High-Risk AI Got 16 More Months

The Council of the EU gave final approval to the Digital Omnibus on AI on 29 June 2026.

Parliament had already voted for it on 16 June 2026, 423 in favour, 57 against, 174 abstaining, and it entered into force on 27 July 2026. If you’ve read an article calling this delay “possible” or “proposed,” that article predates one of those three dates. It’s done. It’s law.

What actually moved

Two deadlines, both pushed out, neither cancelled.

The Annex III high-risk deadline moved from 2 August 2026 to 2 December 2027, sixteen months later than originally planned. Annex I, the product-embedded high-risk category, moved further out, to 2 August 2028.

Those are the two dates that moved for high-risk systems. Outside that tier, the Omnibus added one narrow grace period: generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking to their output under Article 50. Everything else, including the general-purpose AI obligations and the rest of Article 50, applied on 2 August 2026 as planned. If your product falls under either of those, the Digital Omnibus did very little for you.

The vote itself is worth noting because it wasn’t close. 423 in favour against 57 against is a wide margin for a piece of legislation that touches an industry moving this fast, and it’s part of why the sixteen-month number should be treated as durable rather than a placeholder somebody might revisit next year.

Annex III versus Annex I, briefly

Annex III lists high-risk AI by what it’s used for: hiring decisions, credit scoring, medical devices as software, critical infrastructure, law enforcement, and a defined list of similarly sensitive contexts. The obligations attached to it are the heavy ones, risk management, technical documentation, human oversight, conformity assessment, registration in an EU database, and they now apply from 2 December 2027 instead of this past August.

Annex I covers AI embedded as a safety component inside products that were already regulated under other EU product safety law before the AI Act existed: machinery, toys, lifts, medical devices as hardware. Because those products already go through a conformity process under their own sectoral rules, the AI Act folds into that existing process rather than creating a second one from scratch. That category now has until 2 August 2028.

The distinction that trips people up is that Annex III is about the use case, a piece of software making or influencing a decision about a person, while Annex I is about the product, a physical thing with an AI component inside it that already had a safety certification process long before anyone was talking about the AI Act. A hiring algorithm and a smart lift both count as high risk, but they got there through completely different doors, and the door determines which deadline applies.

What’s worth doing in the next twelve months anyway

The wrong read on this delay is “we can stop.” The right read is that the deadline moved, the work did not shrink, and doing the following three things now instead of in month fifteen is the difference between a real compliance program and a rushed one.

• Classify your systems now. Figure out which of your products, if any, fall under Annex III, while there’s no deadline pressure distorting the judgment. This doesn’t get easier by waiting, and misclassifying something as low risk because you were in a hurry is exactly the mistake extra time is supposed to prevent.
• Start the data governance work. If anything you build touches Annex III territory, data lineage and data quality work takes months to do properly. Sixteen months is enough time to do it once. Two months is enough time to do it badly.
• Build the logging habit now. Audit trails compound. A system with two years of real logs by December 2027 is in a completely different position than one that starts logging in November 2027 because the deadline finally showed up on a calendar.

What can wait

Formal conformity assessment paperwork, registration in the EU database, and any notified-body engagement your system might eventually need can genuinely wait. Doing that paperwork sixteen months early mostly means doing it twice, once now against guidance that’s still settling, and again closer to the deadline against whatever the final implementing rules turn out to be.

That’s a different statement from “don’t think about it.” Knowing roughly which conformity route your product will need, self-assessment versus a notified body, is useful to know now even if you don’t file anything until 2027. It changes how you sequence the classification and data governance work above, and it’s a cheap thing to figure out early precisely because filing it isn’t.

One sentence about my own product, then I’ll stop: the transparency and documentation habits a tool like AIVory Guard nudges you toward inside the IDE aren’t wasted regardless of which annex you eventually land in. This post isn’t legal advice, and if Annex III genuinely applies to your product, get real legal review well before December 2027, not in November of that year.

Sixteen months is real time. Spend it now, not in month fifteen.