The delay to the EU AI Act's high-risk rules is no longer a proposal. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. High-risk obligations for stand-alone systems now apply from 2 December 2027. That much is settled. What many boards have missed is how much of the Act already applies today.
The change is one of timing. Obligations for high-risk systems listed in Annex III move to 2 December 2027, and for AI built into regulated products to 2 August 2028. In the EU's own framing, the aim is to give organisations time to prepare while the supporting technical standards catch up. It is more runway, not a reprieve.
Three sets of duties did not move, and two of them are already in force. The Article 5 prohibited practices, which include social scoring and certain manipulative and biometric uses, have applied since February 2025. The obligations on providers of general-purpose AI models have applied since August 2025. And the Article 50 transparency duties, which require you to tell people when they are interacting with AI and to label AI-generated content, stayed on the original timeline. If you run a chatbot, generate synthetic media, or build on a foundation model, you have obligations now, not in 2027.
It is easy to read "the AI Act is delayed" and assume there is nothing to do. But the Act was always a sequence of staggered deadlines, not a single switch. The delay applies to the heaviest, high-risk tier. The transparency, prohibition and general-purpose model rules sit on separate clocks, and those clocks are running. Assuming otherwise is the quickest route to a compliance gap you did not know you had.
Split your systems into what is live now and what falls under the 2027 tier. For anything that talks to people, labels content, or relies on a general-purpose model, confirm your transparency and provider duties are met today. For high-risk systems, use the extra time to run a real conformity assessment rather than to defer one. A short triage tells you which bucket each system belongs in.
The date on the hardest rules moved. The rest of the Act did not. Knowing the difference is now the difference between prepared and exposed.
A fixed-price Triage sorts your systems into what is live now and what falls under 2027, and returns a Risk and Confidence Score in days.
Book a free scoping call