Congratulations, Brussels Gave You an Extension. You Will Waste It.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was signed in Strasbourg on July 8, 2026, published in the Official Journal on July 24, and entered into force on July 27. It moved the AI Act high-risk application dates to December 2, 2027 for standalone Annex III systems and August 2, 2028 for systems embedded in products already covered by EU product-safety law.

Programs that were sprinting in June went quiet in August. That is the predictable response and it is the wrong one, for a reason the regulation states out loud.

Read the reason they gave you

Recital 40 explains the deferral: harmonised standards, common specifications and guidance are late, and national competent authorities are not fully stood up. Neither of those is a problem you can solve, and neither of them reduces your workload by a single system.

Think about what that means in practice. The standards will land at some point between now and late 2027. When they do, you will have less time to build against them than you would have had if they had arrived on schedule, because the deadline moved by sixteen months and the standards will not have. The extension is not slack. It is a delay in the specification with a delay in the deadline attached, and those two delays are not the same length.

Two smaller details in the same regulation are worth more attention than the headline. The deferral covers Chapter III, Sections 1 to 3, with the exception of Article 6(5). Summaries that say "high-risk obligations are deferred" are dropping that carve-out. And the Annex I leg did not move off August 2026 at all. It moved from August 2, 2027 to August 2, 2028. Only the Annex III leg came off the August 2026 date. If your compliance calendar says otherwise, it was built from a secondary source.

December 2, 2026 is the date nobody has in the plan

Two obligations land in about fifteen weeks.

The first is Article 50(2). Transparency and content-marking duties were not deferred and applied from August 2, 2026. The Omnibus inserted a new Article 111(4) giving providers of systems that generate synthetic audio, image, video or text and were placed on the market before August 2, 2026 until December 2, 2026 to comply with the marking requirement. Recital 38 calls it a four-month transitional period. It is the only relief granted on Article 50, and it applies to legacy systems only.

The second is a pair of new prohibited practices. The Omnibus added Article 5(1)(ba) and (bb), covering non-consensual intimate imagery and child sexual abuse material, and set them to apply from December 2, 2026 rather than February 2025. So the common line that "the Article 5 prohibitions have applied since February 2025" is now true of the original eight only. If your organization operates any generative capability with weak output controls, that is a prohibited-practice question with a near-term date on it, not a 2027 question.

What to do with sixteen months

1. Classify before you document. The long pole was never the paperwork. It is deciding whether each system falls inside Annex III, which requires knowing what the system does, who it affects, and what decision it influences. Legal cannot answer that from the outside. It needs an inventory that reflects what is actually running, and building that inventory is a security and engineering exercise, not a compliance one.
2. Screen the estate now and count what you cannot classify. Run every system in the inventory against the Annex III categories and sort into three buckets: clearly in scope, clearly out, and cannot answer without asking someone. The third bucket is your project. It is also the only honest estimate of scope you will get, and it takes days rather than quarters.
3. Put the near dates in the plan, not the far one. December 2, 2026 for Article 50(2) legacy marking and the two new prohibitions. Then work backwards from December 2, 2027 for Annex III. A plan with one date on it at the far end is a plan that starts in month fourteen.
4. Track the standards, and treat their arrival as the real trigger. When harmonised standards and common specifications publish, the conformity work becomes concrete and the remaining window becomes visible. Assign someone to watch for them. That is a low-cost assignment with a high-cost failure mode.

The Monday morning version: open the AI inventory, screen each system against Annex III, and count the ones you cannot classify without asking a question. That number is the size of the project the extension did not shrink.

Sixteen months is enough time to do this properly and roughly six weeks short of enough time to do it badly in a panic. Both outcomes are still available.\

This is a reading of Regulation (EU) 2026/1744 and the consolidated AI Act, not legal advice. Every article and date above is worth checking against the Official Journal text, and the classification questions are worth putting to counsel rather than resolving from a blog post.