The EU AI Act Delay Is a Gift Only If Enterprises Keep Building Governance

August 2, 2026 was supposed to be the date when the EU AI Act's rules for high-risk systems took hold. With two weeks to go, most of those obligations have instead been pushed back. The EU's Digital Omnibus on AI, formally adopted at the start of July, moves the deadline for standalone high-risk systems to December 2, 2027 and for high-risk AI built into regulated products to August 2, 2028, according to a July 1 briefing from Addleshaw Goddard. The firm said the text would be published in the EU's Official Journal shortly and enter into force three days later.

Many compliance teams will read that as permission to slow down. Our view is that this would be a mistake. The delay is useful, but only for enterprises that spend it building the governance they will need anyway.

What changed, and what did not?

The omnibus did not pause everything. According to Addleshaw Goddard, transparency obligations for AI systems, including marking of AI-generated content, still apply from August 2, 2026, with a grace period until December 2, 2026 for certain systems already on the market. A new ban on AI systems designed to generate non-consensual intimate imagery or child sexual abuse material takes effect December 2, 2026.

Other changes ease the load. The AI literacy requirement now asks providers and deployers to take measures supporting staff literacy, rather than to guarantee a specific level. Some exemptions for small and medium-sized enterprises now extend to small mid-cap companies. Registration of high-risk systems in the EU database is back, in simplified form. Processing sensitive personal data to detect and correct bias is allowed in exceptional cases, with safeguards.

So the near-term work is narrower than it looked a year ago, but it is not zero. Any enterprise putting chatbots, content generators or synthetic media in front of EU users has a deadline in two weeks.

Why the delay is not a reason to wait

There are fair arguments for the delay. Rules for systems used in hiring, credit and critical infrastructure are complex, and rushing to meet a deadline with half-built processes produces paperwork, not safety.

But for enterprises, the question is not whether the delay is justified. It is what to do with it. Three reasons argue for using the time rather than banking it.

The work does not get smaller. Knowing which systems are high-risk, documenting data sources, testing for bias and setting up human oversight takes months for a single system and longer across a portfolio. Agentic systems, which act on their own, will be far more common by December 2027 than they are now. Teams that start their inventory then will be inventorying a much bigger estate.

Good governance pays off before the regulator arrives. The practitioners we hear from at AI Connect events describe governance as what lets them move faster, not slower. At COLLIDE 2025, leaders on a panel about AI data governance at speed argued for governance by design: clear rules for developers, automated testing and monitoring built into the pipeline. That is the same infrastructure the AI Act will eventually require. Building it now improves the AI you ship this year.

Ownership questions take the longest to settle. "I think of AI governance as a non-IT responsibility," Nick Yateski, former chief AI officer at WellStar Health System, said on that COLLIDE panel. Deciding which executives own AI risk, and how a central team works with business units, is organizational work. It does not happen in a compliance sprint. Our coverage of how Walmart, AT&T and others built trusted AI describes the AI boards and councils those companies set up to make these calls.

What should enterprise leaders do in the next 16 months?

A practical plan looks like this:

• Meet the August 2 transparency obligations. Identify every customer-facing system that generates content or interacts with people in the EU, and confirm disclosure and labeling are in place, or that the grace period applies.
• Build the inventory now. List AI systems in use, including tools employees adopted on their own. Our report on detecting shadow AI covers practical ways to find them.
• Classify against the high-risk categories. Even with later deadlines, knowing which systems will fall into scope shapes procurement and design choices today.
• Use existing frameworks. ADP's Amber Eshelman, senior director of global data governance, advised teams to "do a lot of reading" in a AI Connect webinar on AI data governance, pointing to the NIST AI framework, ISO certification and the AI Act itself. No one needs to invent a program from scratch.
• Plan for change. The omnibus shows the rules can still move. Build processes that can absorb new requirements rather than a checklist tied to one version of the text.

The bottom line

The EU has given enterprises more time. The companies that benefit most will be the ones that treat December 2027 as the date their governance is finished, not the date it starts. The rest risk scrambling to meet the next deadline with systems they never fully mapped. We would rather see enterprise leaders use the extra months to make their AI more trustworthy and easier to scale, which is the point of governance in the first place.

Frequently asked questions

When do EU AI Act high-risk rules apply now?

Under the Digital Omnibus, standalone high-risk systems face obligations from December 2, 2027 and high-risk AI in regulated products from August 2, 2028.

What still applies on August 2, 2026?

Transparency obligations, including marking AI-generated content, apply from August 2, 2026, with a grace period until December 2, 2026 for certain systems already on the market.

What should enterprises do with the extra time?

Build an AI inventory, classify systems against high-risk categories, settle ownership of AI risk and put governance by design into development pipelines.

Opinion pieces reflect the views of The AI Enterprise Magazine Team.

Filed under: AI Governance & Trust, AI Strategy & ROI