AI Act: Europe Postpones Key Obligations on High-Risk AI to 2027

Extended compliance timeline for high-risk systems

The compromise reached between Parliament, the Council, and the Commission postpones the obligations for autonomous AI systems listed in Annex III—such as recruitment, credit scoring, education, justice, and border control—to December 2, 2027. For AI systems integrated into products regulated under Annex I, such as medical devices, machinery, or vehicles, the deadline is extended to August 2, 2028, according to the timeline detailed by Gibson Dunn.

This delay of more than a year compared to the initially planned schedule gives European AI developers and user sectors additional time to adapt their critical systems to governance, documentation, and risk management requirements. Systems already marketed before August 2, 2026, would also benefit from an additional four-month period to comply with the marking and traceability obligations for generated content as outlined in Article 50.

The definition of « high-risk » systems is further clarified to limit cases of double regulation with other sectoral legislations, which clarifies the scope for actors already subject to specific frameworks in health, finance, or mobility.

New Targeted Sanctions and Strengthening of the AI Office

In exchange for this deferment, the political agreement introduces a new ban targeting AI systems that generate or manipulate non-consensual intimate images or content, as well as child pornography material. This ban is expected to be applicable after a transitional period up until December 2, 2026, during which providers of image and video generation systems will need to integrate technical safeguards to prevent such uses.

The text also strengthens the powers of the European AI Office, which would have exclusive authority over certain generic AI systems and new investigative and sanction tools. This institutional refocusing alters the regulatory landscape for major providers of foundational models present in the European market.

The message sent is twofold: an operational reprieve on the most regulated industrial uses, but an immediate tightening on uses deemed socially unacceptable, with a consolidated sanction framework.

What This Delay Means for User Industries

For European companies deploying AI systems in recruitment, credit risk assessment, education, or justice, delaying to December 2, 2027, pushes back the significant investments related to compliance documentation, audits, and evaluation procedures. Software providers integrated into medical devices, industrial machines, or vehicles have until August 2, 2028, to align their certification processes.

This timeline is set against a tense European macroeconomic backdrop, marked by a persistent energy risk premium linked to the tensions around the Strait of Hormuz, with Brent oil priced around $98 a barrel according to Invezz on May 27, 2026, and a significantly declining French private sector activity. In this environment, the temporary easing of regulatory pressure on AI provides additional visibility for the concerned financial and operational management.

However, the dates and modalities mentioned arise from a provisional political agreement: they will only come into force after formal adoption and publication in the Official Journal of the EU, and the final text could still undergo technical adjustments. Therefore, the involved parties must closely monitor the next steps of the European legislative process before finalizing their compliance trajectories.