Updated 1 November 2026: rewritten as adopted law, with article references to Regulation (EU) 2026/1744.

Correction (19 October 2026): This note was written before the Digital Omnibus was formally adopted; it has been updated to reflect its publication as Regulation (EU) 2026/1744 (in force since 27 July 2026) and the new prohibited practices it adds from 2 December 2026.

The EU AI Act's main high-risk deadline moved from 2 August 2026 to 2 December 2027. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It sets 2 December 2027 for high-risk systems listed in Annex III and 2 August 2028 for AI in products covered by Annex I. The bans, general-purpose AI rules and the Article 50 transparency duties were not postponed.

What exactly moved?

Only the high-risk rules in Chapter III, Sections 1 to 3 moved, and the two high-risk routes moved to different dates.

  • Annex III systems (listed uses such as recruitment, credit scoring and exam proctoring): from 2 August 2026 to 2 December 2027. This is a move of 16 months.
  • Annex I systems (AI that is a product, or a safety component of a product, under listed EU product law, such as lifts, toys and medical devices): from 2 August 2027 to 2 August 2028. This is a move of 12 months.

These dates sit in Article 113, third paragraph, point (c), as replaced by Article 1(40)(b) of the Omnibus. The Commission's implementation timeline shows the same dates. Article 6(5), the Commission's own duty to issue classification guidelines, was left out of the delay.

How did it become law, and why the delay?

The delay followed the normal legislative route and rests on a practical reason stated in the Regulation. Parliament adopted its position on 16 June 2026 and the Council decided on 29 June 2026. The act was signed in Strasbourg on 8 July 2026. Under its Article 4 it entered into force on the third day after publication.

Recital 40 gives the reason. Standards, common specifications and guidance were late, and national authorities were set up late. That risked undermining the rules and raising implementation costs. It explains the two dates by reference to the Act's original difference between Annex III and Annex I, and the time needed for adaptation.

What did not move?

Most of the Act's other deadlines stayed where they were, and a company that treats the delay as general relief would be wrong.

  • Prohibited practices (Article 5): in application since 2 February 2025.
  • AI literacy (Article 4): in application since 2 February 2025. The Omnibus rewrote it, but providers and deployers must still take measures. They need not guarantee a particular level for any individual.
  • General-purpose AI models (Article 53): in application since 2 August 2025. Models already on the market before that date have until 2 August 2027 (Article 111(3)).
  • Transparency (Article 50): in application since 2 August 2026. See the site's note on marking AI content.
  • Data protection: the GDPR and, in Türkiye, the KVKK apply regardless. Article 2(7), as replaced, keeps EU data protection law unaffected, apart from Articles 4a and 59.

The EU AI Act legislation note sets out the full calendar.

What did the Omnibus add or bring forward?

The same Regulation also made changes that apply well before December 2027.

  • 2 December 2026: new bans on AI systems generating non-consensual intimate imagery or child sexual abuse material (Article 5(1)(ba) and (bb)). See the note on the nudification ban.
  • 2 December 2026: end of the transition for machine-readable marking by generative systems already on the market (Article 111(4); Commission Q&A).
  • 27 July 2026: Article 4a allows exceptional processing of special categories of personal data for bias detection, under strict conditions. Articles 102 to 110, which amend other EU laws, also apply from this date.

Annex I itself changed. Machinery moved from Section A to Section B, so AI in machinery now falls under Article 2(2), which applies only Article 6(1), Article 60a and Articles 102 to 112. Article 6(1a) says AI used solely for non-safety purposes such as convenience is not a safety component, unless its failure would endanger health and safety (Article 6(1b)). Article 2(13) requires the Commission to adopt delegated acts by 2 August 2027 that may limit some requirements where Section A law already offers equivalent protection.

What about systems already on the market?

Under Article 111(2), as replaced, high-risk systems placed on the market or put into service before the Chapter III date are caught only if their design changes significantly from that date. One exception applies: providers and deployers of high-risk systems intended for public authorities must comply by 2 August 2030.

The Omnibus recitals add that the decisive date is when the first unit of a type and model reached the EU market. Any later significant design change triggers full compliance. A system launched in early 2027 may therefore carry different duties from a version redesigned in 2028. Article 5 applies to existing systems in any case.

What does the delay mean for planning?

The extra time gives organisations more room to build controls, while the groundwork can begin now.

  • Classify first. The site's risk tier guide and high-risk assessment walk through the tests. The Commission's classification guidelines are still in draft, so the examples may change.
  • Follow the standards. The reference of the first harmonised standard, EN 18286 on quality management, was published on 14 October 2026 under Implementing Decision (EU) 2026/2274. The EN 18286 note explains the effect.
  • Check third-country reach. A Turkish or Korean provider placing a system on the EU market, or whose system's output is used in the EU, falls within Article 2(1). Non-EU providers of high-risk systems must also appoint an EU representative (Article 22(1)).

Frequently asked questions

Was the EU AI Act's high-risk deadline delayed?

Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the EU AI Act's high-risk duties to 2 December 2027 for Annex III systems and to 2 August 2028 for AI in Annex I products. The change is adopted law, not a proposal.

Are EU AI Act prohibitions delayed by the Digital Omnibus?

No. The EU AI Act's Article 5 prohibitions have applied since 2 February 2025 and remain in force. The Digital Omnibus on AI adds two more, on non-consensual intimate imagery and child sexual abuse material, which apply from 2 December 2026.

Does the December 2027 date apply to all high-risk AI?

No. The 2 December 2027 date applies to EU AI Act high-risk systems listed in Annex III. AI that is a product or safety component under Annex I product law follows 2 August 2028, and machinery now falls under the narrower Section B rules of Article 2(2).

Must high-risk systems already in use comply by December 2027?

Not automatically. Under Article 111(2) of the EU AI Act, systems placed on the market before the application date are caught only if their design changes significantly after it. Providers and deployers of high-risk systems intended for public authorities must comply by 2 August 2030 regardless.

Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 as published in the Official Journal; Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 (Official Journal, 14 October 2026); Commission timeline and guideline pages, all read on 1 November 2026. General information, not legal advice.