The EU's AI Act Deadline Just Slipped by Two Years

For most of 2025, companies selling AI into the European Union were told to brace for August 2, 2026 — the date the EU AI Act's toughest rules, covering "high-risk" AI systems, would take effect. Then, quietly, that deadline moved. A Digital Omnibus package pushed the real compliance date for stand-alone high-risk systems out to December 2, 2027, with an even longer runway — August 2, 2028 — for AI embedded in regulated products like medical devices and machinery. The headline deadline everyone had been planning around effectively disappeared.

What actually changed, and why

The original AI Act, passed in 2024, set staggered deadlines: prohibited AI practices banned first, general-purpose AI model obligations next, and high-risk system requirements — the most demanding tier, covering things like biometric identification, hiring and credit-scoring AI, and law enforcement tools — due by August 2026. As that date approached, the EU concluded that neither the standardized technical guidance nor the registration infrastructure regulators needed was ready. Rather than enforce a deadline the compliance ecosystem couldn't actually support, the Digital Omnibus package extended it.

The part that didn't move

Not every deadline shifted. General transparency obligations — disclosing that content is AI-generated, labeling deepfakes, and related requirements — still take effect August 2, 2026, for new systems, with a shorter grace period (through December 2, 2026) for generative AI systems already on the market. A new prohibition specifically targeting AI-generated intimate content also takes effect in December 2026. Companies that assumed the entire Act had been pushed to 2027 are wrong about the part of it most likely to affect them first.

Companies that assumed the entire Act had been pushed to 2027 are wrong about the part of it most likely to affect them first.

What "grandfathering" actually protects

The Omnibus package includes a specific grandfathering clause: AI systems already placed on the EU market before the new deadlines won't retroactively need to meet high-risk requirements, unless they undergo a "substantial modification" afterward. That single clause is doing a lot of work for compliance teams — it means the practical question for many companies isn't "are we compliant by December 2027," it's "will our next model update count as a substantial modification that resets the clock."

What compliance actually requires, once the deadline arrives

None of the substance changed, only the timing. A provider of a high-risk AI system still has to complete a conformity assessment, register the system in the EU's AI Act database before market placement, prepare technical documentation covering the system's purpose and performance, and — for non-EU companies — appoint an authorized representative inside the EU who keeps records for ten years. The extension bought time to prepare for these obligations; it didn't remove any of them.

The honest read for U.S. companies

The practical advice from law firms tracking this closely hasn't changed much: assess now whether your AI system falls into a high-risk category (biometric ID, employment screening, credit or insurance decisions, and law enforcement tools are the clearest ones), and don't mistake the 2027 extension for permission to ignore the nearer transparency deadline still on the books for this year. The EU has shown it will move a deadline it isn't ready to enforce — it has not shown it will drop the requirement.