The EU AI Act's High-Risk Rules Now Apply From December 2027

If you are working to a compliance plan that puts the EU AI Act's high-risk obligations on 2 August 2026, that plan is out of date. The date moved, by law, in July 2026. Annex III high-risk systems are now caught from 2 December 2027, and high-risk AI embedded in regulated products from 2 August 2028. A great deal of published material, including material published after the change, still carries the superseded dates.

The instrument that moved them

The AI Act itself is Regulation (EU) 2024/1689 of 13 June 2024, published in the Official Journal on 12 July 2024 and in force from 1 August 2024. That much has not changed.

What changed is Regulation (EU) 2026/1744 of 8 July 2026, which amends the AI Act and two other regulations to simplify implementation of the harmonised rules on artificial intelligence. EUR-Lex labels it the Digital Omnibus on AI. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, on the third day following publication.

Two points of precision matter here, because both are commonly got wrong. First, this is not a proposal. Anyone describing the digital omnibus as a late-2025 proposal with an uncertain future is more than a year behind: it is a regulation, adopted, published and in force. Second, it is the only amending act. The EUR-Lex consolidated version of the AI Act lists exactly one instrument in its table of amendments, so there is no second change to track.

The staged dates as they now stand

Article 113 sets the commencement scheme, and the European Commission publishes the resulting timeline itself. As it now reads:

1 August 2024, entry into force. 2 February 2025, the general provisions including definitions and the AI literacy duty, and the prohibited practices. 2 August 2025, the general-purpose AI rules and the governance arrangements, with Member States required to designate national competent authorities and adopt national penalty laws. 2 August 2026, the majority of the regulation applies and enforcement begins, including the transparency obligations in Article 50.

Then the dates that moved. 2 December 2027 for AI systems classified high-risk under Article 6(2) and Annex III. 2 August 2028 for systems classified high-risk under Article 6(1) and Annex I, meaning AI embedded in products already covered by EU product legislation. Both are marked in the Commission's own timeline as reflecting amendments made by the Digital Omnibus on AI. A new limb of Article 113 also brought Articles 102 to 110 into application from 27 July 2026.

The Commission's frequently asked questions on navigating the AI Act, updated 7 August 2026, states the position in a single line: the rules for high-risk AI systems will apply starting 2 December 2027.

What this does not mean

It would be a serious error to read the delay as a general pause. The deferral was targeted at two specific tranches of Chapter III. Everything else held.

The opening of Article 113 still provides that the regulation applies from 2 August 2026. The prohibitions in Article 5 have applied since 2 February 2025. The general-purpose AI obligations have applied since 2 August 2025. The transparency obligations in Article 50 apply now, and breach of them sits in the higher of the two main penalty tiers. Supervision and enforcement of the AI literacy duty also began on 2 August 2026.

So the practical effect for most organisations is not relief but a sixteen-month gap between the general application date and the Annex III high-risk date. Compliance material that collapses those into one date is wrong in both directions: it overstates what bites now and understates how long there is to prepare for high-risk.

There is a deadline this month

Two things land on 2 December 2026, which at the time of writing is under a month away.

The first is a set of new prohibitions inserted into Article 5 by the omnibus, concerning non-consensual intimate imagery and child sexual abuse material. These are remote from finance practice but they are the reason 2 December 2026 appears in the timeline at all.

The second is directly relevant to anyone running a generative tool. A new paragraph of Article 111 requires providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026, to take the necessary steps to comply with Article 50(2) by 2 December 2026. Article 50(2) is the marking and detectability obligation: outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated, as far as technically feasible.

Most finance functions are deployers rather than providers and so are not caught by that paragraph. The point to take from it is that the regulation contains live transitional deadlines that a timeline built around high-risk dates will miss entirely.

The grandfathering trap

There is a consequence of the delay that deserves more attention than it is getting. Article 111(2), as amended, provides that the regulation applies to operators of high-risk systems placed on the market or put into service before Chapter III applies only if, from that date, those systems are subject to significant changes in their designs. There is a backstop for systems intended to be used by public authorities, which must be brought into compliance by 2 August 2030.

Read that together with the move to 2 December 2027. An organisation deploying an HR or credit tool now has a real incentive to freeze its design before that date, and a real exposure if it does not. That is a governance decision to take deliberately rather than discover later.

Penalties, stated correctly

Article 99 sets the fine tiers, and three errors about them are in wide circulation.

The headline figure of up to 35 million euro, or 7% of total worldwide annual turnover for the preceding financial year, applies to non-compliance with the prohibited practices in Article 5 and to nothing else. Breaches of the provisions governing providers, importers, distributors, deployers, notified bodies and the Article 50 transparency duties sit at up to 15 million euro or 3%. Supplying incorrect, incomplete or misleading information to a notified body or national competent authority sits at up to 7.5 million euro or 1%.

For an undertaking, the test is whichever of the amount and the percentage is higher. The familiar "whichever is lower" cap applies only to SMEs, and now to small mid-caps under a paragraph inserted by the omnibus.

And the AI literacy obligation in Article 4 does not appear in the list of provisions carrying those administrative fines at all. Enforcement of it runs through Member State rules. Marketing that threatens eight-figure fines for failing to train staff is not supportable on the text, a point we set out in full in our piece on what Article 4 actually requires.

What to do with this

Three practical steps. Rebase any AI compliance timeline on the consolidated Article 113 rather than on commentary, because the commentary is where the old dates survive. Separate what applies today, which is prohibitions, general-purpose AI, transparency and the literacy duty, from what applies in December 2027. And check whether your organisation is a provider or a deployer for each system, because the obligations and the dates differ.

The same discipline applies to every compliance date a finance function tracks. Our analysis of ISA 240 (Revised) and its December 2026 effective date makes the point that paragraph numbers and effective dates move between editions, and that the only reliable citation is the instrument itself. The amending regulation is published at EUR-Lex as Regulation (EU) 2026/1744, and the Commission maintains its own implementation timeline, which marks the amended rows explicitly. Note that the Commission's explanatory pages carry a disclaimer that they are not legally binding; for anything consequential, read the consolidated regulation.