EU Delays Key AI Act Rules Until 2027 and 2028

By Suad Seferi · Aug 12, 2026

The European Union has pushed back some of the most demanding parts of its AI Act, giving companies more than a year of additional time to comply with rules covering high-risk artificial intelligence systems. Under the EU's new AI Omnibus regulation, rules for high-risk AI used in areas such as employment, education, critical infrastructure, biometrics and migration will now apply from 2 December 2027. AI systems built into regulated physical products, including machinery and other equipment covered by EU product-safety legislation, have been given an even longer transition period. Those requirements move to 2 August 2028. The change is substantial. Many of those obligations had been expected to start applying in August 2026 under the original AI Act timetable. But it would be wrong to describe the move as a delay of the AI Act itself. Large parts of Europe's AI rulebook are already in force. The AI Act did not get postponed The timing can be confusing because the EU has been implementing the AI Act in stages. Rules banning certain unacceptable AI practices began applying earlier. Obligations for general-purpose AI models followed, while transparency requirements covering areas such as AI-generated content began applying on 2 August 2026. Those rules have not disappeared because the high-risk timetable changed. The delay specifically affects important parts of the regime governing systems classified as high-risk under Annex III and AI systems covered through regulated products under Annex I. That means an AI company could already face obligations under one part of the Act while having until late 2027 to meet another. For businesses trying to understand whether they are compliant, that distinction matters more than the headline. Hiring, education and critical infrastructure get until December 2027 Some of the systems receiving additional time are among the most sensitive uses of AI covered by European law. They include certain applications involving biometrics, critical infrastructure, education, employment, migration, asylum and border control. For example, an AI system used to evaluate job applicants or influence decisions about access to education may fall into the high-risk framework depending on how it is used. Those systems face requirements covering areas such as risk management, data governance, technical documentation, record keeping, human oversight, accuracy and cybersecurity. The new deadline for these Annex III systems is 2 December 2027. The Commission says the additional time is partly intended to solve a practical problem: companies were being asked to comply before some of the technical standards needed to demonstrate compliance were ready. European standards organisations CEN and CENELEC have been working on harmonised standards for the AI Act, but that process did not progress according to the original schedule. Those standards are voluntary, but they matter. A company following an approved harmonised standard can gain a presumption that its system complies with the corresponding legal requirements. Without those standards, both companies and regulators have less certainty about what compliance should look like in practice. The EU chose to move the deadline rather than force the high-risk regime into effect before that framework was sufficiently mature. AI inside products gets another eight months A separate category receives even more time. High-risk AI systems that are safety components of products already governed by EU harmonisation legislation will not face the relevant AI Act requirements until 2 August 2028. This can include AI incorporated into products such as machinery and other regulated equipment. The reason for the longer transition is that these systems sit at the intersection of AI regulation and existing product-safety law. Manufacturers may need to adjust testing, conformity assessments, documentation and certification processes across both regimes. The EU is effectively giving that part of the market another year before the requirements become fully applicable. Brussels also cut some compliance requirements The AI Omnibus does more than change dates. The legislation is part of a wider attempt by Brussels to simplify the digital regulatory framework following sustained complaints from European businesses about the growing cost and complexity of compliance. Among the changes, simplified obligations previously aimed primarily at small and medium-sized enterprises are being extended to some small mid-cap companies. The Omnibus also removes the requirement for providers to register certain systems that are exempt from the high-risk classification in the EU's central database. A planned requirement for a harmonised post-market monitoring plan has also been removed, giving companies more flexibility in how they structure monitoring after deployment. Another change concerns AI literacy. The previous direct AI-literacy obligation on companies has been replaced by a softer approach centred more heavily on encouragement and measures promoted by the Commission and EU member states. These are not merely adjustments to dates. They represent a broader shift in how Brussels is trying to balance AI regulation with pressure to make Europe easier to build and invest in. But Europe is not abandoning tougher AI rules The simplification package also adds restrictions. The Omnibus introduces a prohibition targeting AI systems designed to generate non-consensual sexually explicit or intimate material, including so-called nudification applications, as well as systems producing child sexual abuse material. It also allows processing of certain sensitive categories of personal data when necessary to detect and correct bias in AI systems, subject to safeguards. The direction is therefore not straightforward deregulation. Europe is easing some administrative requirements and buying companies additional implementation time while retaining, and in some areas expanding, controls over…