EU AI Act shifts high-risk deadlines but keeps transparency duties

The Digital Omnibus on AI postponed EU AI Act high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I products other than machinery. Transparency duties remained applicable from August 2, 2026. Generative systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking requirement; newer systems must comply from launch. The law also reaches providers and deployers outside the EU when their systems’ output is used there.

Vendors generally act as providers, while business customers are deployers. Providers carry obligations covering risk management, technical documentation, conformity assessment and post-market monitoring. Deployers retain responsibility for human oversight, relevant input data, monitoring and required disclosures. Rebranding, substantially modifying or repurposing a system can shift provider obligations to the customer. Fundamental rights impact assessments apply only to specified deployers and uses, not universally.

Vendor assessments should classify the intended use, establish legal roles and examine conformity evidence, underlying general-purpose models, customer-data policies and incident procedures. Contracts should address model changes, incident cooperation and log access, with written assistance agreements required for relevant high-risk supply chains. For most Annex III systems, conformity assessment uses providers’ internal controls rather than a notified body. Documentation supplied before the applicable deadline demonstrates readiness, not conformity. Certification against an AI management standard does not establish compliance with the Act, and contracts cannot transfer deployers’ statutory duties to vendors.