The one-line version: the EU AI Act's high-risk obligations did not take effect on August 2, 2026. The Digital Omnibus deferred standalone Annex III duties to December 2, 2027 and pushed high-risk AI inside regulated products to August 2, 2028. The part that did go live on August 2 is the Article 50 transparency layer — chatbot disclosure and AI-media labeling — and for most solo builders that is the only piece to act on today.
If you read one thing this week about EU AI regulation, read that paragraph. The rest of this piece is why the confusion happened and what to do with it.
1. The mistake half the internet made#
Go back to the original 2024 timeline and August 2, 2026 was a genuinely big date: obligations for standalone high-risk systems — the Annex III list covering hiring, credit, insurance, education, and access to essential services — were supposed to start applying. So when the calendar flipped to August, a wave of posts announced that high-risk conformity assessment was now the law.
It isn't. Between that timeline being set and August arriving, the EU ran the Digital Omnibus — a simplification package the European Commission launched in late 2025 — and moved the deadline. The Council gave final approval on June 29, 2026 (Morgan Lewis, Gibson Dunn). Anyone still citing "August 2, 2026" for high-risk is reading a pre-Omnibus map.
2. What actually moved — and what didn't#
Two different regimes shared the August 2 date, and the Omnibus split them apart.
- High-risk (Annex III, standalone): deferred from August 2, 2026 to December 2, 2027 — a roughly 16-month slip.
- High-risk (Annex I, embedded in already-regulated products): deferred to August 2, 2028.
- Article 50 transparency: unchanged — it took effect August 2, 2026 as planned.
That last line is the one the panic obscured. As Jones Walker put it, "Yes, August 2 Still Matters": the EU approved a high-risk delay, but the transparency duties stayed live. The clock moved on the hard part; the easy, universal part is already binding.
3. Are you even in scope for the high-risk regime?#
Most people worrying about December 2027 don't have to. The Annex III high-risk list is specific. You are in scope if your system makes — or materially informs — a consequential decision in one of these domains:
- Employment / worker management — CV screening, candidate ranking, performance or promotion scoring.
- Creditworthiness — credit scoring or lending decisions (consumer credit).
- Insurance — risk assessment and pricing for life and health insurance.
- Education — admissions, placement, or exam evaluation.
- Essential services — access to public benefits and essential private services.
- Plus biometrics, critical infrastructure, law enforcement, migration, and the administration of justice.
A marketing copy generator, a coding assistant, a customer-support chatbot, an internal analytics agent — none of those are Annex III high-risk. If that's you, the December 2027 story is not your story. Your only EU AI Act obligation today is transparency, which we walk through in the Article 50 founder checklist and, for the disclosure specifics, what a solo founder actually has to ship.
4. If you are in Annex III: the delay is runway, not a reprieve#
Here's the trap in a 16-month extension: it reads as "later," and "later" quietly becomes "never started." The substance of the high-risk regime did not soften — the Omnibus moved the date, not the bar. When December 2, 2027 arrives you will still owe the full stack: a risk-management system, data governance, human oversight you can evidence, technical documentation, and a conformity assessment. A conformity file is not a week's work, and it is materially harder to assemble backward from finished systems than to accrue as you build.
The reason the EU moved the date at all is instructive: the harmonized standards, guidance, and conformity-assessment infrastructure were not ready in time, so the obligations would have bitten before anyone could realistically comply (Travers Smith). Use the same 16 months the regulators took to get their machinery ready: stand up your documentation habit now, while the systems are small, rather than reconstructing it under a 2027 deadline. For the agent-specific reading of these duties, see the EU AI Act for AI agents.
5. The founder move, in one screen#
- Run the Annex III test honestly. Job, credit, insurance, education, essential services? If no — stop tracking December 2027.
- If you have EU users, ship Article 50 today. Chatbot disclosure + machine-readable labels on generated media. It's live, it's short, it binds you now.
- If you're in an Annex III domain, treat 16 months as build time. Start the risk-management and documentation trail this quarter; don't rediscover it in late 2027.
The headline "EU high-risk AI rules are now in force" was wrong. The quieter truth is more useful: the hard deadline moved to December 2, 2027, the transparency floor is already under your feet, and the only mistake that costs you is treating a delay as a dismissal.
