EU AI Act stand-alone high-risk obligations delayed to 2 December 2027

The original timetable put most high-risk duties into force on 2 August 2026. Annex I systems had a later start, 2 August 2027. The Omnibus splits the high-risk timetable in two.

Stand-alone systems listed in Annex III now face 2 December 2027, a postponement of 16 months. That list covers hiring, credit scoring, education and border control. For companies, the practical effect is 16 more months to prepare stand-alone systems and 12 more for embedded ones. RTÉ reported that workers, job applicants and borrowers face a longer wait for the human oversight and risk checks the act would have required. AI that is a product, or a safety component of a product, governed by EU product safety law sits in Annex I.

Medical devices, toys, lifts and radios fall there. Their deadline moves to 2 August 2028 from 2 August 2027, a 12-month delay.

The provisional agreement also narrows the definition of a safety component. An AI feature that merely assists a user or optimises performance, without creating health or safety risk, will not face high-risk obligations. The watermarking deadline also slipped, to 2 December 2026 from 2 August 2026, for providers whose generative systems were on the market before 2 August 2026.

The package took about eight months from proposal to entry into force. The European Commission published the Digital Omnibus on AI on 19 November 2025. Lawmakers reached a provisional deal on 7 May 2026, and the European Parliament voted to adopt it on 16 June 2026. The final text was published on 24 July 2026 as Regulation (EU) 2026/1744 and took effect three days later.

Why Brussels moved

The Commission's stated reason was sequencing. Technical standards and guidance explaining how to comply had fallen behind the deadlines they were meant to support.

Henna Virkkunen, the Commission's executive vice president, framed the change as an implementation adjustment. The aim was to "make it easier to innovate without lowering the bar on safety", she said. The Commission also tied the delay to its competitiveness agenda. It cited Mario Draghi's 2024 report, which argued that regulatory burden was holding back growth. The provisional deal shifted the AI literacy obligation toward support from the Commission and member states; Travers Smith said it remains unclear whether the Article 4 duty will be dropped or stay. The European Trade Union Confederation objected to the change, saying it weakened the requirement to ensure staff AI literacy.

The non-retroactivity gap

Article 111 sets the non-retroactivity rule. Systems placed on the market before the new deadlines do not have to comply unless they are significantly modified.

Systems used by public authorities get until 31 December 2030.

MEP Sergey Lagodinsky, a German Green, called that provision "a loophole" and "a weak spot" in the law. Laura Caroli, a former co-negotiator of the AI Act, gave a concrete case. A hiring system placed on the market before 2 December 2027 "may remain outside the AI Act indefinitely, unless it is substantially altered after that date", she said. Bram Vranken of Corporate Europe Observatory made a similar argument. "A large part of high-risk AI systems that have been placed on the market before December 2027 will never have to comply with the rules," he told Tech Policy Press. Lagodinsky warned that the timeline creates "an incentive to put things on the market before the Act enters into force". Vranken said some companies "might abuse this timeline and quickly push risky AI systems onto the market", saving compliance costs.

What still applies

The delay is not a pause on the whole act. Article 50 transparency duties have applied since 2 August 2026.

Chatbots must say they are AI, synthetic content must carry machine-readable marking, and emotion recognition systems must tell people they are being processed. Fines for breaching those duties reach 15 million euros or 3% of global annual turnover, whichever is higher. High-risk systems remain covered by GDPR and sector-specific rules while the AI Act's own high-risk chapter waits. Providers that rely on an Article 6(3) exemption still have to register the system in the EU database. The procedure is simplified.

The package also returned processing special category data for bias detection to a strict necessity test, reversing an earlier proposal for more flexibility. It extended lower penalty caps, previously reserved for SMEs, to small mid-cap companies.

What happens next

The next hard date is 2 December 2026.

That is when the watermarking obligation applies, and when a new ban applies to AI tools that create non-consensual intimate images and child sexual abuse material. After that the calendar runs to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Guidance is still arriving. The Commission published draft guidelines on classifying high-risk systems, including a 148-page document on Annex III. The guidelines are not exhaustive and may be updated.