Blog · EU AI Act · Readiness
A delay is not a pause: what the EU AI Act postponement really changes
25 July 2026 · 4 min read · By LeadAI
The EU has postponed the most demanding parts of the AI Act. Many teams read that as permission to stop. It is not. The delay moved two dates, left several duties exactly where they were, and handed organisations a fixed window to get ready.
What changed
The Digital Omnibus on AI became Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, days before the original 2 August deadline.
| Obligation | Old date | New date |
|---|---|---|
| Stand-alone high-risk AI systems (Annex III), such as recruitment, credit scoring, education, biometrics, law enforcement and border control | 2 August 2026 | 2 December 2027 |
| High-risk AI built into regulated products (Annex I), such as medical devices and machinery | 2 August 2027 | 2 August 2028 |
The reason given was practical. The standards and national authorities needed to make the high-risk rules workable were not ready. The requirements themselves were not dropped.
What did not move
Several duties were left alone, and some already apply today.
- Prohibited practices. These are already in force.
- Transparency rules (Article 50). These have applied since 2 August 2026. Generative AI systems already on the market before that date have until 2 December 2026, but only for the duty to mark outputs in a machine-readable way. If you publish AI-generated images, audio, video or certain public-interest text, read our note on labelling AI-generated media.
- AI literacy. The duty was reworded and softened. It was not removed, and training your people is still the sensible baseline.
Three ways a delay turns into risk
1. Governance debt keeps growing. The deadline moved, but the work did not shrink. Organisations that treat the delay as relief tend to collect control gaps that are harder to close once enforcement starts.
2. You cannot classify what you have not found. Research from the Cloud Security Alliance in March 2026 found that more than half of organisations lacked a systematic AI inventory. You cannot tell whether a system is high-risk until you know it exists, who owns it and what it does.
3. Old dates are still online. Plenty of articles and vendor pages still show 2 August 2026 as the high-risk deadline. Check the date and the publication year of any source before it drives a plan or a budget.
Use the window: five moves for the next twelve months
- Build the inventory. Record every AI system, its owner, its data and who it affects. Our guide to building an AI inventory that survives an audit shows what to capture.
- Work out your role. Providers and deployers carry different duties, and one organisation can be both. See which role you are.
- Triage for high-risk. Compare each system against the Annex III areas. Mark clear cases, unclear cases and clearly out-of-scope cases, and write down why.
- Collect evidence once, use it twice. Named owners, approval paths, test results and review records support the AI Act and an ISO/IEC 42001 management system at the same time.
- Close the near deadlines first. The December 2026 marking date, labelling duties and staff training come well before December 2027.
Where ISO/IEC 42001 fits
ISO/IEC 42001 is not the AI Act, and a certificate does not prove legal compliance. What it gives you is structure: scope, roles, risk assessment, controls, evidence and regular review. Those are the habits that make a later legal assessment faster and cheaper, because the facts are already recorded. For a plain-English walk-through, see what certification really involves.
A simple test
Ask one question this week: if a regulator or a customer asked which of our AI systems might be high-risk, could we answer within a day? If not, the delay has given you time to fix that, and the clock is already running.
If you would like to see where you stand, the free AI Readiness Check takes about 25 minutes, and the step-by-step journey shows how the LeadAI Assure platform takes you from inventory to evidence.
This article gives general information and is not legal advice or a substitute for the text of the EU AI Act, ISO/IEC 42001:2023 or professional advice.
Sources
- Gibson Dunn, EU AI Act Omnibus agreement: https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
- Brabners, Digital Omnibus on AI: https://www.brabners.com/insights/data-protection/digital-omnibus-on-ai-to-delay-eu-ai-act-what-businesses-need-to-know
- Cloud Security Alliance research note: https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-omnibus-vii-deadline-delay-20260/
- Article 50 overview: https://artificialintelligenceact.eu/transparency-rules-article-50/