On this page
More time for the heavy rules, none for the light ones.
The EU AI Act high-risk delay applies since 27 July 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, is in the Official Journal, so it is law rather than a political deal. It moves the high-risk rules for Annex III uses, such as AI in hiring, education and credit scoring, to December 2027, and for AI inside regulated products under Annex I to August 2028.
What does not move: the prohibitions and AI literacy, in force since February 2025, and the transparency rules for chatbots and deepfakes from August 2026. New prohibitions are even added. For a software company outside the EU, the question is the same as for one inside: is your product high-risk at all?
Question 1
Is it prohibited?
Manipulation, social scoring, emotion recognition at work. From 2 December 2026 also AI for non-consensual intimate images.
Question 2
Is it inside a regulated product?
As a safety component of a device that needs third-party assessment, such as a lift or a medical device.
Question 3
Is the use listed in Annex III?
Hiring and staff, education, biometrics, credit, insurance, critical infrastructure, public-sector areas.
Question 4
Does it only do a narrow task?
Sorting, improving a human result, flagging deviations, preparing. Then not high-risk, unless it profiles people.
Outcome
Transparency or minimal risk
Chatbots and generative AI follow Article 50. The rest: AI literacy and common sense.
Yes to question 2: high-risk under Annex I, the last group the rules reach. Yes to question 3 and no to question 4: high-risk under Annex III.
Old and new dates side by side
| Obligation | Originally | After the omnibus |
|---|---|---|
| Prohibited practices | 2 February 2025 | Unchanged, with two new prohibitions added |
| AI literacy | 2 February 2025: ensure a sufficient level | Since 27 July 2026: take measures that support it |
| General-purpose AI models | 2 August 2025 | Unchanged |
| Transparency: chatbots, deepfakes, marking | 2 August 2026 | Unchanged |
| Marking by generative AI placed before August 2026 | 2 August 2026 | 2 December 2026 |
| High-risk AI in Annex III | 2 August 2026 | 2 December 2027 |
| High-risk AI in Annex I | 2 August 2027 | 2 August 2028 |
The new prohibitions cover AI that creates intimate or sexually explicit images of an identifiable person without explicit consent, and AI that creates child sexual abuse material; see AI-generated content labelling. The chatbot and label rules are in the EU AI Act transparency obligations.
The new dates are fixed. The Commission's proposal tied them partly to the arrival of technical standards; the final text dropped that link, so only another law can move them.
Products that gain the most time
Annex III lists the uses that count as high-risk. The delay matters most to software companies in these markets:
- Hiring and staff managementa Dutch HR-tech start-up whose tool ranks applicants, targets job ads or allocates shifts based on behaviour. See AI for HR.
- Educationa German edtech platform that grades exams, decides admission or proctors online tests.
- Credit and insurancea fintech scoring consumer creditworthiness, or an insurer pricing life and health cover.
- Biometricsremote identification and categorising people from biometric data.
- Critical infrastructureAI as a safety component in traffic, water, gas, heating or electricity.
A marketing tool, a support chatbot, an AI agent that prepares quotes or a scheduling assistant is not on the list. The Commission published draft guidelines with in-scope and out-of-scope examples on 19 May 2026.
What the delay does and does not change
Is this final, or only a political agreement?
Final. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has applied directly in every member state since 27 July.
We are a US company selling an HR tool into Europe. Are we covered?
Yes, the AI Act reaches providers outside the EU whose systems are placed on the EU market or whose output is used there. A tool that ranks candidates is Annex III high-risk from 2 December 2027.
Our tool only sorts CVs by date. Is that high-risk?
Usually not. A narrow procedural task falls under the exception in Article 6(3). Scoring or ranking people is profiling, and profiling is always high-risk.
Could the dates move again?
Only through a new regulation. Until then 2 December 2027 and 2 August 2028 hold.
The exception that frees many tools
Even an Annex III use is not high-risk when the system only performs a narrow procedural task, improves the result of a completed human activity, detects patterns or deviations without replacing human assessment, or performs a preparatory task. Document why you rely on it; the omnibus simplified the registration of such systems in the EU database. Profiling of natural persons always stays high-risk.
Products already on the market
Under the amended Article 111, high-risk systems placed on the market before their new application date only fall under the high-risk rules when their design changes significantly afterwards. A product launched before December 2027 and left largely unchanged stays outside them; the prohibitions still apply. Software as a service ships updates every week, so map which changes count as significant before you rely on this. Systems used by public authorities must comply by 2 August 2030 regardless.
Lighter rules for smaller companies
All SMEs, not only the smallest, may now set up quality management for a high-risk system in a simplified way. Small mid-caps, a new EU category just above the SME threshold, get the same lower-of-two fine caps as SMEs. AI literacy became a duty to take supporting measures, with no required level per employee. How to write that down is covered in do I need an AI policy and the EU AI Act for business; how to roll AI out more broadly in implement AI in business.