The AI Act Deadline Just Moved 16 Months.
Three Obligations Didn’t.

The headlines were clear enough. “EU delays AI Act.” “High-risk compliance pushed to 2027.” “Relief for AI builders.”

All true. The Digital Omnibus on AI, the amending regulation the Parliament approved and the Council adopted in June 2026, moves the big deadline. Obligations for stand-alone high-risk AI systems (Annex III) slip from 2 August 2026 to 2 December 2027. That is sixteen months of room on the heaviest part of the regulation.

Here is the problem with reading the headline and downing tools. Three obligations did not move, and two of them are brand new. And underneath the switch-on dates sits a second set of operational deadlines that no “AI Act timeline” graphic shows, which the Omnibus does not touch at all. If your plan was “the AI Act is a 2027 problem now,” you have a 2026 problem you have not noticed.

So you can plan deliberately rather than react to a headline, here is the other side of the ledger:

The delayed high-risk obligations are not spread evenly. The bulk fall on the provider (Arts 8–22: risk management, data governance, documentation, logging, human oversight, accuracy). Deployers carry their own set (Arts 26–27, including a fundamental-rights impact assessment), and importers (Art 23) and distributors (Art 24) inherit checks of their own. Knowing which of those is yours is the difference between sixteen months of preparation and sixteen months of assuming someone else owns it.

Switch-on dates are only half the clock. The AI Act also carries operational deadlines inside the obligations, and the Omnibus changed none of them. These are the duties teams miss, because they never appear on a timeline graphic:

• Serious-incident reporting
  Art 73, provider and deployer — report within 15 days of becoming aware; 2 days for a widespread incident; 10 days where a death is involved. The market-surveillance authority then acts within 7.
• Documentation retention
  Keep technical documentation, the EU declaration of conformity, and GPAI documentation for 10 years (Arts 18, 22, 23, 47, 54); keep high-risk system logs for at least 6 months (Arts 19, 26).
• Certificate validity
  Notified-body certificates last ≤ 5 years (Annex I) or ≤ 4 years (Annex III); if a notified body’s designation is withdrawn, its certificates stay valid only 9 months (Arts 44, 36).

Timing matters: these durations do not move, but they go live with their parent obligation. GPAI documentation retention is already in force (since August 2025). The high-risk ones (incident windows, log and document retention) switch on with the high-risk regime, now December 2027. Either way they are runbook duties, not calendar entries you can defer.

The delay is not a softening of intent. It is a readiness problem. Implementation was visibly off track, and the harmonised technical standards that tell you how to satisfy the high-risk requirements (risk management, data governance, technical documentation, logging) were not ready in time. You cannot hold companies to a conformity deadline when the conformity yardstick does not exist yet.

That distinction matters for how you use the sixteen months. The requirements did not shrink. The high-risk obligations that land in December 2027 are the same obligations. Retrofitting them into a system already in production takes far longer than sixteen months. Teams that treat this as a deadline that vanished will spend late 2027 doing in a panic what they could have done deliberately.

Most coverage of the Omnibus stops at the date table. A date table tells you when. It does not tell you what to build differently, or who in your organisation owns it.

RuleMesh holds the AI Act as engineered rules: each obligation traced from the statutory article, to the actor it binds, to the engineering control that satisfies it, to the evidence an auditor would ask for. Read through that lens, a sixteen-month shift is not a calendar update. It is a re-prioritisation:

• The 2026 obligations are stable.
  Transparency, content marking, and the two new prohibitions do not wait on standards. You can start the engineering for them now, with little risk of rework.
• The high-risk obligations that moved to 2027 are where the standards uncertainty sits.
  The durable parts (data lineage, logging, documentation discipline) hold regardless of how the standards land. Start the evidence trail there, and let the standards-dependent detail follow.

Much of this is not new work. The 2026 obligations lean on the same controls GDPR already asks of you: security of processing, data governance, logging, records. If you are implementing GDPR with RuleMesh today, you are already building the substrate the AI Act will need. Not sure where you stand? The scope interview walks you through what applies, by role, against the live rules engine.

Sixteen months is not time off. It is a head start, if you spend it building the evidence record instead of waiting for the new deadline to feel urgent.

Informational, not legal advice. The Digital Omnibus dates above are not yet legally binding — they take effect only on publication of the amending regulation in the Official Journal of the European Union (L series); confirm against the published text before relying on any specific date. Primary sources: AI Act — Regulation (EU) 2024/1689 (EUR-Lex, CELEX 32024R1689); Digital Omnibus on AI — COM(2025) 836 (CELEX 52025PC0836), procedure 2025/0359(COD) and report A10-0073/2026 (European Parliament Legislative Observatory). Obligation, actor, and deadline mappings are drawn from RuleMesh’s structured model of the AI Act.