The EU AI Act Deadline Got Pushed Back. Here's What Still Applies Right Now.

For most of 2026, the working assumption among law firms and their advisors was to treat August 2, 2026 as a hard, binding deadline for high-risk AI obligations, since the proposed delay hadn't yet passed. That changed. The European Parliament voted on the Digital Omnibus on June 16, and it became law on June 29, 2026, resetting the clock specifically for high-risk systems.

Under the revised timeline, standalone high-risk systems under Annex III, the category that covers AI used in the administration of justice, now have until December 2, 2027 to comply. That's a genuine 16-month extension from where things stood earlier in the year.

This is the part worth being precise about, because getting it wrong either way creates a problem. The delay applies specifically to the high-risk obligations in Chapter III. Several other parts of the Act took effect exactly on schedule on August 2, 2026:

• Article 50 transparency requirements, covering AI-generated content marking, chatbot disclosure, and deepfake labeling, including the kind of client-facing AI disclosure questions firms already face
• GPAI provider obligations for general-purpose AI models
• The penalty regime and AI Office enforcement powers, meaning the legal machinery for enforcement is now live, even though the biggest substantive obligations for high-risk systems have more runway

Separately, prohibitions on certain AI practices have applied since February 2025 and were never part of the delay conversation at all.

It's tempting to read a 16-month delay as permission to deprioritize this entirely. That would be a mistake for a few concrete reasons.

First, the extension is a backstop, not a target. Firms that use the added time to actually build compliance capacity, tool inventories, risk classification, documentation processes, are in a fundamentally different position by late 2027 than firms that simply forgot about it for a year and a half. That work is the same foundation as having a real AI strategy, not a stack of unused tools.

Second, the technical standards required to fully implement compliance may not be finalized until closer to the new deadline, which means firms that start early get more time to adjust as guidance solidifies, rather than scrambling once standards are locked in.

Third, and most practically, the classification question hasn't gone away. Whether a firm's AI tools count as high-risk under Annex III still depends on what they're actually used for, legal interpretation, case outcome prediction, document analysis feeding into decisions, and firms still need to work that out regardless of when the compliance deadline lands. The same diligence questions before adopting tools still apply.

Given where things actually stand as of today, a reasonable priority list looks like this:

• Check whether Article 50 applies to anything client-facing your firm uses, since that's already enforceable, not deferred
• Build an honest inventory of every AI tool in use, including ones embedded in case management, CRM, or research platforms, since this is the foundation for every later step regardless of deadline
• Do a preliminary risk classification pass, so the firm knows roughly where it stands rather than assuming
• Treat December 2027 as real, not distant, sixteen months disappears faster than it sounds, especially for firms that haven't started anything yet

The headline deadline moved, but the underlying obligation didn't disappear, and part of the Act is already enforceable today. Firms that use this extension to actually build compliance capacity are in a different position by 2027 than firms that mistake a delay for a dismissal.

Not sure which of your firm's AI tools would count as high-risk, or what's already enforceable today versus what's been pushed back? Our AI Tools Assessment maps exactly what you're using and where you actually stand.