Earlier this year, many compliance calendars were quietly redrawn. The EU AI Act’s high-risk obligations, which were set to apply in August 2026, were pushed back through the European Union’s digital omnibus package. Plenty of teams heard the word “delay” and exhaled. That reaction is understandable, and it is also a little dangerous. Some obligations moved. Others did not.

What Moved and What Didn’t

The AI Act, Regulation (EU) 2024/1689, entered into force on August 1, 2024, and phases in its obligations over several years. Bans on prohibited practices and AI literacy duties applied from February 2025. Obligations for providers of general-purpose AI models followed in August 2025.

In May 2026, the Council of the EU and the European Parliament reached a provisional agreement on targeted amendments. The most significant change concerns standalone high-risk systems listed in Annex III, including those used for credit scoring, life and health insurance pricing, employment decisions, education, and critical infrastructure. Those obligations now begin on December 2, 2027, instead of August 2, 2026. High-risk AI embedded in products regulated under Annex I, which includes medical devices, moves to August 2, 2028. Parliament’s approval followed in June, with formal adoption expected before the original deadline. Check the final status before you lock any date into a roadmap.

Some things did not move. The transparency obligations under Article 50, including telling people when they are interacting with an AI system, were not broadly postponed. The agreement gave only a short grace period for watermarking of systems already deployed. It also narrowed the definition of a safety component, so AI that merely assists a user or optimizes performance without creating health or safety risk may fall outside high-risk obligations. At the same time, it reinstated registration duties for some systems that claim an exemption from high-risk classification.

Why a Delay Is Not a Pause

Here is the mistake many organizations are making. They see a 2027 date and push all AI governance work to 2027. But the work is front-loaded. Risk management systems, data governance, technical documentation, conformity assessment, and human oversight design each take months. A system launched in 2027 without proper documentation will not pass a 2027 review just because the deadline arrived later.

Consider a mid-sized lender that uses a model to score small business loan applications. That use case sits in Annex III. A team that treats the delay as permission to wait might discover, a year from now, that its training data lineage is undocumented, its human review process exists only in a slide deck, and nobody can explain how a rejected applicant could request a meaningful reason. Reconstructing those records after the fact is far harder than building them as the model is developed.

Enterprise software teams feel this acutely. A company that builds HR screening tools, lending decision engines, or insurance underwriting platforms sits squarely in Annex III territory. An Enterprise app development company serving those clients needs to know which of its features cross the line, and it needs to know before the client asks.

The Medical Device Question

For medical devices, the picture involves two regulatory systems at once. The AI Act’s requirements for high-risk products interact with sector rules such as the EU Medical Device Regulation. The Commission has published draft guidelines on classifying high-risk systems, which are meant to clarify that overlap. Manufacturers should not assume a later date will make the interaction simpler. What it gives them is a longer runway to build one coherent documentation set instead of two that quietly disagree.

For a Healthcare app development company, the first question is whether a given feature is a regulated medical function at all. Triage suggestions, image analysis, and risk scoring can cross into regulated territory. Administrative tools such as appointment optimization or billing code suggestions usually sit further away, though “usually” is doing a lot of work in that sentence. A practical exercise is to write down the intended purpose of each AI feature in one sentence. If that sentence mentions diagnosis, treatment, or clinical decision-making, the feature deserves a formal regulatory review before anyone talks about launch dates.

A Practical Calendar

Rather than planning around one date, build a three-track calendar. The first track covers what is already live: prohibited practices, AI literacy, transparency duties, and general-purpose model obligations. The second covers what arrives in late 2026 and 2027, including watermarking, registration, and Annex III preparation. The third covers 2028 and beyond, when product-embedded systems come under scrutiny. Assign owners, map every AI feature to a category, and treat documentation as a product artifact that is versioned alongside the code.

What to Watch Next

The Commission’s guidance on high-risk classification and the technical standards expected from European standardization bodies will shape what compliance actually looks like. Those documents will matter more than the headline dates, because they tell engineering teams what evidence regulators will expect. Teams that read them early will have fewer surprises when auditors arrive.

The Thought Worth Keeping

Regulation tends to reward teams that treat compliance as a design input rather than a final review. The extra time in this package is valuable only if it gets spent on that work. Deferred is not dismissed. The organizations that treat the new calendar as a head start, rather than a holiday, will be the ones with products still on the market when the deadlines arrive.