The EU AI Act's High-Risk Deadline Just Moved. The Evidence Bar Didn't.

What actually happened, and when

On May 7, 2026, EU lawmakers reached political agreement on the Digital Omnibus on AI. The European Parliament approved it June 16, the Council gave final adoption June 29, it was signed July 8, and it entered into force July 27 — ten days before this post. It is now enacted law, not a proposal.

The substantive change: standalone high-risk systems under Annex III — biometrics, employment, credit scoring, critical infrastructure, education, certain public-sector uses — move from an August 2026 deadline to December 2, 2027, a 16-month extension. AI embedded in products already covered by EU product-safety law under Annex I — vehicles, medical devices, machinery, toys — moves from August 2027 to August 2, 2028, a 12-month extension. National AI regulatory sandboxes get pushed to August 2027. The maximum penalty framework — up to €35M or 7% of global turnover — is unchanged.

One thing worth being precise about, because getting it wrong undersells how narrow this delay actually is: Article 50 transparency obligations — disclosing that a user is interacting with AI, marking AI-generated content — were not delayed and took effect on the original date, August 2, 2026. Only the machine-readable watermarking piece specifically got a four-month grace period, and only for systems already on the market before that date. Anything placed on the market from August 2, 2026 onward has to comply immediately, no transition at all. This was a targeted extension of the high-risk regime, not a general pause on the Act.

Why it moved — and why that's the part that matters

The stated driver for the delay is not that the obligations were too onerous. It’s that the European standardisation bodies writing the harmonized technical standards the high-risk obligations depend on were running behind — many weren’t expected until late 2026, after the original deadline would already have hit. Regulators pushed the deadline because the yardstick wasn’t finished, not because the requirement was wrong.

That is a materially different situation than a straightforward reprieve. A finished yardstick arriving in late 2026 or 2027, binding from a fixed December 2027 date, means the obligations land with less runway to adapt to a finalized standard than teams currently assume — not more. The delay bought the regulator time to finish the standard. It didn’t buy your team time to start later.

What doesn't change, regardless of the date

Everything in our original walkthrough of the Act’s evidence requirements holds — only the calendar moved. The recurring engineering demand is still technical documentation, record-keeping, and demonstrated accuracy and robustness, measured on the system as deployed. For on-device AI, that’s still the quantized, compiled binary running on the chip, not the full-precision model evaluated on a cloud GPU — those remain different artifacts that can behave differently, and a cloud number was never evidence about the system placed on the market.

Signed, reproducible, on-device evidence — content-hashed to the exact model and hardware, tamper-evident, reproducible on demand — maps to those obligations the same way it did in June. The only thing that changed is how much runway you have to build the back-catalog instead of assembling it under pressure.

What to do with the extra runway

Use it as runway, not as permission to stop. The teams who read this delay as license to deprioritize on-device evidence will be exactly as unprepared in December 2027 as they would have been in August 2026 — just with more warning they chose not to use. The teams who keep gating models on real hardware in CI and keeping the signed bundles will walk into the finalized standard with two extra years of evidence already accumulated, instead of a scramble to reconstruct it once the yardstick lands.