EU delays AI Act deadline: new deadline of 2 December 2027 for high-risk systems

EU delays AI Act deadline: new deadline of 2 December 2027 for high-risk systems

The EU's Digital Omnibus on AI (Regulation 2026/1744) entered into force on July 27, 2026, moving the compliance deadline for high-risk AI from August 2026 to December 2, 2027 for stand-alone systems and August 2, 2028 for systems embedded in regulated products. The delay is significant — but it is not deregulation. The underlying regulatory structure of the EU AI Act stands untouched, and for companies serving European customers the costs remain real. At the same time, the transition arrangement opens the door to a potential "race to market," in which systems launched before December 2027 could in theory escape high-risk obligations indefinitely — an interpretation that is contested and far from settled law.

What Has Changed

The original plan for the EU AI Act set the compliance deadline for high-risk systems at August 2026. The Digital Omnibus (Regulation 2026/1744), in force since July 27, 2026, has fundamentally altered the implementation timeline, according to reporting from Forkast News: the deadline for stand-alone high-risk systems under Annex III is pushed to December 2, 2027, and for high-risk systems embedded in regulated products under Annex I to August 2, 2028 (Forkast News).

It is worth being explicit about the documentation basis: the regulation numbers and dates cited come from two secondary sources — Forkast News and The National Interest — which corroborate each other on the deadlines, but the official text in the EU's Official Journal was not available for verification in this evidence base. The core picture is nonetheless consistent across both sources.

What the Delay Does Not Change

The National Interest is concrete on the point: the delay moves the deadlines but does not solve "the underlying problem" for US companies with European customers — substantial compliance costs persist, while the core legal obligations continue to evolve (The National Interest).

In other words: this is a time shift, not a dismantling of the rulebook. The architecture of the AI Act — risk classification, documentation requirements, human oversight, logging — remains intact. For companies selling into the EU, that means compliance budgets must be planned against the new deadlines, not on the assumption that the requirements will disappear.

What the Requirements Mean for Autonomous and Agentic Systems

For agentic AI (systems that act autonomously on a user's behalf), Forkast News points to four provisions that carry particular weight:

• Article 9(2)(a): Providers must establish clear boundaries for agent behavior — explicit definitions of which actions require human confirmation and which can be performed autonomously, along with defined escalation criteria in cases of uncertainty.
• Article 14: The mechanisms for human oversight must be configurable by the deployer of the system. The rationale is that the required level of intervention varies considerably across domains — a medical decision-support system and a customer service agent need different degrees of human control.
• Article 11: Documentation obligations for high-risk systems.
• Article 12: Logging requirements, so that system behavior can be traced and reconstructed.

In practice, this means that agentic AI providers must design for configurability and traceability from the start: interfaces that let customers adjust the level of oversight, logging infrastructure that captures autonomous actions, and documentation that distinguishes between confirmed and autonomous action types. For companies that have already built systems where these boundaries are implicit or hard-coded, this may require substantial re-architecting.

The Numbers: What Compliance Costs

The cost picture is partly based on official estimates, partly on third-party figures that should be treated with caution:

• The Commission's estimate (April 2026): €23,850–€40,400 in additional costs for certain high-risk systems already subject to existing product safety and quality management requirements. The figure is cited by The National Interest; the underlying Commission document is not available here (The National Interest).
• SQ Magazine (an independent technology publication, cited by The National Interest): annual compliance costs of approximately €29,300 ($33,000) per AI system. This is a third-party estimate that has not been independently verified.
• Auditry: The market for AI Act compliance services is estimated to reach as much as €38 billion by 2030. This too is a third-party estimate relayed via The National Interest and should not be presented as established fact.

The bottom line either way is that compliance costs money, and the delay shifts those costs in time without removing them.

The Industry Is Split

The industry response divides into two camps. On one side stands a coalition of 47 industry associations — including MedTech Europe, DigitalEurope and COCIR — which, according to Forkast News, lobbied successfully for the delay, arguing that the original deadline did not account for the technical complexity of achieving compliance. On the other side are compliance service vendors — named by Forkast as Collibra, OneTrust, Salt Security and Zenity — which are accelerating their roadmaps to capitalize on the new requirements.

The split is unsurprising: for system providers, the delay is breathing room; for the compliance industry, it signals a large, dated market arriving — just later than expected.

The Open Risk: "Race to Market"

The most contested consequence is Forkast News' legal analysis of the entry-into-force rules. Because the high-risk obligations do not apply to systems already on the market before the December 2, 2027 deadline, the analysis suggests a race could emerge: systems launched before that date could in effect bypass the regulation's strict requirements indefinitely.

It is important to emphasize that this is one outlet's analysis of a structural risk — not a confirmed interpretation from EU authorities. How entry into force and retroactivity are actually enforced is an open question likely to be settled only through practice and possible guidance from the Commission or the AI Office. If the interpretation holds, the market could bifurcate into two segments: new systems bearing the full compliance burden and legacy systems that escape it. If it does not, the window will prove narrower than hoped.

What Organizations Should Weigh Before December 2027

On the documented evidence, a few strategic choices stand out:

• Accelerate — or exploit the window? Companies with systems close to readiness may be tempted to launch before December 2027. But that presumes the entry-into-force interpretation holds — an uncertainty that makes a pure "race to market" strategy risky.
• Build in the article requirements early. Articles 9(2)(a), 11, 12 and 14 define concrete design requirements for agentic systems. Integrating autonomy boundaries, configurable oversight and logging now is cheaper than retrofitting.
• Budget against the Commission's estimate. €23,850–€40,400 in additional costs for certain systems is a documented reference point, even though the underlying document is not publicly available in this evidence base.

Open Questions

Several matters remain unresolved. Harmonised standards — such as prEN 18228 and prEN 18229-1 — are still at the draft stage, and without finished standards, providers lack the practical roadmap for demonstrating compliance. It is unclear when they will be completed and how they will operationalize the articles described above.

It also remains to be seen how the entry-into-force rules are enforced in practice: whether systems on the market before December 2027 are genuinely exempted indefinitely, or whether regulators find ways to capture them, will determine whether the delay becomes breathing room or a loophole. And the legal act itself — Regulation 2026/1744, with its final article numbers and dates — should be verified against the Official Journal before business-critical decisions are anchored in the secondary sources.

The delay buys time. The rules are coming anyway.