The Deadline
The date to put on your calendar: 2 December 2027
The EU AI Act's high-risk obligations were pushed back, not cancelled. That gives organisations a real window to prepare, which is a reason to start now, not a reason to wait.
The short answer
2 December 2027 is when the EU AI Act's stand-alone high-risk obligations (Annex III) now apply, after the Digital Omnibus deferred them from the original 2 August 2026 date; high-risk AI embedded in regulated products (Annex I) follows on 2 August 2028. The deferral is a build window, not a reprieve: the proof, audit and record-keeping requirements survive the move intact. Organisations that treat the new date as permission to wait will be doing the same scramble in 2027 that the original deadline would have forced in 2026.
Most organisations heard that the EU AI Act's high-risk deadline moved and did the natural thing: exhaled, and put the topic back on the shelf. That is the wrong read of what happened, and it is worth being precise about the actual dates, because the precision is the point.
What actually changed
The original deadline for high-risk AI obligations under the EU AI Act was 2 August 2026. The Digital Omnibus on AI deferred it. The corrected, current timeline:
- Stand-alone Annex III high-risk obligations: deferred to 2 December 2027.
- High-risk AI embedded in regulated products (Annex I): deferred to 2 August 2028.
- Article 50 transparency obligations largely stay on the original schedule. These were not part of the deferral.
The process behind the change is on the public record: provisional political agreement on 7 May 2026, European Parliament endorsement on 16 June 2026, and the Council's final green light on 29 June 2026, taking legal effect on publication in the Official Journal.
A deferral is not a cancellation
This is the distinction that gets lost. The obligations that were due on 2 August 2026, the logging, the traceability, the ability to reconstruct what a system did, are the same obligations now due on 2 December 2027. Nothing about what has to be built has changed. What changed is how much runway there is to build it properly instead of under deadline panic.
The deferral is a build window, not a reprieve. The proof requirements survive the move intact.
Why "later" is the wrong response to more time
Extra time is only valuable if something is done with it. An organisation that treats the new date the way it treated the old one, as a problem for eighteen months from now, will find itself in exactly the same scramble in October 2027 that it would have faced in June 2026, just later and with less excuse. The deferral was a gift to organisations that use it; it is neutral, or worse, for organisations that don't.
What working backward from 2 December 2027 looks like
- Put the date on the calendar now, not as a compliance reminder but as a project deadline with a start date behind it.
- Establish what "traceable" and "auditable" actually mean for your systems before a regulator's definition is the one you are scrambling to meet.
- Build the record-keeping capability into how the system runs day to day, not as a report generated after the fact.
- Treat any AI system now being adopted or renewed as if the 2027 requirement already applies, since whatever is deployed in the next year will likely still be running when the deadline lands.
For a longer look at the cost of leaving this kind of decision until it is forced, see our companion piece on why "we'll deal with it later" is the most expensive plan. And for the more general timing question of when to move off cloud AI onto infrastructure your organisation controls, an architecture that is built with exactly this kind of provable audit trail in mind, such as the one British company Mickai is building, is worth starting that conversation with well before the date is close enough to force it.
Frequently asked
- Did the EU AI Act deadline get cancelled?
- No, it moved. The Digital Omnibus deferred the stand-alone high-risk obligations under Annex III from 2 August 2026 to 2 December 2027, following provisional political agreement on 7 May 2026, European Parliament endorsement on 16 June 2026, and Council's final green light on 29 June 2026. High-risk AI embedded in regulated products under Annex I was separately deferred to 2 August 2028. Article 50 transparency obligations largely stay on their original schedule.
- Does the deferral mean organisations can deprioritise compliance work?
- That is the trap. The deferral changes the date, not the substance: the logging, traceability and audit requirements that were due in 2026 are the same requirements due in 2027. An extra window to prepare is only valuable if it is used to prepare. Treated as a reason to set the topic aside, it produces the same last-minute scramble the original deadline would have forced, just delayed by sixteen months.
- What should an organisation actually do with this window?
- Use it to build rather than wait. The obligations reward being able to show how a system behaved, which is far easier to build into a system from the start than to retrofit under deadline pressure. Put 2 December 2027 on the calendar now, work backward from it, and treat the intervening time as the schedule for getting the audit and record-keeping capability in place, not as free time.
