If you sell to European customers and you use AI to screen job applicants, check credit or run anything near health care, August 2, 2026 was supposed to be your deadline. It came and went, and the hardest part of the EU AI Act did not switch on. Europe rewrote its own timetable this summer. That is a reprieve, not a pardon, and some of the rules did start on time.
What happened
The change started as a proposal. On November 19, 2025, To Vima reported that the European Commission planned to delay the strictest "high risk" obligations to December 2027 as part of a "Digital Omnibus" package, after pushback from large tech companies. A Commission official told reporters that simplification is not deregulation. The same package also proposed changes to Europe's privacy rules that would make it easier for companies to use personal data to train AI.
Political agreement on the AI part followed on May 7, 2026, according to Winston Taylor. Law firm Lewis Silkin reports that the final text was published in the EU's Official Journal on July 24, 2026 and took effect on July 27. The new dates, per both firms:
- Stand-alone high-risk systems (the list that covers areas like hiring, exams, credit checks, essential services and biometrics) now face obligations from December 2, 2027 instead of August 2, 2026.
- AI built into regulated products such as medical devices moves to August 2, 2028. AI in machinery is taken out of the AI Act and handled under machinery rules instead.
- Machine-readable labeling of AI-generated content applies now for new systems, with systems already on the market before August 2, 2026 given until December 2, 2026.
- Other transparency duties, such as telling people they are talking to an AI, still applied from August 2, 2026.
- A new ban on AI tools that generate non-consensual intimate images or child sexual abuse material, which Lewis Silkin says Parliament added during negotiations.
Winston Taylor also notes smaller changes: the staff "AI literacy" duty is softened, support measures for small companies now extend to small mid-cap firms, and registration paperwork is simplified. Its overall verdict is that the package does not significantly change what companies must eventually do. It mostly buys time.
Why it matters for your business
The EU AI Act reaches past Europe. If your AI system is used on people in the EU, it can apply to you even if your company is in Missouri. This is not legal advice, but a few points are clear.
The heavy lifting moved, it did not disappear. If you use AI in hiring, lending or eligibility decisions that touch EU residents, you still need documentation, risk management, human oversight and logging. You now have until December 2027 to build it.
Transparency is already live. Chatbots that talk to EU customers should tell them they are dealing with AI. Generated images, audio and video need to be marked. These are cheap to do and easy to forget.
Your vendors carry much of this. Most of the high-risk obligations fall on the provider that builds the system. As a deployer, your job is to use it as instructed, keep people in the loop and keep records. Ask vendors now how they plan to meet the 2027 rules.
US rules are moving the same way. Colorado and other states are writing notice and human-review rules for automated decisions. A single program built to the EU standard will cover a lot of US ground too.
What we'd do
- Make a list of every AI tool you use that touches EU customers, staff or applicants. Mark the ones that help make decisions about people.
- Fix transparency this quarter. Add a clear AI notice to customer chat and turn on content labeling where your tools offer it.
- Ask vendors in writing how they will meet the December 2027 high-risk obligations and what they will need from you.
- Start a simple record for each decision-making tool: what it does, who oversees it and how a person can challenge a result.
- Put December 2027 on the calendar and work back from it. Eighteen months goes fast.
Our view
Critics see Brussels bending to industry pressure, and the reporting on the original proposal makes that hard to dismiss. The fair counterpoint is that companies were being asked to comply with rules whose detailed guidance was still unfinished, so the old deadline was shaky to begin with. We think the delay is sensible but dangerous for anyone who treats it as a reason to wait. The rules are now fixed in law with firm dates. Companies that use the extra time to build simple, honest controls will be fine. Companies that wait for a second delay are making a bet we would not make.
Want a system like this in your business?
A discovery conversation is where we map it: what to automate first, where the human checkpoints go, and what it would take.
Book a discovery conversation →