AI Act: the delay is not a pause

Since 27 July 2026, Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, has amended the AI Act. Its most discussed measure: obligations for high-risk AI systems, originally due on 2 August 2026, have been pushed back. Many executive teams took away a simple message: we have time. That is a risky reading.

What actually changes

• Stand-alone high-risk systems listed in Annex III (recruitment, credit scoring, education, access to public services, law enforcement…) now have until 2 December 2027.
• High-risk systems embedded in regulated products (Annex I: machinery, medical devices, toys…) move to 2 August 2028.
• High-risk systems already in service with public authorities keep the 2 August 2030 deadline.
• SMEs and small mid-caps get lighter technical documentation and quality-management requirements.

The Council gave its final green light on 29 June 2026, after the political agreement reached with the European Parliament on 7 May. The delay is justified by late harmonised standards and late national supervisory authorities.

What does not move, or comes sooner

The delay only covers high-risk systems. The rest of the timeline still applies:

• prohibited practices (Article 5) have applied since February 2025, and two new prohibitions take effect on 2 December 2026: systems that generate intimate or sexually explicit images of identifiable people without consent, and systems that generate child sexual abuse material;
• obligations for general-purpose AI models have applied since 2 August 2025;
• generative tools placed on the market before 2 August 2026 only have a grace period until 2 December 2026 for marking generated content;
• the European AI Office gains wider oversight of systems built on general-purpose models and embedded in very large online platforms and search engines.

Why “we have time” is a bad calculation

A high-risk system is prepared upstream: inventory, classification, data governance, documentation, logging, human oversight, testing. For an organisation starting from scratch, that is a programme of several quarters, not a last-minute compliance exercise.

Above all, the contracts you sign today will run beyond December 2027. CV screening, scoring or case-handling software bought this autumn will still be in production when the obligations apply. If the specification includes no documentation, no logs, no audit right and no reversibility, you will pay twice: once for the tool, once to bring it into compliance.

Finally, the AI Act does not stop at the EU’s borders. Institutions and companies in French-speaking Africa that buy from European vendors, or serve European clients, inherit these requirements through their contracts.

Five decisions to take before year-end

1. Inventory the AI systems in service and in the pipeline, and classify those that fall under Annex III.
2. Check for prohibited uses, including in the generative tools your teams use, before 2 December 2026.
3. Require content marking from your generative-tool vendors, with a committed date.
4. Rewrite the standard clauses of your tenders: technical documentation, logging, human oversight, audit right, reversibility.
5. Appoint an owner: one business owner per system, not just the IT department.

The delay gives time to the teams that start now. It takes time away from those who wait.

The question to ask on Monday morning

To your main vendor: “For each AI feature in your product, which AI Act classification do you apply, and which compliance deliverables will you hand over to us before December 2027?”