Executive briefing: EU AI Act
The EU AI Act Deadline Has Moved: What Boards Must Do Before December 2027
Yes, the EU AI Act has been partly delayed. The Digital Omnibus on AI moved the deadline for most high-risk AI systems from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI built into regulated products. The bans, the general-purpose AI rules and the Article 50 transparency duties were not delayed. The deadline moved. The obligations did not.
Correct as of 25 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- High-risk AI (Annex III) now applies from 2 December 2027. AI in regulated products (Annex I) from 2 August 2028.
- Banned practices (since February 2025), general-purpose AI rules (since August 2025) and Article 50 transparency (since August 2026) already apply.
- The Act follows the market, like GDPR. UK and US companies selling into the EU, or whose AI output is used there, are in scope.
- Using AI to screen candidates, manage staff, assess credit or price life and health insurance is high-risk, even when it sits inside a vendor platform.
- Five board actions: find it, classify it, fix what is live now, plan for December 2027, and govern it.
Why the board should care
Fines at GDPR scale, or higher
Up to EUR 35 million or 7% of global annual turnover for banned practices, and up to EUR 15 million or 3% for many other breaches, whichever is higher.
EU revenue depends on it
EU customers will expect evidence of compliance in contracts and procurement. Without it, deals stall or go to a competitor who can show it.
Late discovery is expensive
A high-risk system found in autumn 2027 may need to be rebuilt, re-procured or switched off. Finding it now costs a fraction of that.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The video briefing
- The full written briefing
- Who it applies to, and who it does not
FAQ
Frequently asked questions
Has the EU AI Act been delayed?
In part. The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force from 27 July 2026, moved the obligations for high-risk AI systems listed in Annex III from 2 August 2026 to 2 December 2027, and those for AI in products regulated under Annex I to 2 August 2028. The bans on prohibited practices, the general-purpose AI rules and the Article 50 transparency duties were not delayed.
Does the EU AI Act apply to UK companies?
Yes, if they supply an AI system to the EU market or the output of their AI system is used in the EU. It follows the market, not the head office, much as GDPR does.
Does the EU AI Act apply to US companies?
The same test applies. A US company that places an AI system on the EU market, or whose AI output is used in the EU, is in scope wherever it is headquartered.
Does the EU AI Act apply to small businesses?
Yes. There is no general exemption for small and medium-sized businesses. SMEs get some simplified documentation and, for fines, the lower of the two amounts applies, but the obligations are the same. What decides whether a business is caught is how it supplies or uses AI, not its size.
Who is exempt from the EU AI Act?
The Act does not apply to AI used only for military, defence or national security purposes, AI developed and used solely for scientific research and development, research and testing before an AI system is placed on the market (real-world testing is not exempt), or individuals using AI for purely personal purposes. Free and open-source AI is largely outside it unless it is high-risk, banned or covered by the Article 50 transparency duties. A UK or US business whose AI and its output never reach the EU is generally outside it too.
What is Article 50 of the EU AI Act?
Article 50 sets transparency duties that have applied since 2 August 2026. People must be told when they are interacting with an AI system, and AI-generated or manipulated content must be marked or disclosed as such.
What are the fines under the EU AI Act?
Up to EUR 35 million or 7% of global annual turnover for banned practices, up to EUR 15 million or 3% for many other breaches, and up to EUR 7.5 million or 1% for supplying incorrect or misleading information to regulators. The higher figure applies, except for SMEs, where the lower one does.
What should a board do about the EU AI Act now?
Five things: find every AI system in use, classify each by risk tier and role, fix the obligations that already apply, plan each high-risk system for December 2027, and name an accountable board owner with a quarterly report.
Correct as of 25 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 25 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing is general information about the EU AI Act as amended by Regulation (EU) 2026/1744, correct at the date last reviewed. It is not legal advice. For decisions about specific AI systems, take advice from a qualified lawyer.