The EU AI Act's big deadline moved. Half the internet hasn't noticed.

What actually changed this summer

The EU spent two years telling companies that 2 August 2026 was the day the AI Act's high-risk regime would bite. Then, days before the deadline, the calendar moved. The AI Omnibus, formally Regulation (EU) 2026/1744, entered into force on 27 July 2026 and rewrote the Act's timetable. Stand-alone high-risk systems under Annex III, the list covering hiring and recruitment tools, credit scoring, education, access to essential services, law enforcement and border management, now have until 2 December 2027. AI embedded in products that already carry EU safety regimes, the Annex I set spanning machinery, medical devices, toys and lifts, moved out to 2 August 2028.

That is a sixteen-month reprieve on the obligations most software companies were sweating: risk management systems, data governance, technical documentation, logging, human oversight and registration in the EU database. The Commission sells the package as simplification rather than retreat, and paired the delays with lighter documentation duties for SMEs and, newly, for small mid-cap companies.

What is already law today

Read past the headlines about delay and the striking fact is how much of the Act is simply in force. The banned-practices list, including social scoring by public authorities, has applied since 2 February 2025. Obligations for general-purpose AI model providers have applied since 2 August 2025. And the piece that landed on schedule this August is the one most consumer products actually touch: Article 50 transparency. Systems that interact with people must disclose that they are AI, and synthetic media and deepfakes must be labelled. The Commission's AI Office also holds enforcement powers over general-purpose model providers as of 2 August 2026.

The Omnibus even added law while subtracting deadlines. It wrote a new prohibition into Article 5, banning AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a transition that ends on 2 December 2026. The same date closes a four-month watermarking grace window for systems that were already deployed before this August. Anyone filing the Omnibus under "Brussels went soft" has not read it.

The internet has not caught up

Here is the practical problem: much of what ranks in search for the AI Act was written before late July, and it confidently tells you things that are no longer true. In one afternoon of research for this piece we found current-looking compliance guides still presenting 2 August 2026 as the binding high-risk deadline. Even the specialist resources disagree on details: the Future of Life Institute's AI Act tracker logs the Omnibus as entering into force on 31 August, while the Commission's own announcement says 27 July.

When sources conflict, dates beat prose. The regulation number is 2026/1744, the consolidated text lives on EUR-Lex, and any undated page that treats August 2026 as the high-risk deadline was written in a different legal reality. This is exactly why our regulation tracker attaches a source link and a verified-on date to every row. A compliance date without a date-of-checking is a rumour with a citation.

Sixteen months is a schedule, not a pardon

If you build or deploy Annex III systems for the EU market, December 2027 sounds distant and is not. The high-risk file takes quarters, not weeks: risk management that actually runs, training-data governance you can evidence, logs you retain, oversight a human can genuinely exercise, and registration at the end of it. Deployers carry duties as well as vendors, including oversight arrangements and informing affected people. Start with an inventory of which systems plausibly land in Annex III, then gap-analyse against the file you would need to show a regulator, and let the deferral absorb the engineering rather than the procrastination.

Member states also now have until August 2027 to stand up regulatory sandboxes, which are worth watching if you want supervised room to test.

The nearer risk surface is the part nobody delayed. If your product talks to people, generates media, or ships a general-purpose model, your obligations are current, and as of August the AI Office has the powers to make that point.

Our take

Brussels blinked on timing, not on direction. The high-risk regime survived intact and dated, the ban list grew, and the transparency rules arrived on schedule with an enforcer attached. Companies reading the delay as a pardon will spend late 2027 discovering how much of the file cannot be built in a quarter. Use the sixteen months. And check the date on anything you read about this law, including this article: it was accurate on the day in the byline, which is why it, and every row of our regulation tracker, carries one. The same week the compliance calendar moved, the price of frontier AI moved too: see what the GPT-6 price cuts actually mean.