The EU AI Act's high-risk deadline just moved to 2027. What it means for your firm

The EU AI Act's toughest rules, the ones for "high-risk" AI that were due to apply from 2 August 2026, have just been pushed back. On 29 June 2026 the Council of the EU gave final sign-off to a simplification package that defers those obligations to 2 December 2027. If your business uses AI to help decide who gets hired, lent to, insured or granted an essential service, you now have more time. You do not have a reprieve. The duties are still coming, most small firms using everyday tools were never in the high-risk category to begin with, and the sensible move is to check whether the rules reach you at all, then use the extra sixteen months to get ready calmly.

What actually changed

On 29 June 2026 the Council of the EU gave its final green light to the "Digital Omnibus", a package that simplifies and re-times parts of the EU AI Act. The European Parliament had already approved it on 16 June. The headline change for most businesses is timing. The obligations for the high-risk AI systems listed in the Act's third annex, originally due from 2 August 2026, now apply from 2 December 2027. High-risk AI embedded in regulated physical products, a separate category, moves a year later still, to 2 August 2028.

That is a deferral of sixteen months for the rules most likely to touch a small or mid-sized firm. It is not a change of direction. The Act still stands, the high-risk duties are still detailed and demanding, and the clock is still running, just more slowly. Reading the delay as "AI rules are off" would be a mistake. The better reading is that Europe has given organisations longer to prepare properly.

Does any of this reach your firm?

Most small businesses will breathe out here. The high-risk category is narrow and specific. It covers AI used in areas like recruitment and the management of workers, access to credit and essential private services, insurance pricing and risk, education, and a handful of other sensitive uses. Using AI to draft an email, summarise a document or produce a first draft is not high-risk. Building or operating an AI system that decides who gets a job, a loan or an insurance quote is a different matter.

The test is the use, not the tool. The same model can be ordinary in one setting and high-risk in another. So the question to ask is not "do we use AI", it is "does AI help make a consequential decision about a person". If the answer is yes, the UK rules on automated decisions already apply alongside this, and you should treat the December 2027 date as your runway. If the answer is no, you are very likely outside the high-risk rules, and our earlier guide to the Act covers the lighter duties that still apply.

One point for UK readers: being outside the EU does not put you outside the Act. If your AI system is used by people in the EU, or its output is relied on there, the rules can still reach you. Geography is not the deciding factor. Use is.

What the extra time is actually for

Sixteen months sounds like a long time. It is not, if you spend the first twelve ignoring it. The firms that will find December 2027 comfortable are the ones that treat the next year as preparation, not pause.

Three things are worth starting now, whatever your size. First, map where AI touches consequential decisions in your business, even informally, so you know where the rules would land. Second, keep a human meaningfully in the loop on those decisions, with the authority and the information to overrule the machine. Third, write down what you do: which tool, on what basis, checked by whom. None of this needs a consultant or a compliance department. It needs an afternoon and the willingness to be honest about where AI already sits in your decisions.

There is also a duty that did not move. The Act's requirement that staff have a basic level of AI literacy has applied since February 2025 and is unaffected by the delay. If your people are using AI without understanding what it can and cannot be trusted to do, that gap is live now, not in 2027.

A ten-minute scope check

You can get a rough read on whether the high-risk rules reach you without a lawyer. Ask three questions about each way you use AI. Does it help make a decision about a person, rather than just draft text or crunch numbers for someone else to act on? Is that decision one that affects their access to work, money, insurance, education or an essential service? And does the AI's output carry real weight in the outcome, rather than being one minor input a person barely consults?

If the honest answer to all three is yes, that use is likely in scope, and you should treat December 2027 as a real deadline with a runway. If the answer to any of them is no, that particular use is very probably outside the high-risk rules. Run the test use by use, not tool by tool, because the same assistant can be harmless in one task and consequential in another. Write the answers down. That short note is the start of the documentation the Act expects, and it is one of the most useful hours you can spend on this before the rules bite.

One thing that did not move, and one that is new

The prohibited practices in the Act, the uses banned outright, were never part of this delay and remain in force. The simplification package also adds a new prohibition, on AI-generated non-consensual intimate imagery and child sexual abuse material, with a short transition period running to 2 December 2026. The pattern is consistent: the most harmful uses are being tightened, while the administrative weight on legitimate high-risk systems is being spread over more time.

For an ordinary business, the takeaway is reassuring but not an invitation to switch off. The lines around genuinely harmful and genuinely sensitive AI are getting clearer and firmer. The paperwork around mainstream high-risk use is getting more time. Both can be true at once.

What to do now

If you take three actions from this, make them these. Check whether any of your AI use falls into the high-risk list, honestly and specifically, rather than assuming you are either fine or doomed. If you are outside it, make sure you still meet the lighter duties: be transparent that you use AI, and ensure your team has the literacy to use it with judgement. If you are inside it, treat 2 December 2027 as a real deadline with a generous runway, and start the mapping and documentation now while it is calm.

The delay is good news for anyone who was facing an August scramble. It is only good news if it buys preparation rather than procrastination. If you would like a clear read on whether the high-risk rules reach your firm, and a simple plan for the runway, book a readiness review and we will work through it with you.