EU AI Act shifts high-risk deadlines as existing duties remain

The Digital Omnibus on AI, in force since 27 July 2026, postpones EU AI Act obligations for high-risk systems. Use-based applications, including recruitment, credit scoring and education, must comply from 2 December 2027. Requirements for AI safety components embedded in regulated products follow on 2 August 2028. The changes extend preparation time without removing the need for risk classification, documentation and oversight.

Prohibited practices, AI literacy duties and general-purpose AI model rules already apply. Transparency obligations have applied since 2 August 2026, including informing people when they interact with AI and marking synthetic content. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet output-marking requirements. Additional prohibitions covering systems generating non-consensual intimate imagery and AI-generated child sexual abuse material also take effect on 2 December 2026. The amended literacy duty requires measures supporting literacy development rather than guaranteeing individual proficiency.

Compliance starts with an inventory of systems an organisation builds, buys or deploys, supported by documented intended purposes and risk assessments. Preparation should cover human intervention procedures, testing, event logs, supplier evidence and incident monitoring. Organisations outside the EU, including UK businesses, can be covered when their systems or outputs are used there. ISO/IEC 42001 can support governance, but certification does not replace evidence of compliance with the Act.