High-risk deadlines: plan backwards from 2 December 2027
The Digital Omnibus, in force since 27 July 2026, defers Annex III high-risk obligations to 2 December 2027. See what already binds and how to plan back.
Under the Digital Omnibus (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026), the stand-alone high-risk obligations of Regulation (EU) 2024/1689, meaning systems classified under Article 6(2) and listed in Annex III, move from 2 August 2026 to 2 December 2027. Product-embedded high-risk systems under Article 6(1) and Annex I move from 2 August 2027 to 2 August 2028.
One point of status comes before anything else. The amendment is law: European Parliament plenary vote on 16 June, Council adoption on 29 June. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. For what else it changed, see what the Digital Omnibus changed.
The date moved; the workload did not. A 16-month deferral is schedule, not reprieve. This chapter shows how to use it: plan backwards from 2 December 2027.
The Amended High-Risk Timeline at a Glance
The original Article 113 schedule made the high-risk regime applicable from 2 August 2026 for stand-alone Annex III systems and 2 August 2027 for Annex I product-embedded systems. The Digital Omnibus moves those two dates, and only those two dates, to 2 December 2027 and 2 August 2028 respectively.
Three points govern everything that follows.
- The new dates are fixed calendar dates. The Commission's November 2025 proposal would have linked the high-risk start date to the availability of standards and support tools, with backstop dates; the co-legislators instead adopted fixed dates. The deferral does not depend on harmonised standards being available, and it does not move again if standards arrive late.
- The deferral is settled law. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026.
- Nothing else moved. The prohibitions, the GPAI obligations and the Article 50 transparency duties keep their original dates. The Omnibus added new 2 December 2026 dates: two new Article 5 prohibitions, and the end of the Article 50 transition for generative systems already on the market.
Sixteen extra months sounds generous until you sequence the work: classification, conformity route, technical documentation, testing, oversight design, quality management, declaration, registration. Counted backwards from 2 December 2027, those months are already spoken for.
What the Digital Omnibus Changed for High-Risk Systems
From Proposal to Law
The Digital Omnibus is the Commission's digital simplification package of 19 November 2025, covering several files in the EU digital rulebook at once. Parliament and Council negotiators reached a political agreement on 6–7 May 2026, COREPER confirmed the compromise text around 13 May 2026, and the co-legislators adopted it in June 2026 — the European Parliament on 16 June, the Council on 29 June. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026.
For the AI Act's high-risk regime, the core of the measure is the application schedule in Article 113. The substance of the high-risk obligations in Articles 8–17 is unchanged. The Omnibus did change substance elsewhere: Article 4 (AI literacy) was replaced, Article 6(1a) and (1b) narrowed the Annex I safety-component test, and two prohibitions were added to Article 5. The same risk management, the same documentation, the same conformity assessment, just later. For the full package beyond the AI Act dates, see the Digital Omnibus explained.
Fixed Dates, Not a Standards Trigger
The Commission's November 2025 proposal would have linked the high-risk start date to the availability of standards and support tools, with backstop dates. The co-legislators instead adopted fixed dates: 2 December 2027 (Annex III) and 2 August 2028 (Annex I). So do not plan as if the date might slip again when standards run late. 2 December 2027 is a calendar date, not a condition.
Entry into Force: 27 July 2026
The European Parliament voted on 16 June 2026 and the Council on 29 June 2026. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. Entry into force came on the third day after publication (Article 4 of the amending regulation).
Plan to the amended dates; they are settled. The reason the deferral cannot justify a pause is not legal uncertainty but arithmetic: counted backwards from 2 December 2027, the work already fills the calendar.
Before and After: the High-Risk Deadline Table
The table separates the two schedules. The left column is the original Article 113 schedule; the right column is the deferral under Regulation (EU) 2026/1744, in force since 27 July 2026.
| Provision | Original date (superseded 27 Jul 2026) | Applies from (Reg. 2026/1744) |
|---|---|---|
| Article 6(2) stand-alone high-risk — Annex III use cases: biometrics, employment, education, essential services, law enforcement and more | 2 August 2026 | 2 December 2027 (+16 months) |
| Article 6(1) product-embedded high-risk — Annex I harmonised product legislation: machinery, medical devices, toys, lifts and more | 2 August 2027 | 2 August 2028 (+12 months) |
| Article 50 transparency, including 50(2) machine-readable marking | 2 August 2026 | Unchanged: 2 August 2026; generative systems on the market before that date: 2 December 2026 (Art. 111(4)) |
| Article 5(1) points (ba) and (bb): two new prohibitions added by the Omnibus | — (new) | 2 December 2026 |
Section 5 (Arts. 40–49) is not named in the deferral in Art. 113, third paragraph, point (c), but it has no practical effect until the deferred Sections 1–3 apply. For Annex I Section B products (e.g. vehicles, aviation, and, since Regulation (EU) 2026/1744, machinery), the requirements arrive through the sectoral legislation, not directly from the AI Act.
For every date in the Act in one place, including those already passed, see the full deadline timeline.
What Did Not Move — and Already Binds
Prohibitions: Apply Since 2 February 2025 — Article 5
The Article 5 prohibited practices have applied since 2 February 2025: social scoring, certain biometric categorisation, emotion recognition in workplaces and education (save for medical or safety reasons), untargeted facial-image scraping, and the rest of the banned list. They carry the top penalty tier, up to EUR 35 million or 7% of total worldwide annual turnover under Article 99(3), and the Omnibus does not move them; it adds two more from 2 December 2026.
GPAI Obligations: Apply Since 2 August 2025 — Articles 51–55
General-purpose AI model obligations under Articles 51–55 have applied since 2 August 2025 and are untouched by the Omnibus. If your company provides a GPAI model, the high-risk deferral gives you nothing.
Article 50: applies since 2 August 2026 (legacy generative systems: 2 December 2026)
Article 50, including 50(2) marking, has applied since 2 August 2026: disclosing chatbot interactions to users, machine-readable marking of synthetic content, and deepfake labelling duties for deployers. What moved is narrower. Generative systems already on the market before 2 August 2026 have until 2 December 2026 (Art. 111(4)). The same date brings two new prohibitions, Article 5(1) points (ba) and (bb): non-consensual intimate imagery of an identifiable person, and child sexual abuse material. Many timelines published before May 2026 do not show that date at all.
The '2027' headline is therefore a trap. A provider of an Annex III recruitment system may simultaneously run a customer-facing chatbot and generate synthetic content (Article 50, applying since August 2026). A compliance calendar that shows only one date will miss the obligations that already apply. See how enforcement phases in for which authority enforces what, from when.
Planning Backwards from 2 December 2027
The method is subtraction. Start at 2 December 2027 and work upstream. Registration requires a signed declaration, the declaration requires a completed conformity assessment, the assessment requires Annex IV documentation, and the documentation requires evidence that takes quarters to produce, not weeks. Four steps, in dependency order; the full walkthrough lives at conformity assessment.
Step 1: Lock Your Classification — Article 6
Confirm whether each system is in Annex III scope under Article 6(2), and whether the Article 6(3) filter takes it out. A system that performs a narrow procedural task, improves a previously completed human activity or does only preparatory work may escape high-risk status if it poses no significant risk of harm, with the assessment documented in writing.
The Commission's draft classification guidelines under Article 6(5), published 19 May 2026 with a targeted consultation that closed on 23 July 2026 (extended from 23 June), give practical in-and-out examples for both Annex I and Annex III. Use them as a sense-check, not as gospel. They are draft, not legally binding, the Commission says it will adopt the final guidelines by the end of 2026, and authoritative interpretation rests with the Court of Justice of the EU.
Step 2: Pick the Conformity Route — Article 43
Most Annex III providers self-assess under internal control (Annex VI). Remote biometric identification and certain other Annex III point 1 systems can require a notified body (Annex VII) under Article 43(1). Notified-body capacity is the scarcest resource on this timeline. If your route involves one, first contact belongs two to four quarters before the assessment, not after the documentation is finished. Article 43 conformity routes walks through the decision.
Step 3: Build the Annex IV Technical Documentation — Article 11
The Annex IV technical documentation, required by Article 11, is where the whole programme comes together. It must evidence the risk management system (Article 9), data governance over training, validation and testing data (Article 10), accuracy, robustness and cybersecurity testing (Article 15), automatic logging (Article 12) and human-oversight measures (Article 14). Each of those must be built and running before it can be documented, which is why this step cannot start in the final quarter.
Step 4: Testing, Logging and Human-Oversight Design — Articles 12, 14 and 15
Human oversight under Article 14 is a design obligation, not a policy document. Interface changes, override mechanisms and operator training materials need engineering sprints in the plan. The same goes for Article 12 logging, where the system must technically allow automatic recording of events over its lifetime, and the Article 15 test campaigns. Then come the wrap-up items that gate market placement: a quality management system (Article 17), the EU declaration of conformity (Article 47), CE marking (Article 48), and registration in the EU database for Annex III systems (Article 49).
A Quarter-by-Quarter Backward Plan
H2 2026: Classify, Scope, Assign Owners
AI inventory, Annex III mapping with the draft Article 6(5) guidelines as a sense-check, gap analysis against Articles 8–15, choice of conformity route, and a named owner for each workstream. For biometric systems, make first contact with a notified body now, not next year.
H1 2027: Build Documentation and Controls
Annex IV documentation buildout, risk management iterations under Article 9, test campaigns for accuracy and robustness under Article 15, human-oversight implementation under Article 14, and a stood-up quality management system under Article 17.
Q3 2027: Assess, Declare, Register
Run the conformity assessment, either Annex VI internal control or the Annex VII notified-body procedure, then sign the EU declaration of conformity (Article 47), affix CE marking (Article 48) and register in the EU database (Article 49).
Q4 2027 Is Margin, Not Working Time
The last quarter stays deliberately empty: buffer for notified-body queries, corrective findings, re-tests and late procurement evidence requests. If the buffer is consumed by planned work, the plan has already failed.
For a single Annex III system with an existing engineering team, expect four to six quarters of part-time-to-dedicated work. Multi-system portfolios scale roughly linearly on documentation and testing.
Set Your Internal Deadline at Mid-2027
The one operational takeaway is this: set an internal readiness target of mid-2027, roughly five months ahead of 2 December 2027, so audit findings, notified-body queues and re-tests land inside your margin instead of past the statutory date.
The commercial reality reinforces the legal one. Enterprise buyers and public procurement teams are already writing AI Act readiness into RFPs ahead of the statutory date, so 'ready by the deadline' often means 'too late for the deal'.
Keep one principle in view: the statutory deadline is the date enforcement can begin, not the date to aim for. Your own deadline comes first.
If You Miss It: Penalties and Enforcement
Non-compliance with the high-risk obligations, meaning Articles 8–17 and the operator duties in Articles 23–27, carries administrative fines up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). Since the Digital Omnibus, the Article 99(4) tier also covers the Article 25(2) and (4) supply-chain obligations (point (da)).
The other tiers set the contrast. Article 5 prohibited-practice breaches reach EUR 35 million or 7% (Article 99(3)), and supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities reaches EUR 7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps each tier at the lower of the percentage or the fixed amount. For small mid-cap enterprises (SMCs), the lower amount applies only to fines under Article 99(4) and (5), not to fines for prohibited practices under Article 99(3) (Article 99(6a)).
Fines are not the only exposure. Market surveillance authorities can order corrective action, withdrawal or recall of non-conforming systems under Chapter IX, and for a shipped product, a recall is usually costlier than the fine that accompanies it.
The decision you need to make: pick your internal readiness date, with mid-2027 as the defensible default, put it in writing, and assign an owner to every workstream in the backward plan above. The deferral bought you sixteen months of schedule. Converting that schedule into compliance is your decision, and it is due now, not in 2027.
How Confir helps
The backward plan above is what Confir operationalises. Confir's classification module asks plain-English questions about what each AI system does and derives the risk tier under Articles 5 and 6, including the Article 6(3) filter assessment, documented in writing. From the classification result, the platform maps which obligations apply, generates the Article 11 / Annex IV technical documentation pack, assembles the conformity-assessment evidence trail, and produces the Article 47 declaration of conformity.
The synthesis engine is deterministic and rule-based: the same logic every time, no model inference, no hallucination. Every classification decision and its rationale lands in an append-only audit log, time-stamped and locked against edits, the evidence a market surveillance authority or a notified body will ask for first.
Frequently Asked Questions
Is the EU AI Act high-risk deadline delayed to 2027?
Yes. The Digital Omnibus (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026) moves stand-alone Annex III high-risk obligations from 2 August 2026 to 2 December 2027. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026.
When do high-risk AI systems have to comply with the EU AI Act?
Under the Digital Omnibus (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026), stand-alone Annex III systems (Article 6(2)) must comply by 2 December 2027 and product-embedded Annex I systems (Article 6(1)) by 2 August 2028 — both fixed calendar dates. The amendment has been in force since 27 July 2026.
What is the Digital Omnibus and what does it change in the AI Act?
The Digital Omnibus is an EU amending regulation (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026), in force since 27 July 2026, after a political agreement on 6–7 May 2026. For the AI Act it defers the two high-risk application dates to 2 December 2027 and 2 August 2028, adds two Article 5 prohibitions from 2 December 2026, gives generative systems already on the market until 2 December 2026 for Article 50, and sets fixed dates instead of the standards-linked start date the Commission proposed in November 2025.
Is the whole EU AI Act delayed?
No. The Article 5 prohibitions have applied since 2 February 2025, GPAI model obligations under Articles 51–55 since 2 August 2025, and Article 50, including 50(2) marking, has applied since 2 August 2026. Generative systems already on the market before that date have until 2 December 2026 (Art. 111(4)). Two new Article 5 prohibitions apply from 2 December 2026. Only the two high-risk application dates move.
What are the penalties for missing the EU AI Act high-risk deadline?
Non-compliance with high-risk obligations carries fines up to EUR 15 million or 3% of worldwide annual turnover under Article 99(4). Prohibited practices draw up to EUR 35 million or 7% (Article 99(3)), and supplying incorrect or misleading information to authorities up to EUR 7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps fines at the lower amount.
How long does conformity assessment take for high-risk AI?
Plan in quarters, not weeks. Most Annex III providers self-assess under internal control (Annex VI), but the groundwork — Annex IV documentation, testing evidence, human-oversight design and a quality management system — typically takes two to four quarters. Biometric systems under Annex III point 1 may need a notified body, whose queues add months. Target internal readiness by mid-2027.
Was the EU AI Act stop-the-clock proposal adopted?
No. The Commission's November 2025 proposal would have linked the high-risk start date to the availability of standards and support tools, with backstop dates. In the Digital Omnibus, the co-legislators instead adopted fixed dates. The deferrals now in force — 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems — are fixed calendar dates that do not move if standards arrive late.