AI Regulation Tracker  /  Provisional agreement

The EU Moved Its High-Risk AI Deadline, But the Penalties Still Switch On August 2, 2026

Brussels has provisionally pushed the EU AI Act's high-risk obligations to December 2027. The penalty regime, governance rules, and general-purpose AI duties were not moved. Here are the two clocks your board now has to track, and why the later one is the dangerous distraction.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published June 27, 2026  ·  Last updated June 27, 2026

The headline says relief, the calendar says otherwise

When a regulator moves a deadline, the instinct in most companies is to exhale and reallocate the team. Brussels has handed out exactly the kind of news that triggers that instinct, and it is the kind that gets boards in trouble if they read only the headline.

On May 7, 2026, the Council of the EU announced that the Council and Parliament had reached a provisional agreement on the Digital Omnibus on AI, a package that amends the EU AI Act. Its most quoted change pushes the deadline for the Annex III high-risk obligations from August 2, 2026 to December 2, 2027, per the Council of the EU (May 7, 2026). That is real, and for companies racing toward the high-risk regime it buys time. The problem is what the same package left untouched.

What did not move

The delay is narrow. The August 2, 2026 activation of the AI Act's governance and notified-body provisions, its penalty regime, and its enforcement of general-purpose AI obligations was not pushed back. Gibson Dunn (May 2026) noted that obligations like the Article 50 transparency duties largely remain on their original schedule, and that the general-purpose AI model obligations proceed unchanged from their existing timeline.

The penalty regime is the part boards should sit up for. Under Article 99 of the AI Act, non-compliance with provider and deployer obligations carries administrative fines of up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher, and general-purpose AI providers face the same 15 million euro or 3 percent exposure under the GPAI penalty provision. Those teeth do not depend on the high-risk timeline. They attach to obligations that are already arriving.

Two clocks, and the later one is the trap

The cleanest way to brief a board on this is to describe two clocks. The near clock runs to August 2, 2026 and governs the enforceable machinery: the supervisory and governance structure, the notified-body provisions, the penalty regime, and general-purpose AI duties. The far clock runs to December 2, 2027 and governs the Annex III high-risk obligations.

The trap is that the far clock is the one everyone was watching, so its movement is the news, and a board that anchors on the news will quietly let the near clock slip. That gets the sequencing backwards. The deadline that moved is the one further out. The deadlines that did not move are the ones close enough to plan against this year, and they are the ones with penalties attached.

Provisional is not the same as final

There is a second discipline this story demands, and it cuts the other way. The high-risk delay is a provisional political agreement, not finished law. The high-risk delay becomes binding only upon publication in the Official Journal of the European Union, while the governance provisions, the penalty regime (up to 15,000,000 euros or 3 percent of total worldwide annual turnover under Article 99 for provider and deployer duties), and the GPAI obligations remain on the August 2, 2026 schedule. Gibson Dunn (May 2026) is explicit that the amended dates do not bind until formal adoption and publication in the Official Journal, which is expected before August 2, 2026.

So the responsible read has a precise shape. Do not bank the relief as if it were final, because the December 2027 date only becomes real on formal adoption. And do not treat the relief as broad, because it never covered the penalties or the GPAI duties in the first place. A company that assumes the delay is both certain and total is wrong on both ends.

What a board should actually do

The work here is mostly a labeling exercise that most teams have not done. Take your EU AI Act compliance plan and sort every obligation into the August 2026 column or the December 2027 column. The August column is where the immediate risk lives: confirm you can interact with the new governance and notified-body structure, confirm your general-purpose AI duties are met, and confirm you understand where the 15 million euro or 3 percent penalty exposure could attach to your systems. The December column is where you have genuine runway, and where you can stage spend rather than rush it.

Then assign an owner to each clock. The failure mode is a single overloaded owner who naturally drifts toward whichever deadline got the most coverage, which is the one that moved. Two clocks, two owners, and a standing check with counsel on when the provisional delay becomes final. That keeps the relief from turning into a missed penalty date in the same summer it was announced.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.