The EU AI Act Deadline Moved. Here's How to Use the Time
For most of the past year, August 2, 2026 was the date circled on AI governance calendars. It was when the EU AI Act’s obligations for high-risk AI systems listed in Annex III were due to begin. Those are systems used in areas such as employment, credit decisions, education and access to essential services.
That date has moved. The Digital Omnibus on AI, proposed by the European Commission last November, was published in the Official Journal this month and entered into force just days before the original deadline. It postpones the Annex III high-risk obligations to December 2027, with obligations for high-risk AI embedded in regulated products following later.
Not everything moved. Obligations for general-purpose AI model providers have applied since August 2025. Prohibited practices and the AI literacy expectations have applied since February 2025. Transparency obligations under Article 50, such as telling people when they’re interacting with an AI system, remain largely on their original schedule.
Don’t treat the delay as a pause
Organizations that were rushing to meet August 2 now have about sixteen months. It’s tempting to move the project down the priority list. That would waste the most useful part of the extension.
The high-risk obligations, including risk management systems, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity, assume an organization already knows which AI systems it uses, what they do and who is responsible for them. Many organizations don’t yet. Building that foundation takes time, and it’s valuable whether or not a given system turns out to be high-risk.
A practical plan for the extension
Now to end of 2026: know what you have
- Complete the AI system inventory. Include systems built in-house, AI features in purchased products and AI services used by business units. The inventory work described in Finding the AI Your Organization Already Uses is the starting point.
- Classify each system against the Act’s categories, with legal input. Document the reasoning, particularly for systems you conclude aren’t high-risk.
- Identify your role for each system. Obligations differ significantly for providers and deployers, and many organizations are both.
- Confirm Article 50 transparency obligations are met for systems that interact with people or generate content.
First half of 2027: build the controls
For systems likely to be high-risk:
- establish the risk management process and assign owners
- document data sources and data governance practices
- put human oversight arrangements in place and test them
- confirm logging is sufficient to reconstruct how decisions were reached
- address cybersecurity specifically, including resistance to manipulation of inputs and attempts to extract data or alter behavior
Second half of 2027: test and evidence
- run internal reviews against the obligations
- resolve gaps found
- organize evidence so it can be produced on request
Cybersecurity is the part security teams own
The Act requires high-risk AI systems to achieve an appropriate level of cybersecurity, including resilience against attempts to alter their use, outputs or performance by exploiting vulnerabilities. It names threats specific to AI, such as data poisoning, model manipulation and adversarial inputs.
Security teams should take ownership of this requirement early. It overlaps substantially with AI security practices that are worth adopting anyway: protecting training and retrieval data, controlling what external content reaches models, limiting what AI systems can access and do, and monitoring their behavior. The OWASP guidance for LLM and agentic applications and the NIST AI Risk Management Framework are useful references for structuring that work.
For organizations outside the EU
The Act applies to providers placing AI systems on the EU market and to deployers in the EU, along with some cases where AI outputs are used in the EU. Organizations without EU exposure aren’t directly affected. Many will still find the Act’s structure useful as a reference, and U.S. state laws on AI in consequential decisions, such as Colorado’s, follow similar ideas around inventory, impact assessment and oversight.
The real opportunity
Regulatory deadlines often drive work that should have happened anyway. This extension gives organizations time to do that work properly: an accurate inventory, clear ownership, sensible security controls and governance that reflects how AI is actually used. Organizations that use the time well will meet the new deadline comfortably. They’ll also be better placed to adopt AI with confidence, which is the point of governance in the first place.