The AI Act Deadline Moved. The Exposure Didn't.
Edition 20 — Why boards should treat the AI Act's deferral as borrowed time to govern, not permission to stand down.
For two years, 2 August 2026 sat in compliance plans as the date when the EU AI Act’s main obligations would take effect. Then, weeks before it fell due, the calendar was rewritten. The European Parliament endorsed the simplification package on 16 June, the Council gave its final approval on 29 June, and the final act was signed on 8 July; it now awaits publication in the Official Journal, entering into force three days later. The headlines have settled on one word: delay. In a good number of boardrooms, the practical translation will be “stand down”, with budgets released, programmes re-phased without ceremony, and the topic dropped from the risk committee’s autumn agenda. That translation is wrong, and the ways in which it is wrong are precisely the ones that surface in an enforcement file two years later. What the omnibus actually did was sort the company’s AI estate into four buckets with four different dates, and a board that hears only “delay” is now misinformed about three of them.
What moved, and what did not
The genuine deferral applies to high-risk AI systems. Obligations for standalone high-risk systems under Annex III move to 2 December 2027, and for AI embedded as safety components in products governed by sectoral EU safety legislation, to 2 August 2028. That is real headroom, and for organisations that were behind, which was candidly most of them, it is welcome. What did not move is Article 50. The transparency obligations still apply from 2 August 2026, largely untouched by the omnibus, with one exception: generative systems already on the market before that date have until 2 December 2026 to comply with the machine-readable marking duty. The penalties for transparency breaches reach €15 million or 3% of worldwide turnover, and UK businesses serving EU users are in scope. Nor was the omnibus purely a loosening: it added two new prohibitions to Article 5, covering AI-generated non-consensual intimate imagery and child sexual abuse material, and handed the AI Office significantly expanded supervisory powers. A board briefed that “the AI Act has been delayed” has been briefed on roughly a third of what happened.
Where your systems now sit
The four buckets become concrete the moment you place a typical portfolio into them. The customer-service chatbot lands on 2 August as planned: systems that interact directly with people must be designed so that those people know they are dealing with a machine. The marketing team’s generative tools, the ones producing campaign imagery, video, and published copy, carry the marking duty, with the grace period to December only where the system was on the market before August. The deployment of emotion recognition or biometric categorisation carries a live duty to inform the people exposed to it, and a director should remember that emotion recognition in the workplace was prohibited outright in February 2025; anyone assuming that “delay” reached that far is wrong in the worst available way. The HR estate is the headline beneficiary: tools used for recruitment, candidate selection, performance evaluation, worker monitoring, and promotion or termination decisions are high-risk, and their obligations now arrive in December 2027, with credit scoring on the same schedule. AI inside regulated products (medical devices, machinery, and vehicles) has the longest runway, to August 2028. And the honest counterweight is that most of the estate carries no new obligations at all: the Act imposes nothing on minimal-risk systems, which include internal copilots, meeting summarisers, and spam filters that make up the bulk of most organisations’ AI use. Four buckets, four dates, one of them a fortnight away. That is why “the AI Act is delayed” is a dangerous sentence in a boardroom.
Why Brussels moved
The reason for the deferral matters because it kills the comfortable reading that the EU retreated on substance. The Commission proposed the omnibus after the Act’s implementation fell behind: harmonised standards were not ready, national competent authorities were not designated, and the compliance tools companies would need to demonstrate conformity did not exist. The deferral aligns the application of the rules with the availability of the systems and structures needed to support them; it does not diminish the underlying obligations. A director should read that plainly. The obligations were postponed because the infrastructure for meeting them was late, including, in most companies, the internal infrastructure: the inventory of AI systems, their classification against the Act’s categories, and the data governance beneath them. The work that was behind schedule in June is the same work that will be due in December 2027, and the extra time changes when it falls due rather than whether it does.
The two traps in the extra time
The first trap is what I would call the deferral dividend. Compliance budgets and risk-committee roadmaps were approved against 2 August 2026, and a programme re-phased across sixteen additional months is a materially different plan: a different spend profile, different resourcing, and a different risk position. The temptation, in a year when every cost line is under pressure, is to bank the difference, release the budget, redeploy the people, and let the programme drift to a start date comfortably beyond the next planning cycle. A board that allows this has not approved a revised plan; it has silently unapproved the original one. The second trap is the grandfathering catch. High-risk systems already on the market before the new application dates remain outside the rules only for as long as their design remains substantially unchanged, and the threshold for a “significant change” has not yet been defined. Every model upgrade, retraining, and vendor version bump between now and 2027 is a potential trigger, and the organisations most exposed are the ones that stopped maintaining their AI inventory the day the deferral was announced, because they will not know which systems changed, or when.
Three decisions before the summer break
None of this requires a special committee or a consulting engagement; it requires three decisions at the next scheduled meeting. First, the board should ask for written confirmation of what remains live on 2 August: which systems carry Article 50 duties, who owns each one, and whether contracts signed before that date allocate the duties between provider and deployer, since the obligations are independent of the UK regime and satisfying one does not discharge the other. Second, it should require the re-phased compliance programme to come back for formal approval rather than arriving as a verbal update, with the spend, resourcing, and milestones restated against the new dates. Third, it should ring-fence the deferral window for the unglamorous foundations of inventory, classification, and data governance rather than releasing the budget, because that work is the prerequisite for both the December 2026 marking duty and the 2027 deadline, and it is the work whose absence caused the delay in the first place. For UK boards, there is a supplementary point: there is no domestic equivalent statute, but the FCA, ICO, and Ofcom apply existing sector duties to much of the same conduct, so a single governance programme, run properly, serves both regimes at little marginal cost.
The omnibus is best understood as a test the EU did not intend to set: whether a board governs to the calendar or to the risk. The calendar has become more forgiving, while the exposure that mattered in June sits exactly where it was: the ungoverned systems, the unallocated duties, the inventory nobody maintains.
If this is the kind of analysis you want arriving before the deadline rather than after it, subscribe to AI in the Boardroom. I write for directors, executives, and advisers who need to know what a regulatory headline actually changes: which obligation, which date, which decision. The gap between what happened in Brussels this month and what most boards will be told about it is the reason this publication exists.