EU Delays AI Act High-Risk Rules to 2027: What Enterprises Should Do Now

The European Union has formally pushed back the EU AI Act's toughest obligations. On June 29, the Council of the EU gave its final green light to the AI Omnibus, a regulation that moves the start of high-risk AI rules from August 2026 to December 2027 for stand-alone systems and August 2028 for AI built into regulated products. It also adds a new ban on AI that generates non-consensual intimate content or child sexual abuse material. For enterprises that have spent two years preparing for August 2026, the vote changes the calendar. Whether it should change the plan is a different question.

What exactly did the Council approve?

The Council's vote completes a process that began with a provisional agreement between Council and European Parliament negotiators on May 7, according to the Council's timeline. The text enters into force on the third day after publication in the EU's Official Journal, which was still pending when law firm Addleshaw Goddard summarized the adopted changes on July 1.

The main changes, based on the Council's description and that summary:

• High-risk deadlines move. Core obligations for high-risk systems now apply from December 2, 2027 for stand-alone systems and August 2, 2028 for systems embedded in products.
• A short grace period for transparency marking. AI systems placed on the market before August 2, 2026 get until December 2, 2026 to meet transparency obligations such as watermarking.
• A new prohibition. AI systems designed to generate non-consensual intimate imagery or child sexual abuse material, or lacking reasonable safeguards against it, are banned from December 2, 2026.
• Sandboxes later. The deadline for national AI regulatory sandboxes moves to December 2, 2027, according to the Council.
• Broader room to fix bias. The right to process sensitive personal data to detect and correct bias, previously limited to high-risk providers, extends to deployers of high-risk systems and to providers and deployers of other AI systems, under safeguards and only exceptionally.
• Relief for small mid-caps. Some exemptions available to small and medium-sized enterprises now extend to small mid-cap companies.

The Council framed the adoption as a deliverable under its "One Europe, One Market" simplification roadmap.

Is this deregulation or a timing fix?

Supporters of the omnibus present it as simplification: giving companies and regulators time for standards and guidance to catch up before high-risk rules bite. The final text, though, is not a wholesale rollback, and the negotiations show lawmakers pushing back on some of the European Commission's proposed cuts.

Two examples stand out in the Addleshaw Goddard analysis. The Commission had proposed exempting some high-risk systems that pose no significant risk from registration in the EU database; the final text keeps the registration duty and instead simplifies what must be submitted. The Commission had also proposed shifting the AI literacy duty from companies to EU and national authorities; the final text keeps it on providers and deployers, which must take measures to support literacy among staff and others operating AI on their behalf, though it sets no required proficiency level.

So the honest read is mixed. Deadlines moved substantially, but several core duties survived, and a new prohibition was added. Companies hoping the AI Act would quietly fade should not read the vote that way.

What is still unsettled?

The AI Omnibus is separate from the broader Digital Omnibus, which would amend the GDPR, NIS2 and the Data Act. According to Addleshaw Goddard, a Council vote on that package was expected on June 29 but was delayed because of disagreement over its content. For data leaders, that matters: much of what makes AI compliance hard sits in data protection and data-sharing rules, not the AI Act itself.

The omnibus also clarifies how supervision is split between the EU AI Office and national authorities for systems built on general-purpose models, and how sector rules interact. Machinery, for example, is excluded from direct AI Act application where requirements overlap, with the Commission to issue implementing acts for other sectors such as medical devices and toys. Expect more guidance before the new dates arrive.

What should enterprise AI leaders do with the extra time?

The temptation will be to pause compliance programs. AI Connect speakers have consistently argued for the opposite: treating governance as the thing that lets AI scale. "You put brakes on a car so that you can go fast," IBM's Ryan Zombo said at COLLIDE 2025, in a session on the five questions enterprises must answer to scale agentic AI.

Four practical implications follow:

1. Keep the inventory and risk classification going. Knowing which systems would count as high-risk is useful for internal governance, procurement and customer due diligence regardless of the EU date.
2. Do not drop AI literacy. The duty stayed with companies. Training programs already in motion remain a legal requirement, not just good practice.
3. Act on the near-term dates. The intimate imagery ban and the transparency grace period both land on December 2, 2026. Teams deploying generative tools should check vendor safeguards and marking now.
4. Use the bias-data provision deliberately. The expanded right to process sensitive data for bias detection could help teams test models more rigorously, but it comes with safeguards that legal and privacy teams need to design in.

Global companies also need to reconcile EU rules with other jurisdictions. Kellanova's Meet Patel told a COLLIDE 2025 audience that for GDPR-style rules, "there's not a right solution" or playbook yet, as legal, privacy and data teams learn together. Our coverage of trusted AI at Walmart, AT&T and Kellanova and of governance by design at ADP shows how teams are building that muscle.

The bottom line: the EU bought time, not an exemption. Enterprises that use the next 17 months to build durable governance will be ready for December 2027 and better positioned for whatever the Digital Omnibus brings.

Frequently asked questions

When do EU AI Act high-risk rules apply now?

Under the AI Omnibus, high-risk obligations apply from December 2, 2027 for stand-alone systems and from August 2, 2028 for AI systems embedded in regulated products.

Does the AI Omnibus remove the AI literacy requirement?

No. The final text keeps the AI literacy duty on providers and deployers, though it does not require a specific proficiency level.

What is the difference between the AI Omnibus and the Digital Omnibus?

The AI Omnibus amends the AI Act and was approved on June 29. The Digital Omnibus would amend the GDPR, NIS2 and the Data Act, and its Council vote was delayed.

Filed under: AI Governance & Trust, AI Strategy & ROI