EU AI Act delay leaves current compliance duties intact

The Digital Omnibus moved the EU AI Act’s Annex III high-risk obligations to 2 December 2027, but companies already face requirements covering prohibited practices, AI literacy and transparency. High-risk AI embedded in regulated products follows from 2 August 2028. The rules also reach companies headquartered outside the EU when their AI output is used in the Union.

Deployers carry legal responsibilities independently of vendor contracts. Article 26 requires appropriate use, competent human oversight, monitoring, incident escalation, log retention and notices to workers and affected individuals. Logs under a deployer’s control must generally be retained for at least six months, unless other applicable law provides otherwise. Modifying or repurposing a system can shift an organisation into the provider category, bringing heavier obligations.

Compliance planning starts with a living inventory covering purchased tools, embedded features and employee use of assistants. Each entry should identify its purpose, affected people, data, risk classification and accountable owner. Country-level oversight helps address differing adoption levels and employee-representation requirements. Supplier agreements should secure documentation, log access and incident notification, while operational teams test suspension procedures and regulatory responses. Breaches of operator duties can attract fines of up to EUR 15 million or 3% of worldwide annual turnover. Maintaining the register alongside business-value assessments can also reveal redundant tools and opportunities to consolidate suppliers.