For two years, compliance teams inside European banks and insurers built their calendars around one date: 2 August 2026. That was when the EU AI Act’s high-risk tier was supposed to start biting for the two use cases that matter most to finance: AI that scores creditworthiness, and AI that prices life and health insurance. Both sit in Annex III of the Act, points 5(b) and 5(c). Both carry the full weight of the high-risk regime: risk management systems, data governance, human oversight, logging, conformity assessment, and registration in an EU database.
That date is gone. On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, the “Digital Omnibus on AI.” It entered into force on 27 July. Its headline move: the standalone high-risk obligations under Annex III now apply from 2 December 2027, not August 2026. AI embedded in regulated products under Annex I gets even longer, until 2 August 2028.
Sixteen extra months. Across Europe, program managers exhaled.
They should not have.
The deferral is surgical, and most of the Act is still live
Read the Omnibus carefully and the reprieve narrative falls apart. The Commission did not pause the AI Act. It moved one tier of it, and left everything else exactly where it was.
The prohibitions in Article 5, the ones that ban social scoring, certain biometric categorisation, and manipulative systems, have been enforceable since 2 February 2025. They did not move. The obligations on general-purpose AI models, the governance architecture, and the penalty regime went live on 2 August 2025. They did not move. And the transparency duties in Article 50, which require that AI-generated content and AI interactions be disclosed, took effect on 2 August 2026 exactly as scheduled. Providers of generative and general-purpose models placed on the market before that date got a short extension, to 2 February 2027, to comply with Article 50(2). That is a matter of weeks, not the sixteen months the high-risk headline advertised.
So the picture for a European lender or insurer running AI is not “nothing until December 2027.” It is this: the prohibited-practice floor already applies to you. If your models touch general-purpose systems from an upstream provider, the GPAI obligations already apply to that provider, and the documentation you need from them is already due. If any of your customer-facing AI generates text, images, or interacts with a person, the Article 50 disclosure duty already applies to you now.
The firms most exposed are the ones that treated 2 August 2026 as a single cliff and, when it slipped, filed the whole AI Act under “later.” They have quietly deprioritised a live obligation set. The penalties do not wait for December 2027. A breach of Article 50 sits in the middle enforcement tier: up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher. The prohibited-practice tier is higher still, at 35 million euro or 7 percent. Those numbers are collectable today.
The split deadline is the real trap for finance
The more subtle problem is the fork the Omnibus created between two dates. Standalone high-risk systems come into scope on 2 December 2027. AI embedded in regulated products comes into scope on 2 August 2028.
For most sectors that distinction is academic. For financial services it is a live sorting problem, because the same model can land on either side of the line depending on how it is packaged.
Consider a creditworthiness model. Sold or deployed as a standalone scoring engine, it is an Annex III system, and its deadline is December 2027. Now embed the identical model inside a regulated product, and the analysis shifts toward the Annex I product-safety track and the later 2028 date. Insurance is worse. A risk-pricing model for a term life policy is Annex III point 5(c), December 2027. Fold the same pricing logic into an insurance-based investment product that already carries its own EU product regime, and the classification argument gets harder, and the timeline potentially moves.
The result is that two teams inside the same firm, running what is functionally the same machine-learning pipeline, can end up with compliance deadlines eight months apart, determined not by how risky the model is but by how the legal wrapper is drawn. That is an invitation to arbitrage, and supervisors know it. The gap will not be read charitably. Firms that use the packaging to buy the later date are betting that a national competent authority, staring at an identical model on the standalone side, agrees the wrapper changes the risk. That is a bet made in a documentation trail, and it has to be built now, not in 2027.
This was a political retreat, and it changes the base case
Strip away the mechanics and the Omnibus is a signal. The Commission, under sustained pressure from industry and from a US administration hostile to European tech rules, blinked on the hardest, most contested tier of its flagship AI law. It did not touch the parts that were already collecting political capital. It moved the part that was about to impose real cost on real businesses, and it moved it past the current Commission’s own comfortable horizon.
That matters for planning because it changes the base rate. Before July, the rational assumption was that the high-risk regime would arrive on schedule and be enforced. After a sixteen-month deferral delivered under pressure, the honest assumption is that a further slip, a further carve-out, or a quiet narrowing of Annex III is now inside the range of outcomes. The law firms tracking this are already noting that the Omnibus did not only defer deadlines; it also adjusted scope and added new provisions. A regime that can be reopened once can be reopened again.
The trap for a compliance leader is to price that uncertainty as a reason to slow down. It is the opposite. The obligations already in force are certain and enforceable. The December 2027 deadline is fixed and finite, sixteen months is one budget cycle and one model-governance overhaul, not a comfortable runway. And the political fragility of the high-risk tier is not a reason to under-build; it is a reason to build the parts that will survive any renegotiation, which are precisely the data-governance, documentation, and human-oversight foundations that every version of the regime will keep demanding.
The August cliff did not disappear. It moved, narrowed, and split in two. For the AI systems that decide who gets a loan and what a policy costs, the deferral is the easy part of the story to read. The rest of it, the live obligations, the packaging fork, and a deadline that is now negotiable in principle, is where the work actually is.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.