AI literacy was simplified, not dropped. Providers and deployers must still support staff AI literacy. The AI literacy provisions applied from 2 February 2025, according to the European Commission's AI Act timeline. RTE reported that the European Trade Union Confederation objected to the change, which replaced a requirement to ensure a sufficient level of AI literacy among staff with a duty to support its development.

Who enforces it

The European AI Office now has exclusive supervisory responsibility for certain AI systems built on general-purpose AI models and for AI systems integrated into very large online platforms and search engines regulated under the Digital Services Act. Its powers include investigations, demands for information, inspections, binding commitments and periodic penalty payments of up to 5% of average daily turnover for continuing infringements.

Why the Commission proposed the delay

Commission recitals cited delays in the harmonised technical standards providers need to show compliance, and slow setup of national authorities and conformity assessment bodies. DIGITALEUROPE put the cost of compliance at around EUR 3.3 billion a year across the EU. A company of about 50 employees could face EUR 320,000 to EUR 600,000 in initial costs, the trade group said.

The Commission tied the amendments to a wider push to cut administrative burdens. It followed the Draghi and Letta reports on European competitiveness. Industry associations lobbied for the changes through 2025. A coalition of 47 associations, including MedTech Europe, DigitalEurope and COCIR, backed the delay. The European Parliament pointed to unfinished technical standards.

What happens next

The next fixed date is 2 December 2026. Annex III high-risk obligations follow on 2 December 2027 and Annex I product-embedded obligations on 2 August 2028.

High-risk obligations do not apply to systems already on the market before the 2 December 2027 deadline. A Yahoo Finance analysis warned this creates a race to market and a split between legacy systems and post-deadline launches.