The EU AI Act Delay Is Breathing Room, Not a Reason to Pause Governance

The European Union gave enterprises more time this week. The AI Omnibus, Regulation (EU) 2026/1744, entered into force on July 27 and pushed the AI Act's obligations for stand-alone high-risk systems, the category that covers AI used in hiring, credit decisions and education, from August 2, 2026 to December 2, 2027, according to a Cloud Security Alliance research note. AI built into regulated products such as machinery and medical devices now has until August 2, 2028.

Our view is that enterprises should treat those 16 extra months as a chance to build high-risk governance properly, not as permission to set it aside. The companies that use this time well will deploy AI faster in 2027, not slower.

Why the delay is tempting to treat as a pause

The argument for easing off is easy to understand. Compliance teams have spent two years preparing for an August 2026 date that has now moved. Budgets are tight, AI programs are under pressure to show returns, and the rules for high-risk systems are detailed, with risk management, technical documentation, conformity assessment and post-market monitoring. If the legal deadline is late 2027, why not redirect people to projects that pay off this year?

There is a fair point here. A deadline that moves once can move again, and nobody wants to build to a target that shifts. Some of the final Omnibus text also eased burdens, simplifying documentation for systems that companies self-assess as not high-risk and softening the AI literacy duty, the CSA note said. Supporters of the delay can reasonably argue that companies are better off building to final rules and guidance than to a moving target.

Why that would be a mistake

The law is now fixed, and the work is slow. The new dates are binding because the Omnibus is in force, and the Act's risk tiers and obligations are unchanged, Holistic AI pointed out on July 28. The same analysis noted that risk management, documentation and conformity assessment take months per system. A large company may need to repeat that work across many systems. Sixteen months is not a long time for that.

Much of the Act is already live. Enforcement of transparency rules and rules for general-purpose AI providers began on August 2, the European Commission said. Chatbots must disclose they are AI, deepfakes must be labeled and AI-generated content must carry machine-readable marks. Prohibited practices have applied since February 2025. A company that pauses its AI governance program will find that a good part of it was needed now, not in 2027.

Good governance speeds AI up. This is the point practitioners at AI Connect events make most often. Inventories, risk tiers and documentation are what let a company approve the next use case in weeks instead of months. At ADP, the "number one thing is governance by design," the company's generative AI scaling lead, Julia, said at COLLIDE 2025, describing clear direction for developers, automated testing and proactive monitoring as the way to keep governance from becoming a blocker. Our report on AI data governance at speed shows how that works in practice.

Customers and boards will not wait for 2027. High-risk categories in the Act, such as hiring and credit, are also areas where customers, employees and other regulators tend to ask hard questions. The documentation the AI Act requires is close to what a careful company would want anyway to explain a decision, defend it and fix it.

What enterprises should do with the extra time

We would put four items at the top of the list.

Finish the AI inventory. The CSA note recommended re-running AI system inventories within 60 to 90 days against the narrower scope for product-embedded AI. That inventory is also the foundation for every other governance step.

Make transparency real in production. Disclosures and labeling are required now. Check that they are live in customer-facing chatbots and content tools, not only written into policy.

Pilot conformity work on one high-risk system. Pick a hiring, credit or similar system and take it through risk management and technical documentation end to end. The lessons will shape templates for the rest.

Fit frameworks to the Act. ISO/IEC 42001 and the NIST AI Risk Management Framework are useful starting points but do not replace the Act's per-system assessment, registration and CE marking, Holistic AI noted. Map what you already have to what the Act requires.

Speed and caution do not have to be opposites. "You have to balance going fast versus overstepping," SandboxAQ's Stefan Leichenauer, vice president of engineering, said in a AI Connect panel on future-proofing AI infrastructure. The delay makes that balance easier to strike, but only for companies that keep working. For examples of how large enterprises structure the oversight, see how Walmart and AT&T approach trusted AI at scale.

The EU has moved the deadline. It has not changed what good AI governance requires. Enterprises that build it now will arrive at December 2027 ready, and will have moved faster on AI in the meantime.

Frequently asked questions

When do EU AI Act high-risk obligations apply now?

Stand-alone high-risk systems must comply by December 2, 2027, and AI embedded in regulated products by August 2, 2028, under the AI Omnibus.

Is the AI Omnibus in force?

Yes. Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026.

Do ISO 42001 or the NIST AI RMF satisfy the AI Act?

They are useful starting points but do not replace the Act's per-system conformity assessment, registration and CE marking requirements.

Opinion pieces reflect the views of The AI Enterprise Magazine Team.

Filed under: AI Governance & Trust, AI Strategy & ROI