EU AI Act high-risk deadline pushed to late 2027 — what the Digital Omnibus actually means for your business

If you run a UK business that touches AI — or sells into the EU — you may have seen a headline this month that read something like "EU delays the AI Act." Cue a small wave of relief, a little confusion, and a lot of people quietly wondering whether the deadline they'd circled in red has just vanished.

So let's clear it up, plainly. No jargon, no fear, no "the regulators are coming" energy. Here's exactly what moved, what didn't, and what a sensible business does next.

The short version

Through a package the European Commission has nicknamed the Digital Omnibus — a broad simplification effort that reached political agreement in May 2026 and is now awaiting publication in the Official Journal — the start date for the AI Act's high-risk obligations has been deferred.

In plain English: the rules for high-risk AI systems (the ones listed in Annex III) were due to bite on 2 August 2026. They've now been pushed back to roughly 2 December 2027.

One honest caveat before you act on this: the deferral is provisional. It's been agreed politically but is pending formal adoption and publication. Treat the new date as the working direction of travel, not a date you'd bet the company on just yet.

What's still happening in August 2026 vs. what got pushed

This is the bit most headlines blur. Two different things are going on, and only one of them moved.

Still arriving on 2 August 2026 — transparency duties (Article 50)

• Telling people they're dealing with AI. If a user is interacting with a chatbot or AI system, they need to know it's a machine, not a person.
• Labelling synthetic content. AI-generated or manipulated images, audio, and video (think deepfakes) need to be marked as such.
• This sits alongside the general-purpose AI (GPAI) obligations, which have already been live since August 2025.

Deferred to ~2 December 2027 — high-risk obligations (Annex III)

• The heavier lifting: risk management systems, data governance, technical documentation, logging, human oversight, accuracy and robustness, and conformity assessments for high-risk systems.
• Annex III covers uses such as AI in recruitment and HR, credit scoring, education, biometric identification, and access to essential services.
• If that's the category your AI falls into, this is the deadline that just gave you breathing room.

So the mental model is simple: transparency is still on for next summer; the high-risk machinery slipped to late 2027. Nothing was cancelled — the calendar was redrawn.

What this actually means for you

If you've been racing toward an August 2026 high-risk deadline, you can exhale. You've likely just gained around sixteen months. That's real, and it's genuinely useful.

But here's the part we'd gently underline: December 2027 is closer than it sounds. Building proper documentation, data governance, and human-oversight processes for a high-risk system isn't a two-week sprint — it's a programme of work that usually surfaces awkward questions about your data, your suppliers, and how decisions actually get made inside your product. The businesses that struggle aren't the ones who started early. They're the ones who treated a deferral as a cancellation.

And remember: if you deploy chatbots or generate synthetic media, the transparency rules still land in August 2026. That one didn't move at all.

The penalties — and which tier applies to what

It's worth being precise here, because the deferral changed the timing, not the teeth. The penalty tiers are unchanged:

• Up to €35 million or 7% of global annual turnover — for breaching the Article 5 prohibitions (the outright-banned uses, such as social scoring or certain manipulative systems). Whichever figure is higher.
• Up to €15 million or 3% of global annual turnover — for breaching the high-risk obligations under Annex III (Article 99(4)). This is the tier tied to the deadline that just moved.
• Up to €7.5 million or 1% of global annual turnover — for supplying incorrect, incomplete, or misleading information to authorities.

The takeaway: a later start date doesn't make the obligations softer when they do arrive. It buys you time to get them right — which, given the numbers above, is time well spent.

What a sensible business does next

You don't need to panic, and you don't need a compliance army. You need a clear, calm sequence. Here's the one we'd suggest:

• 1. Inventory your AI. List every AI system you build, buy, or embed. You can't classify what you haven't written down — and most teams are surprised by how long this list actually is.
• 2. Classify each one. Is it prohibited (rare), high-risk (Annex III), limited-risk (transparency duties), or minimal-risk? This single step tells you which deadline applies to which system.
• 3. Handle transparency now. For chatbots and synthetic content, get your AI disclosures and content labelling sorted ahead of August 2026. It's low-effort and it's not moving.
• 4. Start the high-risk groundwork. If anything lands in Annex III, begin documentation, data governance, and human-oversight design now — paced toward late 2027, not crammed into 2027.
• 5. Watch for formal adoption. Because the deferral is still provisional, keep an eye on the Official Journal publication so you're working from the confirmed date, not the agreed one.

This is the kind of structured readiness work our EU AI Act Readiness service was built for. As a founding-client business ourselves, we built the same AI Act Readiness Engine we use internally — AI inventory, Annex III classification, gap analysis, and the documentation trail you'll need — to turn that five-step list from a vague intention into a tracked, evidenced plan. The point isn't to scare you into buying something; it's to make sure the breathing room you just gained doesn't quietly evaporate.

The bottom line

The Digital Omnibus didn't repeal the AI Act. It re-sequenced it. Transparency duties still arrive in August 2026. High-risk obligations now point to around December 2027, pending formal adoption. The penalty tiers — €35M/7%, €15M/3%, €7.5M/1% — are exactly where they were.

If you'd like a calm, plain-English read on where your AI systems sit and what your real timeline looks like, we're happy to walk through it with no pressure and no jargon. Book a short readiness chat whenever it suits you — a clear map now is worth far more than a scramble in 2027.