EU AI Act Delay: What's Postponed and What Already Applies

The EU AI Act is now applicable, but its toughest rules for hiring software, credit scoring and other high-risk uses have been pushed back to December 2027. That gives European teams breathing room, yet not a free pass: bans, AI-literacy duties, model rules and transparency obligations already apply, and the US is moving in the opposite direction, toward lighter, disclosure-based rules.

This explainer on the EU AI Act delay sets out what was postponed, what is already in force, and what the compliance-versus-velocity trade-off means for teams shipping AI products and agents in Europe. It is documentation research based on the official texts, not legal advice.

What exactly was delayed

The delay came through the “AI Omnibus”, a simplification package. According to the European Commission, the proposal was adopted on November 19, 2025, a political agreement was reached on May 7, 2026, and the amending Regulation (EU) 2026/1744 entered into force on July 27, 2026.

• Annex III high-risk uses such as biometrics, critical infrastructure, education, employment, migration and access to essential services now apply from December 2, 2027.
• Annex I high-risk systems embedded in regulated products, such as machinery or medical devices, get an extended transition period to August 2, 2028.
• Machine-readable marking of AI-generated content under Article 50(2) has a grace period to December 2, 2026 in the amending regulation.
• SME relief is extended to small mid-cap companies, with simplified technical documentation, and more firms get access to regulatory sandboxes, including an EU-level sandbox, per the Commission.

The Commission frames the package as simplification meant to keep the rules “clear, simple, and innovation-friendly”. In practice, the high-risk obligations depend on harmonised technical standards and guidance that companies need in order to show conformity, and a fixed later date gives providers, notified bodies and national authorities more time to prepare. That is an interpretation, not an official rationale; the Commission's stated goal is simpler implementation.

What did not change matters as much. The risk categories, the list of high-risk areas and the substance of the obligations remain. Providers of high-risk systems will still need risk assessment and mitigation, high-quality datasets to reduce discriminatory outcomes, activity logging for traceability, detailed documentation, clear information to deployers, appropriate human oversight and a high level of robustness, cybersecurity and accuracy, as listed on the Commission's page. The Omnibus moved the start line; it did not shorten the course.

What already applies

The delay is narrower than many headlines suggest. The Act entered into force on August 1, 2024 and became generally applicable on August 2, 2026, the Commission says. Several layers are already live.

Two of the existing bans matter directly to HR tech: emotion recognition in workplaces and education is prohibited, as is biometric categorisation to deduce certain protected characteristics. Transparency rules also apply now: people must be told when they are interacting with a chatbot, generative AI output must be identifiable, and deepfakes must be labelled, according to the Commission.

Hiring tools: a reprieve, with conditions

CV-sorting software for recruitment is the Commission's own example of a high-risk employment use. Until December 2, 2027, vendors do not yet face the full high-risk regime of risk management, data-quality controls, logging and human oversight. But workplace emotion recognition is already banned, AI literacy duties already apply to deployers, and data-protection law still governs automated decisions. The Council's Digital Omnibus position, which keeps the GDPR right not to be subject to solely automated decisions unless an exception applies, is still being negotiated, Addleshaw Goddard reports.

Credit scoring: same delay, same direction

Credit scoring that can deny someone a loan is the Commission's example of a high-risk essential-services use. It also moves to December 2027. Lenders gain time to build documentation and bias testing, but the destination has not changed: the obligations are delayed, not removed.

Agents: mostly transparency for now

General-purpose agents are not high-risk by default. What applies to most agent deployments today are the transparency rules, the prohibited practices and, for model providers, the GPAI obligations. An agent that screens candidates or assesses creditworthiness, however, inherits the high-risk category of the task from December 2027. Teams building agents should map use cases, not products. Independent certification efforts such as AIUC-1 and identity-and-permission layers like Atlassian's agent platform are early attempts to make that mapping auditable.

Who enforces it now

Since August 2, 2026, the AI Office and member-state authorities are responsible for implementing, supervising and enforcing the Act, according to the Commission. The AI Office holds enforcement powers over general-purpose AI models and can request technical documentation and evaluate models. For most companies, though, the practical first contact will be a national market-surveillance authority, not Brussels.

A practical checklist for 2026-2027

If you build or deploy AI in the EU, these steps follow directly from the timeline above.

• Inventory every AI use case and tag it against the nine prohibited practices, the Annex III list and the transparency rules. Do this per use case, not per vendor.
• Confirm your AI literacy measures for staff who operate AI systems; that duty has applied since February 2025.
• For chatbots and agents that talk to users, make the machine disclosure explicit in the interface, and label synthetic media.
• For generative output, plan machine-readable marking before the Article 50(2) grace period ends on December 2, 2026. The Commission's Code of Practice on marking and labelling is the reference.
• For hiring, credit or education features, start the high-risk file now: data-quality checks, logging, human-oversight design and technical documentation, so the December 2027 deadline is a review, not a rebuild.
• Track the Digital Omnibus. Changes to GDPR rules on automated decisions and AI training data are not final, and Parliament's position is still pending.

The US: lighter, and getting lighter

In the US there is still no federal AI statute comparable to the AI Act, and the direction of travel in 2026 has been deregulatory.

• Colorado reset: Governor Jared Polis signed SB 189 on May 14, 2026, repealing the Colorado AI Act weeks before its June 30 effective date, Morrison Foerster reports. The replacement, effective January 1, 2027, drops risk assessment programs, impact assessments and the duty of reasonable care to prevent algorithmic discrimination in favour of disclosure, while still covering consequential decisions in areas including employment and lending.
• Federal pressure on states: on January 9, 2026 the Attorney General set up an AI Litigation Task Force whose “sole responsibility shall be to challenge State AI laws” inconsistent with the administration's policy, under Executive Order 14365, according to the DOJ memo. State laws remain in force unless a court or Congress says otherwise.
• Patchwork: MoFo notes other states, including California, Illinois, Texas, New York and Utah, have taken narrower, use-specific approaches.

The compliance vs. velocity trade-off

The delay changes the timing of the trade-off, not its shape. Three practical consequences for teams:

• Shipping speed in the EU improves for high-risk use cases through 2027, but anything you ship now must be retrofitted. Building logging, data-quality checks and human-oversight hooks into the architecture is cheaper than adding them in late 2027.
• US-first teams gain a real velocity edge on hiring and credit features, but a product that later enters the EU will need the documentation anyway. A single control framework that satisfies the stricter regime avoids two codebases.
• Evaluation is the shared requirement. Whether you face the AI Act or a state disclosure law, you will need evidence of how the system behaves. Our guide to building LLM evals is a practical starting point.

There is also a strategic angle for Europe. As we argued in Europe's automation trap, Europe's challenge is capturing AI value at home; regulatory predictability is one of the few levers fully in Brussels's hands. And compute capacity, as we covered in our look at data center power, is the other constraint the Act does not solve.

Our take

The AI Omnibus bought Europe 16 months on its hardest rules, and that is useful for start-ups that were not ready. But the bigger risk now is complacency. The bans and transparency duties are live, the high-risk deadline is fixed in law, and the US advantage is mostly about lighter rules today, not a lasting exemption for anyone selling into Europe. Teams that treat December 2027 as a design constraint now will move faster later than those who treat it as a reprieve.

Sources

• Regulation (EU) 2026/1744 (AI Omnibus), EUR-Lex
• European Commission: AI Act regulatory framework
• US Department of Justice: AI Litigation Task Force memo (Jan 9, 2026)
• Morrison Foerster: Colorado hits reset on AI regulation
• Addleshaw Goddard: Council position on the Digital Omnibus