EU AI Act 2027: AI Got Extra Time

Why high-risk AI got extra time 

High-risk AI is the heart of the EU AI Act, and it is also the part companies were least ready for. The technical standards that explain how to comply, the bodies that assess conformity and many national authorities were not in place when the rules were due to start. In May 2026 EU lawmakers agreed to move the dates, and the Digital Omnibus on AI has since entered into force.

The result is two new deadlines instead of one. Most of the rest of  the Act keeps its schedule, so the delay is narrower than many headlines suggested.

If you want the complete timeline, including what already applies, read our overview of all EU AI Act deadlines and new obligations.

The two high-risk deadlines at a glance 

How to tell whether your system is high-risk

The classification depends on what the system is used for, not on the technology behind it. A simple chatbot is not high-risk by default, but the same model used to rank job applicants may be. Three questions help with a first check:

1. Does the system influence decisions about people? Hiring, lending, school admissions, access to essential services and similar decisions are the typical triggers.
2. Is it part of a product that already needs EU safety approval? If so, it usually belongs to the Annex I group and follows the 2028 date.
3. Does it operate in a sensitive area such as critical infrastructure or law enforcement? These uses are listed in Annex III.

If the answer to any of them is yes, treat the system as a candidate for high-risk and confirm the classification against the legal text or with a lawyer.

Which sectors feel the delay most

The delay matters most where AI directly affects people’s rights, safety or access to services.

Hiring. CV screening, candidate ranking and employee monitoring tools are among the most widespread high-risk systems, and many are bought from vendors that do not label them as such.

Finance. Credit scoring and similar assessments of a person’s financial standing are covered, so banks and fintech firms need documented risk management and human oversight.

Healthcare. AI inside medical devices follows the later 2028 date, but software that supports clinical decisions needs a careful check of which category it falls into.

Education and public services. Systems that decide who gets a place, a benefit or a service are treated as high-risk because errors can close doors for individuals.

Law enforcement and infrastructure. These areas remain less regulated until the new deadlines, which has raised concerns among human rights organisations.

What is expected from high-risk systems

Once the deadlines arrive, providers of high-risk systems must show that they manage risk throughout the life of the system, use suitable and well-documented data, keep technical records, allow meaningful human oversight and meet requirements for accuracy and robustness. They must also pass a conformity assessment and register the system in the EU database. Deployers, meaning the organisations that use these systems, have their own duties, including using the system as intended, supervising it with trained staff and keeping logs.

What to do while you wait

Extra time only helps if it is used. A realistic plan for the coming months looks like this:

• Build an inventory of every AI tool in use, including those bought from vendors and those built in-house.
• Classify each tool as high-risk, transparency-only or minimal-risk, and write down the reasoning.
• Talk to vendors. Ask in writing how and when they will meet the requirements and what documentation you will receive.
• Set up governance. Name an owner for AI compliance, define how incidents are handled and decide who can override automated decisions.
• Start documentation now. Technical records are the most time-consuming part and cannot be produced in the last weeks before a deadline.

Standards are still being finalised, so keep the framework flexible and expect to adjust details later.

Common mistakes to avoid

Most compliance problems come from a handful of repeated misunderstandings.

Assuming the delay applies to everything. Only the high-risk rules moved; transparency duties and bans did not.

Classifying by technology instead of use. The same model can be low-risk in one setting and high-risk in another.

Relying on vendors alone. Deployers have their own duties, so a supplier’s promise is not a substitute for your own checks.

Leaving documentation for late 2027. Records of data, testing and oversight take months to assemble and cannot be recreated afterwards.

What the delay does not change

The delay does not reach the rules that are already in force. Banned practices have applied since February 2025, obligations for general-purpose AI models since August 2025, and the transparency duties of Article 50, such as telling users they are talking to an AI, since 2 August 2026. Only machine-readable marking of AI-generated content has a short grace period for existing systems, until 2 December 2026.

New bans, including on AI “nudifier” tools, take effect on 2 December 2026. Companies that treat the delay as a pause on everything risk missing obligations that are already live.

The high-risk rules are postponed, not dropped. December 2027 and August 2028 give providers and deployers a real chance to prepare, but only for those who start with an honest inventory and a clear classification.

 This article is for information only and is not legal advice 

 AI Transparency: This article was written by the author. AI tools were used to support editing and grammar refinement. This article contains AI‑generated images. The final version was reviewed by a human. 

Explore related pillars
👉Digital Safety Guide - A framework for privacy and safe digital ecosystems.
👉Neurotechnology Guide - A framework for neural data, BCI technologies, and neuromorphic computing.

• EU AI Act — What Changes on August 2, 2026
• The Ethics of Artificial Intelligence
• Ethics and Technology: Comparing OpenAI, DeepMind & UNESCO
• UNESCO Sets Ethical Standards for Neurotechnology
• The Ethics of AI Surveillance
• AI Agents, Panic and Real Risks

🔙 Return to the beginning of the journey

 Explore more topics:
Ethics • AI Trends • Neurotechnology • Digital Safety • Brain Science • AI Tools • Technology