EU Agrees to Push AI Act's High-Risk Rules Back to 2027 and 2028
The Digital Omnibus deal buys companies 12 to 16 extra months for high-risk systems while keeping watermarking and a new nudification ban on a December 2026 clock.
Key takeaways
- Negotiators reached a provisional deal on May 7, 2026 delaying standalone high-risk obligations to Dec. 2, 2027.
- Product-embedded high-risk systems, such as medical devices, move to Aug. 2, 2028.
- Watermarking duties and a nudification ban are set for Dec. 2, 2026, so some deadlines did not slip.
EU negotiators reached a provisional deal on May 7, 2026 to delay the AI Act's toughest requirements for high-risk systems by roughly a year or more. The postponement is real, but it is narrower than the headlines suggested: transparency rules and general-purpose AI duties were not part of the delay.
What was agreed
The AI Act's obligations for high-risk AI were due to apply from August 2026. Under the deal, which emerged from the Commission's Digital Omnibus simplification package, the dates move in two tiers. Standalone high-risk systems listed in Annex III, covering uses such as employment, education and credit scoring, now face obligations from December 2, 2027. High-risk AI embedded in products already regulated under EU safety law, listed in Annex I and including medical devices and machinery, gets until August 2, 2028.
That is a delay of about 16 months for the first group and 12 for the second, measured against the original schedule. Law-firm summaries repeatedly stress the word "deferred," not "cancelled": the substantive requirements remain, and companies still need risk management, data governance, documentation and human oversight in place before the new dates.
What did not move
Several obligations stay on near-term calendars. Transparency and labelling duties for AI-generated content, including watermarking under Article 50, are tied to December 2, 2026, with a grace period for generative AI providers already on the market before August 2, 2026. The deal also adds a ban on so-called nudification applications, effective the same date. The original Omnibus proposal had sought to drop the watermarking requirement; commentators note it was reinstated in negotiations. The general-purpose AI model rules, which already applied from 2025, were left alone.
The reporting trail is a little untidy. Some summaries describe formal endorsement by the European Parliament and Council in June and publication in the Official Journal in July, while others were written before those steps. Anyone planning around the dates should check the final text rather than rely on commentary.
Why it matters
The delay answers a practical complaint: the technical standards companies would use to prove compliance were not ready, and regulators were still building guidance. Pushing the dates relieves pressure on firms and on national authorities. It also hands critics a ready argument that Europe is retreating under industry and geopolitical pressure.
For companies, the sensible reading is that the work was moved, not removed. Teams that pause risk assessments now will face a compressed schedule later, and the nearer December 2026 duties apply regardless.
How the delay came about
The Commission proposed the postponement in its Digital Omnibus package, arguing that the standards and guidance companies need were not finished. Parliament and the Council had different appetites: some members wanted a longer pause or deeper cuts, others feared that delay would signal that the Act could be bargained away. One commentary even described the talks as collapsing in late April before the May 7 deal, a reminder of how close the negotiation was to stalling. The compromise kept the structure of the Act intact, moved the dates and added or preserved a few near-term obligations as a political counterweight.
The two-tier schedule reflects how the Act is built. Annex III covers stand-alone applications that regulators define as high-risk by use case, such as hiring tools or credit scoring. Annex I covers AI that is a safety component of products already governed by sector rules, including medical devices and machinery, where conformity assessment by notified bodies takes longer. Those products get the later 2028 date because their approval pipelines are slower and already complex.
For global companies, the effect is to stretch a compliance project rather than cancel it. Providers that sell into both Europe and the US now face a more favorable European calendar than expected, but a less predictable American one. That contrast, a delay in Brussels and a preemption push in Washington, is the policy story of the year for anyone shipping AI products across the Atlantic.
What to watch
- The final published text and any differences from the provisional agreement.
- Harmonised standards from European standards bodies, the real gating item for high-risk compliance.
- How the Commission and national regulators enforce watermarking from December 2026.
- Whether the US and other jurisdictions cite the delay in their own deregulation debates.
Sources
- The EU's Digital Omnibus on AI: What the Provisional Agreement Really Changes — CMS
- EU Lawmakers Reach Provisional Agreement to Delay Key EU AI Act Obligations — Sidley Austin
- The Digital AI Omnibus: Proposed deferral of high risk AI obligations under the AI Act — DLA Piper
- EU legislators agree to delay for high-risk AI rules — JD Supra
