The EU Just Gave You 16 More Months on AI Compliance. Do Not Spend Them.

Six days before the deadline everyone had been planning around, the EU moved it.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July and entered into force on 27 July. The high-risk obligations for standalone Annex III systems that were due on 2 August 2026 now apply from 2 December 2027. High-risk AI embedded in already-regulated products moves to 2 August 2028. The Commission's stated reason was that the harmonised standards from CEN and CENELEC were not finished and the conformity assessment infrastructure the Act assumes would exist had not matured.

I have had four separate conversations about this since it landed, and three of them opened with some version of "so we can push the governance work to next year."

You can. I would not.

What did not move

The delay was targeted, not general. Two things stayed exactly where they were, and both took effect on 2 August 2026.

Article 50 transparency applies now. If a person is interacting with an AI system, they have to be told, unless it is obvious to a reasonably observant person. Synthetic audio, image, video, and text has to be machine-readable and marked as artificially generated. Deepfakes have to be disclosed. Emotion recognition and biometric categorisation systems have to inform the people subject to them.

Article 4, the AI literacy duty, also applies. Providers and deployers have to take measures to ensure the people operating their AI systems have a sufficient level of understanding of what those systems do. That has been in force since February 2025 and nobody delayed it.

So read the actual shape of this. The obligations that were postponed are the ones that need a conformity assessment ecosystem that does not exist yet. The obligations that stayed are the ones you can meet on your own, today, without waiting for a notified body.

That is not an accident, and it is not an invitation to stop.

The parts that apply to agents specifically

Most of the discussion about the AI Act still assumes a model that scores something. An agent is different in ways the Act cares about.

An agent takes multiple steps. It calls tools. It reads data it was not explicitly handed. It decides, in the middle of a run, to do something nobody wrote down in advance. When you go to explain a decision six months later, you are not explaining one inference. You are explaining a chain.

Three obligations get materially harder because of that.

Article 12 requires automatic logging over the lifetime of the system, at a level that lets you trace how an output was produced. For a classifier that is one record. For a twelve-step agent that read three internal systems and wrote to two, it is a per-step record with inputs, tool calls, and the state the agent was carrying at each hop. If you did not build that from the start, you cannot reconstruct it later. The runs are gone.

Article 14 requires effective human oversight, including the ability for a person to intervene or interrupt the system. In agent terms that is a stop button that works mid-run, and a design where stopping does not leave a half-finished transaction in a downstream system. Most agents I review can be killed. Far fewer can be stopped safely.

Article 9 requires a risk management system across the lifecycle. Autonomy pushes you toward stricter classification, not away from it, because the risk surface includes the things the agent might decide to do rather than only the things it was asked to do.

None of that is due until December 2027 for Annex III systems. All of it takes longer than you think.

Whether you are even in scope

Worth being precise here, because a lot of teams assume they are covered when they are not, and a few assume they are clear when they are very much not.

Annex III covers standalone systems used in biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services including credit scoring and life and health insurance pricing, law enforcement, migration and border control, and the administration of justice.

An agent that screens CVs is in scope. An agent that assigns shifts, scores performance, or influences promotion decisions is in scope. An agent that determines creditworthiness is in scope. An agent that routes support tickets about a shipping delay is not, and does not need to pretend it is.

Two things trip people up. The first is that being a US company does not put you outside the Act. If the output is used in the EU, you are in. The second is that in a chain of agents, the compliance boundary follows the function. If a supervisor agent delegates the actual employment-relevant judgment to a subagent, that subagent is performing a high-risk function and the classification does not disappear because it was two hops down.

Why 16 months is less than it sounds

Here is the arithmetic that makes me nervous on behalf of the teams treating this as breathing room.

The harmonised standards are not out yet. When they land, everyone reads them at once, and everyone discovers the same set of gaps at the same time. The notified bodies doing conformity assessments are a finite resource, and the queue in the six months before 2 December 2027 will be worse than the queue now, which is already thin.

Meanwhile the technical work is not paperwork. Adding per-decision logging to an agent that was built as a single opaque loop means changing the loop. Adding a stop button that leaves the system in a consistent state means making your tool calls idempotent and your steps resumable, which is real engineering, not a config flag. Producing the risk documentation means somebody has to actually enumerate what the agent can do, which most teams have never written down.

I have watched a client spend eleven weeks retrofitting audit trails into a document processing agent that had been running happily in production for a year. Eleven weeks, for something that would have been about four days of work if it had been designed in at the start. The agent worked fine. It simply could not explain itself, and there was no cheap way to make it.

The part that is not about compliance at all

The thing I keep telling people, and the reason I do not think of this as regulatory overhead, is that the Article 12 and Article 14 requirements describe an agent you would want anyway.

Per-step logs with inputs, tool calls, and carried state is what you need to debug a bad run. It is also what you need to build an eval set, because your eval set should be made of real production traces, and you cannot harvest traces you did not record. Cost attribution comes off the same data. So does the answer to "why did it do that", which is the single most common question anyone asks about an agent after it goes live.

A working stop button is what you need the first time an agent starts doing something expensive and wrong at two in the morning.

Documented scope, the list of what the agent is allowed to do and what it must never do, is the same list you need for your permission model. It is also the list that keeps a prompt injection from turning a support agent into a refund machine.

Every serious agent team I know builds these three things eventually. They usually build them the week after an incident. Building them because a regulation names a date is not worse than that, it is just calmer.

What I would do between now and December 2027

Start with classification, not controls. Take an hour, list every AI system running or planned, and mark each one against Annex III. Most organisations discover two things: they have more systems than the inventory says, and only a handful are actually high-risk. That handful is where the money goes. Everything else needs the Article 50 disclosure and nothing more.

Then close the transparency gap this quarter, because it is already live. Every customer-facing agent needs a clear disclosure that it is an AI system. Every piece of generated content that goes out needs to be marked machine-readably. This is the cheapest compliance work in the whole Act and it is the work that is enforceable right now.

Then instrument for Article 12 on the next thing you build, rather than going back through everything at once. Retrofit is expensive. Building it in is nearly free. If you set the standard on new agents now, the retrofit backlog stops growing while you work through it.

Then design the stop. Pick your highest-value agent and answer one question: if someone hits stop at step seven of twelve, what state is the world in? If the answer is "we do not know", you have found the work.

And keep the AI literacy duty in mind, because it is quietly the one people forget. The staff operating these systems need to understand them well enough to exercise the oversight the Act assumes. That means training that is specific to your systems, not a generic AI awareness module.

The wider point

The Commission delayed the high-risk rules because the ecosystem was not ready. That is an honest reason and it was probably the right call. What it does not mean is that the underlying analysis changed. Agents that make consequential decisions about people are going to be regulated, in the EU and eventually elsewhere, and the requirements are going to look like risk documentation, logging, and human oversight, because there is no other plausible shape for them to take.

The teams that will be fine in December 2027 are not the ones that start in September 2027. They are the ones already building agents that can explain themselves, because that turns out to be the same thing as building agents that work.

If you are trying to work out which of your systems are in scope, or you are looking at an agent in production that cannot currently produce an audit trail, that is a conversation we have a lot. Get in touch and we will walk your architecture with you.