EU delays AI Act 'high‑risk' compliance deadlines to Dec 2027 (standalone) and Aug 2028 (ecosystem)

The EU just blinked on the hardest part of its AI law. Not the headline bans — those mostly stay. The real change is timing and scope for “high-risk” systems, which is where the expensive compliance work lives. On May 7, the European Parliament and Council reached a provisional deal to delay those obligations and clean up a mess around industrial products and machinery. (consilium.europa.eu) ### What actually moved? Two dates. Stand-alone high-risk AI systems now shift to 2 December 2027. High-risk AI embedded in products covered by sector safety laws — basically the industrial and product-regulation bucket — moves to 2 August 2028. Before this deal, the big high-risk rules were due to start on 2 August 2026. (consilium.europa.eu) ### What counts as “stand-alone” here? This is the Annex III side of the AI Act — systems used in areas like biometrics, critical infrastructure, education, employment, law enforcement, and border management. These are high-risk because of where they are used, not because they are built into a regulated machine or product. That category now gets the December 2027 date. (europarl.europa.eu) ### Why did the EU push it back? Basically, the compliance plumbing was not ready. The Commission’s simplification push argued that companies still lacked the standards, tools, and support measures needed to apply the rules cleanly. Lawmakers kept that logic and turned the original “up to 16 months” delay idea into fixed dates, which gives companies more certainty than a moving trigger tied to future Commission confirmation. (consilium.europa.eu) ### Why is machinery the big fight? Because manufacturers were staring at double regulation. The new deal says AI used in machinery products should comply with the sectoral safety regime instead of both that regime and a second overlapping AI Act layer, as long as equivalent health and safety protec(consilium.europa.eu) not create a health or safety risk. (europarl.europa.eu) ### Did anything get stricter? Yes — and this is the part that stops the story from being a pure deregulation move. Parliament and Council added a ban on AI systems used to create non-consensual sexual or intimate content and AI-assisted child sexual abuse material. The ban covers providers putting those systems on the EU market and deployers using them for that purpose, with compliance due by 2 December 2026. (consilium.europa.eu) ### What else changed? Watermarking obligations for AI-generated content move to 2 December 2026. The deal also restores a registration duty in the EU database for providers that claim an exemption from high-risk classification. And it allows personal data processing, under safeguards, when strictly necessary for bias detection and correction. (consilium.europa.eu) ### Is this final? Not quite. This is a provisional political agreement, so it still needs formal adoption. But the direction is now clear, and the odds of the core timeline changing again look much lower. The catch is timing — if formal adoption somehow slipped badly, companies would still have to watch the original legal calendar very closely. That uncertainty is smaller now, but not fully gone until the text is formally signed off. (consilium.europa.eu) ### Bottom line? The EU did not abandon the AI Act. It bought time for the part businesses feared most and cut duplicate rules for industrial AI. That is a real retreat from the original August 2026 pressure. But Brussels paired the softer rollout with a new hard ban on “nudifier” tools, which tells you the political line: less compliance chaos, not less appetite to police the ugliest uses of AI. (consilium.europa.eu)