For most of the past year, compliance teams at European banks and insurers ran toward a single date: 2 August 2026, when the EU AI Act’s rules for high-risk systems were due to apply. Credit-scoring engines and insurance-pricing models sit squarely inside that tier. Then, weeks before the date, the EU moved it.
On 29 June 2026 the Council gave its final green light to the Digital Omnibus on AI, following the European Parliament’s endorsement on 16 June (Council of the EU). The package pushes the applicability of obligations for stand-alone Annex III high-risk systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products under Annex I from 2 August 2027 to 2 August 2028 (White & Case).
Sixteen extra months. For a lender that spent 2025 building a fundamental-rights impact assessment it did not have, the reflex is relief. The reflex is wrong.
The problem
Start with who the rule actually targets, because that is where most of the confusion lives.
Annex III of the AI Act names the use cases that make a system high-risk regardless of how clever the model underneath is. Point 5(b) covers AI used to evaluate the creditworthiness of natural persons or set their credit score, excluding fraud detection. Point 5(c) covers risk assessment and pricing in life and health insurance (EU AI Act, Annex III). Read literally, that is a description of the modern retail bank and the modern insurer.
The obligations do not land on whoever trained the model. They land on the deployer — the institution running the system in production under its own authority. A bank that licenses a third-party scoring engine is the deployer. An insurer that buys a pricing model is the deployer. Under Article 26, that deployer must assign human oversight to competent staff, use the system only within its declared purpose, monitor it, report serious incidents to the provider and the authority, keep logs, and — for creditworthiness and life-and-health insurance specifically — complete a fundamental-rights impact assessment. None of it can be signed away in a vendor contract (EU AI Act summary for financial services).
This is the part the “model vendors will handle it” narrative gets backwards. The general-purpose model providers already crossed their own line: GPAI obligations, governance rules, and the penalty regime took effect on 2 August 2025 (Article 113). Their clock has been running for nearly a year. The tier that just slipped to December 2027 is the deployer-facing, high-risk-system tier — the one that falls on lenders and insurers, not on the labs that shipped the weights.
The analysis
The delay is cleaner than the version first floated. The Commission’s November 2025 proposal tried to tie the postponement to a conditional trigger — high-risk rules would apply only once harmonised standards and support tools were ready. The co-legislators threw that out and replaced it with fixed dates (Gibson Dunn). That is a double-edged simplification. Firms get certainty: 2 December 2027 is the date, full stop. But they also lose the escape hatch. If the standards that are supposed to make compliance concrete slip — and harmonised AI standards have slipped before — there is no automatic relief. The date does not move again just because the toolkit is late.
There is also a gap between “agreed” and “binding.” As of early July 2026 the Omnibus has cleared both institutions but has not yet been published in the Official Journal; it enters into force on the third day after publication, expected within weeks and before August (DLA Piper). Until then, the original Article 113 text is the law, and 2 August 2026 is still black-letter. The political outcome is not in doubt. The legal instrument that makes it real is not printed yet. A firm that stands down its programme on the strength of a press release, before the amendment lands in the Journal, is betting on a formality — a good bet, but a bet.
The stakes explain why the formality matters. Breaches of Article 26 deployer duties sit in the middle penalty tier: up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99). For a large bank, the percentage is the number that bites, and it is measured against the whole group, not the AI budget.
The implications
Treat the sixteen months as build time, because that is what they are.
A fundamental-rights impact assessment is not a form filed the week before a deadline. It is a process: mapping which decisions the model touches, who it can disadvantage, what the human-oversight step actually does when it disagrees with the score, and how any of it is logged and audited. The institutions that were behind on 2 August were behind because these are organisational problems, not paperwork problems, and organisational problems do not compress. December 2027 is roughly one build cycle away, not a snooze button.
The second implication is decoupling. Lenders and insurers now run on a compliance clock that is fully detached from their model suppliers’. The vendor’s obligations are live; the deployer’s are not, for another year and a half. That asymmetry invites a tempting but hollow procurement move — leaning harder on vendor attestations to fill the gap. It does not work, because the non-transferable duties are exactly the ones a vendor cannot discharge on your behalf. Human oversight is your staff. The fundamental-rights assessment is your use case. The monitoring is your production system.
The third is that the AI Act clock was never the only clock. Credit and insurance models already sit under sectoral supervision — capital rules, Solvency II, consumer-credit law, and the GDPR’s rules on automated decisions — none of which moved because the Omnibus did. For a lender, an unexplainable scoring model was a problem on 1 August 2026 and remains one, AI Act or not.
The honest read of the delay is that Brussels blinked on timing, not on substance. The obligations are intact. The tier still targets the deployer. The only thing that changed is that lenders and insurers have been handed the one resource compliance programmes never get enough of — time — and the failure mode is to spend it as though the problem went away.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.