EU AI Act High-Risk Delay - The New December 2027 and August 2028 Deadlines Explained

The EU AI Act's most demanding obligations were due to hit on 2 August 2026. Days before that deadline, the EU's Digital Omnibus package became law as Regulation 2026/1744, in force since 27 July 2026, and moved the high-risk dates.

The delay is real but smaller than most headlines suggest. Stand-alone high-risk systems, the category covering recruitment and HR screening, credit scoring, education and essential services, now apply from 2 December 2027; only high-risk AI embedded in regulated products such as machinery and medical devices moves to 2 August 2028.

Everything already in force stays in force. This guide sets out the new timeline, what has not moved, and what UK businesses serving the EU should do with the extra time.

The Timeline After the Omnibus

The Delay Is Law, Not a Proposal

The Commission proposed the delay in November 2025 with the dates conditional on harmonised standards being ready. The final deal, confirmed in the Council and Parliament agreement of May 2026, replaced that conditionality with fixed dates, and the regulation entered into force on 27 July 2026.

The stated reason is candid: standards, guidance and national regulators were not ready. The practical consequence for businesses is a fixed, reliable runway rather than a moving target.

Which Date Applies to You

The distinction that matters is where your high-risk classification comes from. Annex III lists stand-alone use cases, including CV screening and recruitment tools, workforce management, credit scoring, education and access to essential services, and these apply from 2 December 2027, which is the headline date for most service businesses.

Annex I covers AI that is a safety component of products already regulated at EU level, such as machinery and medical devices, and only that category gets August 2028. A UK HR software provider reading about a two-year delay would be planning against the wrong date.

What Has Not Moved

The prohibitions, in force since February 2025, still ban practices such as social scoring, manipulative techniques and emotion recognition at work, with two further prohibitions on non-consensual intimate imagery and child sexual abuse material generation applying from December 2026. The AI literacy duty, requiring staff who operate AI systems to be adequately trained, has applied since February 2025 as well.

General-purpose AI obligations have applied since August 2025, transparency rules arrive as planned in August 2026, and the penalty framework is untouched, reaching 35 million euros or 7 per cent of worldwide turnover for prohibited practices, per the consolidated Act.

UK Businesses Are Still in Scope

The Act's reach did not change: it covers providers placing AI systems on the EU market wherever they are established, and providers and deployers outside the EU where the system's output is used in the EU. A UK firm screening EU candidates with an AI tool, or selling AI-enabled software into the EU, is in scope on either limb.

The UK contrast remains sharp. There is still no comprehensive UK AI statute, with the government continuing its regulator-led approach, so for UK firms serving Europe the EU AI Act remains the binding regime and the delay changes its dates, not its reality.

What to Do With the Extra Time

The delay converts a scramble into a programme. Inventory your AI systems against Annex III, assign owners, and build the governance documentation the high-risk regime will demand: risk management, data governance, human oversight and technical documentation. The duties that already apply, literacy and prohibited practices, need covering now, not in 2027.

Our AI governance policies service builds exactly this framework, and our updated EU AI Act guide for UK businesses covers the regime in full, alongside our guide to workplace AI policies for the internal-use side.

AI Policy and Procedure Writers

Policy Pros writes AI governance documentation for UK businesses: AI use policies, governance frameworks mapped to the EU AI Act and ISO 42001, literacy training records and the risk documentation the 2027 deadline will test. Contact us for a free quote, or call 020 3951 2875.