The EU AI Act Has Been Delayed to 2027 — What Your SME Still Must Do Now

If you have read a headline saying the EU AI Act has been pushed back to 2027 and quietly closed the tab, please open it again. The delay is real, but it is far narrower than the headlines suggest. The heaviest high-risk obligations have moved. The rules that already touch almost every SME using AI — AI literacy and transparency — have not. This is a guide to what actually changed, what still applies today, and why the extra runway is an opportunity rather than a reason to relax.

Has the EU AI Act really been delayed to 2027?

Partly. Under the Digital Omnibus, the high-risk obligations for stand-alone Annex III systems move from August 2026 to 2 December 2027, and high-risk AI embedded in regulated products (Annex I) moves to 2 August 2028. Other obligations keep their original dates.

The change comes from the Digital Omnibus on AI, the first substantive set of amendments to the AI Act since it was adopted in 2024. It was designed to give businesses more time on the parts of the regime that were not yet workable — the harmonised technical standards and national supervisory authorities simply were not ready in time. Rather than let obligations bite before the tools to meet them existed, EU legislators moved the dates, and they used fixed calendar dates rather than a conditional trigger, so there is no moving target to plan around.

Is the Digital Omnibus already law?

It is formally adopted but not yet fully in force. The European Parliament approved it on 16 June 2026, the Council gave final approval on 29 June, and the final act was signed on 8 July 2026. It enters into force three days after publication in the Official Journal, expected in late July 2026.

This matters for planning. Until the Omnibus is published and enters into force, the original AI Act timeline remains the law on the books. In practice the new dates are now a near-certainty — the text is signed — but a cautious compliance lead should note that the relief becomes legally binding only on publication, not before. We are tracking the Official Journal and will update this page the day it lands.

What still applies in 2026 regardless of the delay?

Two things every SME should care about. Article 4 AI literacy has applied since February 2025 and is untouched by the delay. The Article 50 transparency obligations remain due on 2 August 2026, so chatbots and AI-generated content must be disclosed to users.

This is the part the headlines miss. The Omnibus delayed the high-risk regime — risk management systems, conformity assessments, technical documentation for Annex III and Annex I systems. It did not delay the obligations that most SMEs actually encounter first:

• Article 4 (AI literacy): in force since 2 February 2025. Every business using AI must take measures to support AI literacy among staff and others operating its systems. The Omnibus reworded this from "ensure" to "take measures supporting" — a softer duty, but a live one.
• Article 50 (transparency): due 2 August 2026. Users must be told when they are interacting with an AI system and when content is AI-generated. Only the narrower provider watermarking duty under Article 50(2) slips to 2 December 2026.
• Prohibited practices: the Act's bans on unacceptable-risk uses remain in force, and the Omnibus adds a new prohibition on AI-generated non-consensual intimate imagery.

Which deadlines moved, exactly?

Stand-alone high-risk systems under Annex III move to 2 December 2027. High-risk AI embedded in regulated products under Annex I moves to 2 August 2028. Article 50(2) provider watermarking moves to 2 December 2026. Everything else keeps its original date.

The moved dates at a glance

• Annex III high-risk (e.g. AI in recruitment, credit scoring, education, essential services): was 2 Aug 2026 → now 2 Dec 2027.
• Annex I high-risk (AI embedded in regulated products such as medical devices, machinery, vehicles): was 2 Aug 2027 → now 2 Aug 2028.
• Article 50(2) provider watermarking of AI-generated output: → 2 Dec 2026.

What did NOT move

• Article 4 AI literacy — in force since Feb 2025.
• Article 50 transparency for deployers — remains 2 Aug 2026.
• Prohibited-practice bans — in force.

Why is the delay an opportunity, not a reason to wait?

Because the work did not shrink — only the enforcement clock moved. A high-risk compliance framework takes many months to build properly. The businesses that use the 18-month runway to build calmly will be ready; those that wait will face a 2027 scramble with the same workload compressed.

There is a reason the deadline moved: the standards and authorities were not ready. That is precisely why a serious business should start now. The obligations are unchanged; only the date enforcement begins has shifted. Treating December 2027 as a comfortable finish line rather than a distant start line is the trap. The smarter framing is a managed 18-month journey — literacy and transparency handled this year, higher-risk work sequenced calmly across the runway. That is exactly the kind of ongoing, month-by-month engagement our retainer services are built around.

Frequently asked questions

What is the Digital Omnibus AI Act?

The Digital Omnibus on AI is the first package of amendments to the EU AI Act since 2024. Its headline change is a delay to the high-risk obligations, moving Annex III systems to December 2027 and Annex I embedded systems to August 2028, while leaving AI literacy and transparency rules on their original schedule.

Is the AI Act 2027 deadline final?

The 2 December 2027 date for Annex III high-risk systems is set by fixed calendar date, not a conditional trigger, and the amending regulation was signed on 8 July 2026. It becomes legally binding once published in the Official Journal, expected in late July 2026.

Does the EU AI Act timeline delay mean I can stop preparing?

No. AI literacy obligations have applied since February 2025 and transparency obligations are still due in August 2026. The high-risk work was deferred, not cancelled, and it takes many months to complete — so the extra time is best used to prepare, not to pause.

What must an SME do right now despite the postponement?

Document your AI literacy measures under Article 4, disclose AI use where Article 50 applies (chatbots and AI-generated content), and build a simple register of the AI systems you use. These are live obligations unaffected by the delay.