Europe’s AI Act Gets a Breather, But Don’t Get Too Comfortable
When the AI Act was formally adopted in June 2024,its timelines seemed clear enough. Prohibited practices would apply from February 2025. General-purpose AI obligations from August 2025. And the big one, the full weight of high-risk AI requirements, from August 2026. Businesses had two years to prepare. Surely that would be enough.
It was not enough. Or more precisely, the Commission did not give businesses enough to prepare with. The guidelines on high-risk AI systems that were supposed to provide clarity? The Commission missed its own February 2026 deadline to publish them. The harmonised standards that would let companies demonstrate conformity? Still not finalised. Many Member States have not even designated their competent authorities yet. The entire compliance infrastructure that was supposed to be humming along by now simply does not exist.
The Delay
In November 2025, the Commission proposed the Digital Omnibus on AI to push back deadlines. Both Council and Parliament agreed on fixed dates: 2 December 2027 for standalone Annex III high-risk systems (employment screening, credit scoring, biometrics), and 2 August 2028 for AI embedded in regulated products. Parliament voted 569 to 45 in favour.
Trilogue negotiations began 26 March 2026, with the final session scheduled for 28 April. The Cypriot Presidency aims for political agreement by late April or May. But here is the catch: until a final text is adopted, the original 2 August 2026 deadline remains legally in force. If negotiations stall, that deadline applies automatically.
What This Means for Us
Here is the practical question. If you are a business wanting to deploy AI for recruitment screening, credit assessment, or any of the other Annex III use cases, what should you actually do between now and the eventual compliance deadline?
The temptation is to treat this as a free pass. Eighteen months of regulatory breathing room. Deploy now, worry about compliance later.
This would be a mistake.
First, the delay applies to when you must be compliant, not to what compliance requires. The substantive obligations, the conformity assessments, the technical documentation, the human oversight requirements, none of that is changing. You will still need to meet them. The only question is when.
Second, the transition provisions matter. Systems placed on the market before the compliance deadline get some protection, but only if they do not undergo “significant change.” If you deploy a high-risk system now and then modify it substantially, you may find yourself caught by the full requirements earlier than you expected.
Third, and most importantly, the market is not waiting. Customers, particularly enterprise customers, are already asking about AI Act compliance in procurement processes. Being able to demonstrate that your system meets the high-risk requirements, even before you are legally required to, is a competitive advantage. Being unable to answer those questions is increasingly a disqualifier.
Stick to the Fundamentals
The delay in harmonised standards does not mean there is nothing to work with. ISO/IEC 42001, published December 2023, is the world’s first certifiable AI management system standard. It covers transparency, accountability, human oversight, data governance, and continual improvement using the familiar Plan-Do-Check-Act structure (ISO).
ISO/IEC 42001 and the AI Act share approximately significant overlaps in requirements. As ISACA puts it: the AI Act is the rulebook, ISO/IEC 42001 is the operating system that makes compliance repeatable and auditable (ISACA, December 2025). ISO/IEC 23894 provides AI risk management methodologies. ISO/IEC 22989 establishes terminology. These standards exist now and do not require Commission implementing acts to be useful.
The Bottom Line
Use the extra time to prepare, not to delay. Design your conformity assessment processes. Identify your notified body. Build technical documentation. Implement ISO/IEC 42001 as your operational foundation. Treat December 2027 as a deadline you will comfortably meet, not one you will scramble towards.
The AI Act is not going away. It is just arriving later than planned. The businesses that treat this delay as preparation time rather than holiday time will be best positioned when it lands.