The EU AI Act Delay Bought You a Year. Use It, Starting 2 December.

When the EU agreed to delay the high-risk provisions of the AI Act, many boards heard one message: relax. That reading is understandable and expensive. The delay moved one block of obligations, while others already apply, one more arrives in three weeks, and the extra year is the only window most organisations will get to build the capability the Act assumes they have. This article sets out what changed, what is live, and how to spend the time.

What the Digital Omnibus changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, according to ActuIA's tracker of the Act's timeline. Its headline effect is a new schedule for high-risk systems:

• High-risk requirements for stand-alone uses such as employment, credit, education and biometrics (Annex III) now apply from 2 December 2027, moved from 2 August 2026.
• High-risk requirements for AI embedded in regulated products such as medical devices and machinery (Annex I) now apply from 2 August 2028.
• High-risk systems used by public authorities, including those already in service, have until 2 August 2030.

Gibson Dunn's analysis of the agreement also notes a softer AI literacy duty, where providers and deployers support literacy among staff instead of guaranteeing a specific level, and expanded supervisory powers for the AI Office. The Omnibus adds two new Article 5 prohibitions, covering systems that generate non-consensual intimate imagery or child sexual abuse material. Those prohibitions carry a transitional period that ends on 2 December 2026.

What already applies

The same ActuIA summary lists the obligations in force today. The eight prohibited practices in Article 5 and the AI literacy duty have applied since February 2025. General-purpose AI model obligations have applied since August 2025. Article 50 transparency rules, covering chatbots, marked generated content and deepfakes, have applied since 2 August 2026, along with Commission fining powers for general-purpose models.

For an enterprise this means the Act already touches production systems. A customer-facing assistant must disclose that it is an AI system. Published synthetic media needs labelling. Staff who use AI tools need support to use them well.

The date to circle: 2 December 2026

Generative AI systems placed on the market before 2 August 2026 received a grace period for machine-readable marking under Article 50(2). That grace period ends on 2 December 2026. Systems placed on the market on or after 2 August 2026 received no grace period. If your organisation builds or white-labels generative features, your product inventory needs to show which side of that line each system sits on.

The Commission has also made the practical route clearer. According to Reed Smith's review, the Commission found the Code of Practice on marking and labelling AI-generated content adequate on 8 July 2026, the AI Board followed on 9 July, and final Guidelines on transparency obligations followed on 20 July. The same review reports that the Guidelines say AI agents must disclose their artificial nature and the identity of the person they act for. Any enterprise rolling out agents that email, call or negotiate on a person's behalf should read that sentence twice.

Why the extra year is more valuable than it looks

High-risk compliance depends on capabilities that take time to build: a complete inventory of AI systems, documented data lineage, human oversight procedures, logging, and vendor contracts that deliver evidence on request. None of these arrives with a policy memo. The organisations that start in 2027 will be negotiating with vendors at the same moment as every other regulated buyer.

Sovereignty makes the same point from a different direction. The Commission's proposed Cloud and AI Development Act, covered by Computerworld in June, would have public bodies buy cloud services against four assurance levels, and the Commission's impact assessment placed about 70% of existing EU public sector workloads at Level 1, which is largely data residency. The proposals are not yet law, so treat them as direction of travel. They point to buyers asking sharper questions about who controls the stack, and enterprise suppliers will pass those questions down to you.

Practical takeaways for enterprise leaders

1. Build the inventory this quarter. List every AI system in production or pilot, its vendor, its purpose, and who in the business owns it. Every later obligation depends on this list.
2. Classify against the new dates. Tag each system as Article 50 transparency, potential Annex III high-risk, Annex I product-embedded, or general-purpose model use. Assign a compliance date to each tag.
3. Resolve the 2 December question. Identify generative systems placed on the market before 2 August 2026 and confirm with vendors how machine-readable marking will be delivered. Obtain the answer in writing.
4. Write agent disclosure into your design standards. Define how every agent identifies itself and the principal it acts for, and test it in each channel.
5. Put evidence rights in contracts. Ask suppliers for logging, documentation and incident notification terms that support Annex III duties, and align renewals to your 2027 timeline.
6. Fund AI literacy as an operating practice. The Act softened the wording, and the business case for trained staff remains unchanged.
7. Map sovereignty exposure. Record where your most sensitive workloads run, who holds the keys, and which jurisdictions can compel access. Decide which workloads justify a higher assurance level.

The bottom line

Regulators gave enterprises time, and they also set a rhythm: a transparency regime already running, a milestone on 2 December 2026, high-risk rules on 2 December 2027 and 2 August 2028. Leaders who build an inventory, a classification scheme and supplier evidence rights now will meet those dates as routine operations. Everyone else will meet them as projects.

This article offers general commentary and is not legal advice. Confirm obligations against the primary texts and with counsel.