High Risk Deadline

This page explains how the site’s own articles describe the high-risk deadline. It is not legal advice. Dates have moved before and may move again, so confirm the current position with a qualified adviser before relying on any one of them.

What the High-Risk deadline is

The high-risk deadline is the date from which the EU AI Act’s obligations for high-risk AI systems apply. The site’s review of the EU AI Act and GDPR reports that the Digital Omnibus on AI moved that date. It was formally adopted in 2026 and is in force as Regulation (EU) 2026/1744.

The word “deadline” can mislead. It is the date from which duties apply, not a date by which a business has to have filed something. What it means in practice depends on whether a business uses a high-risk system at all, which is why classification matters more than the date.

Which dates moved

The review reports two moves.

• Annex III, stand-alone high-risk systems: from 2 August 2026 to 2 December 2027. Annex III includes employment and recruitment uses.
• Annex I, high-risk AI embedded in regulated products: from 2 August 2027 to 2 August 2028. The small-business article gives machinery and medical devices as examples, and the governance article describes the extension as being to August 2028.

The governance article calls the Annex III change a sixteen-month extension. Both articles are firm that the classification did not change. The Omnibus changed when the duties start, and not what counts as high-risk.

Which dates did not move

Several things stayed where they were, and the review and the small-business article agree on them.

• The banned practices and the AI literacy duty have applied since 2 February 2025. The small-business article says the Omnibus softened the literacy wording to supporting the development of AI literacy, but that the duty remains. The AI literacy page covers it.
• The penalty rules have applied since 2 August 2025, which the small-business article says means a national authority can already enforce the first two.
• Most of the Article 50 transparency rules apply from 2 August 2026, according to the small-business article. That includes telling people when they are interacting with an AI system.

The small-business article also lists two items for 2 December 2026: a grace period for the machine-readable marking duty on generative systems already on the market, which falls on providers, and new bans on systems that generate non-consensual intimate imagery or child sexual abuse material. It lists that date as upcoming.

A timeline of the EU AI Act dates

The small-business article gives the full table, and this is its content in short.

The article’s own caution is that dates have moved once and could move again. That is the reason to check the current position before relying on any single date, and the status column should be read the same way.

What the delay means for a Small Business

The governance article says the Act draws its line at what the AI is used for, not at company size. A small organisation deploying AI for a use the Act classes as high-risk carries the same core obligations as a large one, whatever its headcount or turnover. The delay moves when those obligations apply to it, not whether they do.

The ownership article puts the delay in proportion. It says this is not an urgent duty for everyone, because most everyday tools are not high-risk and the Act does not ask a business to appoint someone for every chat assistant. Drafting, summarising and internal search sit outside the category. Recruitment and candidate screening sit inside it, which is the case most small businesses meet. The recruitment AI page covers it.

Why the delay is not a removal

The review says commentators stress that the delay changes when duties bite, and not what is classed as high-risk. Its reading is that businesses have more time to prepare for high-risk obligations, not permission to ignore them.

The governance article says the same in its own words: the extension buys time and eases paperwork, but it does not remove the requirement to classify a use case correctly and manage the risk it carries. The high-risk AI system page explains what the class means, and the documentation obligation page covers the record that goes with it.

The ownership article points to a quieter reason not to wait. Each deployer duty presumes a person. Monitoring needs someone monitoring, and oversight needs someone assigned. A business that has not decided who that is will find the deadline arriving without an answer. The deployer page lists the duties.

The simplified route for Small mid-cap companies

The governance article reports that, alongside the delay, a simplified compliance framework was extended to qualifying small mid-cap companies, which it defines as organisations with fewer than 750 employees and below certain turnover or balance sheet thresholds. The article says this eases the documentation burden for firms in that band, and the small-business article reports the same extension of relief.

Neither article says the framework removes the obligation. The governance article’s reading is that the extension and the simplified route change the timeline and the paperwork, not the substance of the duty. Whether a particular business qualifies is a question for an adviser, and this page does not decide it.

What to do before the date arrives

The small-business article’s advice is to use the extra time to find and classify AI uses and not to ignore them, and to put the high-risk cases to a qualified adviser before December 2027. It gives a decision path of three questions for any use. Does it infer how staff or applicants feel? Does it feed into deciding who is hired, promoted, monitored or paid, or who gets credit or insurance? Is it a chatbot, or does it publish AI-generated content? A use that fits none of them is minimal risk, and only the AI literacy duty applies.

The governance article adds the practical order: inventory what is in use, classify each use by what it does, name a person and a checkpoint for the uses that carry the most risk, and check each use against the Act and GDPR together. The risk classification page covers the sorting.

The recruiting article makes a related point about choosing tools. A tool that already supports logging, explanation and human override saves a rushed change later, and the notes kept while testing a tool are the start of the record a deployer is expected to hold.

A worked example

An illustration, not a case study. A small business has used an AI tool to draft emails for some time and is considering a second tool that scores job applications.

The owner lists both and runs each through the three questions. The email tool is a drafting use, so it is minimal risk and only the AI literacy duty applies, which the business already supports with a short session. The scoring tool feeds into deciding who is hired, so the owner treats it as high-risk and puts it to an adviser.

The owner notes the dates as the site’s articles give them: the high-risk rules for this kind of system start on 2 December 2027, moved from 2 August 2026, and an adviser should confirm that when it matters. The business does not read that as permission to wait. It names one person as owner of the scoring tool, asks the vendor what its documentation covers and what logs it keeps, and writes a one-page record. When the date approaches, the business is deciding whether to keep the tool and not working out who is responsible for it.

Mix-ups worth avoiding

Four confusions come up often enough to name. The first is treating the delay as a removal, when both articles say it changes the timeline and not the obligation or the classification. The second is assuming the deadline applies to every AI tool, when most everyday use sits outside the high-risk category. The third is treating a single date as the whole picture, when other duties have applied since 2 February 2025 and 2 August 2025 and others start on 2 August 2026 and 2 December 2026. The fourth is relying on a date without checking, when the articles say dates have moved before and may move again.

How we use it

The ownership article treats the date as a reason to decide who owns each high-risk use now: a business that has not decided will find the deadline arriving without an answer. The deployer page lists the duties that follow. EU AI Act and GDPR obligations are checked as part of how we audit.

If you would like an outside view on which of your AI uses might be high-risk and what each carries, a discovery call is a quick way to start. An audit is a diagnostic and not a legal opinion, so it identifies the obligations without certifying them.

Sources

• EU AI Act vs GDPR: the Annex III and Annex I dates, the Omnibus and its regulation number, the dates that did not move and the delay as a delay and not a removal.
• What the EU AI Act requires of a small business: the full timeline, the penalty and transparency dates, the 2 December 2026 items, the three-question decision path and the advice to use the extra time.
• AI governance for small and mid-sized businesses: the sixteen-month extension, the Annex I extension, the simplified route for small mid-cap companies and classification by use.
• What happens when nobody owns the AI you have rolled out: not an urgent duty for everyone, and each duty presuming a named person.
• Best AI for recruiting: choosing a tool that already supports logging, explanation and human override.
• High-risk AI system, EU AI Act, Risk classification, Deployer, Recruitment AI, Documentation obligation, AI literacy and AI ownership: the neighbouring terms this page links to.