EU Defers High-Risk AI Act Obligations to December 2027
The Digital Omnibus on AI entered into force on 27 July 2026, moving the compliance deadline for stand-alone Annex III high-risk systems from 2 August 2026 to 2 December 2027.

The European Union has formally pushed back the date on which its most demanding artificial intelligence rules begin to bite. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July, following final approval by the Council of the EU on 29 June. Its central effect is to move the compliance deadline for stand-alone high-risk systems listed in Annex III of the AI Act from 2 August 2026 to 2 December 2027, a deferral of sixteen months.
Annex III covers the categories where an AI system's output bears directly on a person's circumstances: biometric identification, critical infrastructure management, education and vocational training, employment and worker management, access to essential public and private services, law enforcement, migration and border control, and the administration of justice. Providers of systems in these categories face the full weight of the Act's obligations, including a risk management system maintained across the product lifecycle, data governance requirements, technical documentation, logging, transparency toward deployers, human oversight provisions, and registration in an EU database before the system is placed on the market.
The Commission first proposed the deferral on 19 November 2025, and the reasoning has been consistent throughout: the harmonised standards and guidance that providers were meant to build against were not ready in time for an August 2026 deadline, leaving companies to interpret obligations without the technical references that were supposed to make them concrete.
For industrial and infrastructure suppliers the practical read is straightforward. Any product whose AI component touches critical infrastructure management now has a longer runway, but the runway leads to the same place. Conformity assessment, technical documentation and CE marking remain the mechanism, and the systems that will need them in December 2027 are being designed now.
Sixteen months is enough time to do the work properly and not enough to postpone starting it.
Source: Gibson Dunn