The 2 August panic was wrong. Your real AI Act deadline is December 2027.

Conclusion first: if your organisation deploys AI in the EU and you have been bracing for the 2 August 2026 deadline, that date has moved. The high-risk obligations most organisations were worried about now apply from 2 December 2027. Parliament backed the change on 16 June; the Council gave its final green light on 29 June. Publication in the Official Journal is expected imminently — the political decision is settled.

If your compliance programme was a sprint to August, you can stop sprinting. What you should not do is stop.

What actually changed

The EU’s Digital Omnibus on AI amends the AI Act’s timetable in three places that matter:

• Annex III standalone high-risk AI systems — recruitment, credit scoring, essential services, and the other listed use cases. Obligations were due 2 August 2026; they now apply from 2 December 2027.
• Annex I high-risk systems — AI embedded in products already covered by EU safety law (machinery, medical devices, and so on). Those obligations move to 2 August 2028.
• Article 50(2) transparency — marking AI-generated content. The grace period was trimmed, so machine-readable watermarking obligations bite from 2 December 2026. Note that one: it is now the nearest real date on most deployers’ calendars.

Sources, if you want them from the horse’s mouth: the Council’s provisional agreement of 7 May and final adoption of 29 June, and Gibson Dunn’s explainer with the full dates table.

What didn’t change

The obligations on general-purpose AI model providers — the labs building the frontier models — are untouched. Those have applied since August 2025 and were never deferred. Much of the noise around “the AI Act deadline” conflated the clock running on the model providers with the clock running on the organisations deploying AI. They were never the same clock. If you deploy AI rather than build foundation models, the panic was aimed at somebody else.

The prohibitions on unacceptable-risk AI also remain in force. Nothing about the deferral makes reckless deployment legal; it changes when the paperwork for high-risk systems is enforced, not whether.

Why the panic happened — and why it was useful

I have written before about what I saw inside a large AI rollout: “We were not governing AI. We were tracking toward a date.”

That is what a hard deadline does to an organisation that hasn’t built real governance. The date becomes the governance. Compliance activity gets confused with control, and the question that actually matters — do we know what AI is doing in our name, and can we stop it if it goes wrong? — never gets asked, because everyone is busy hitting the milestone.

The deadline was doing work, though. It forced budget conversations that would otherwise have drifted. The honest reading of the deferral is that Brussels concluded most organisations weren’t going to be ready, and gave everyone sixteen more months. The risk now is the obvious one: the forcing function is gone, and “December 2027” sounds like “someone else’s problem, later”.

What the runway actually buys

Here is why starting now matters, and it has little to do with regulation.

The evidence on AI adoption is consistent and unflattering. Gartner finds that 89% of AI agent pilots never reach production — while the roughly 11% that do achieve an average 171% ROI. Gartner also expects over 40% of agentic AI projects to be cancelled by the end of 2027, and the stated reasons are operationalisation, governance, and failure to demonstrate value — not the technology. McKinsey finds 88% of organisations now use AI somewhere, but only 39% see any EBIT impact, with around 6% of high performers capturing disproportionate value. IBM’s CEO study puts it most bluntly: 25% of AI initiatives delivered the ROI they promised.

Read those numbers together and the pattern is clear: the gap between organisations that get value from AI and those that don’t is not model access. It is whether the operating model around the tools — ownership, verification, decision rights, workflow design — was ever rebuilt. That is the same work the AI Act’s high-risk obligations require you to evidence: oversight that can actually intervene, accountability with a name on it, documentation of what the system does and where it breaks.

Sixteen months is enough time to do that work properly, in small reversible steps, proven on real workflows. It is not enough time to do it as a structural change programme starting in mid-2027 — that version ends the way the August version was going to: tracking toward a date. There is no best practice for this yet; anyone who claims otherwise is selling a binder. There is safe practice: start early, keep the steps small, and make sure every automated decision has an owner who can stop it.

The question to ask before the compliance question

The organisations that will be comfortable in December 2027 are not the ones with the thickest compliance files. They are the ones that know where their AI adoption actually is. Most sit at the first level — tasks got faster, and how work moves stayed the same — and the honest next question is whether that is where you intend to stay, or whether the next level is worth the risk-versus-return.

That is a measurement question, and measuring it is quick. The free three-minute survey gives you a first read. A 90-minute AI Maturity Review gives you a structured one: where you are, what is holding the next level shut, and what the sixteen months should be spent on — in that order.

The panic was wrong. The clock is still real.