If you had 2 August 2026 circled in red, you can relax a little. Only a little.
That was the date when the EU AI Act's obligations for many high-risk AI systems were due to apply. The EU's Digital Omnibus on AI has now pushed those deadlines back. But "deferred" is not "cancelled", and for UK firms that sell into Europe, the extra time is only useful if it is used.
The new timeline at a glance
According to Orrick's summary of the final Omnibus text (Orrick):
- High-risk systems listed in Annex III (such as AI used in employment, education, credit scoring and access to essential services) now apply from 2 December 2027, instead of 2 August 2026.
- High-risk systems under Annex I and Article 6(1), broadly AI that forms part of products already covered by EU product safety law, apply from 2 August 2028.
- Certain systems used by public authorities have until 2 August 2030.
Existing obligations are untouched. The bans on prohibited AI practices have applied since February 2025, and obligations for general-purpose AI models since August 2025.
What else changed
The Omnibus is not only a delay. Orrick identifies eight changes in total. The ones most UK businesses should know about:
New prohibitions. AI that creates non-consensual intimate imagery, including so-called "nudifier" apps, and child sexual abuse material is now explicitly banned.
Relief for growing companies. Compliance support previously reserved for SMEs now extends to "small mid-caps": companies with fewer than 750 employees and turnover up to €150 million.
Data for bias detection. There is now a GDPR legal basis for processing special category data to detect and correct bias, under strict necessity and safeguards.
Less double regulation. Overlapping duties are reduced where sector laws such as the Machinery Regulation already cover similar requirements, and the definition of "safety component" is narrowed.
Central enforcement. The EU AI Office gains exclusive supervision over certain systems built on general-purpose AI models and AI in very large online platforms and search engines.
Why UK businesses are in scope
Brexit did not take UK companies out of the AI Act. The Act applies to providers placing AI systems on the EU market and, broadly, to AI systems whose outputs are used in the EU. A UK software company selling an AI-enabled recruitment tool to a German employer, or a UK health tech firm with customers in Ireland, is very much in scope.
The UK has so far chosen a lighter, regulator-led approach at home. That creates a two-speed reality for British firms: one set of expectations in the domestic market and a more prescriptive regime for European customers. Most will find it simpler to build to the higher standard once.
How to use the extra time
Sixteen months until December 2027 sounds like a lot. For a high-risk system, it is not. Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness requirements all take time to design in, and much longer to retrofit.
A sensible sequence for the rest of this year:
- Inventory. List every AI system you build, sell or use, and where its outputs are used.
- Classify. Work out which could be high-risk under Annex III or Annex I. Be honest. Customers' procurement teams will ask.
- Gap-assess. For likely high-risk systems, compare what you have today with what the Act requires, and plan the work.
The organisations that do this now will have an advantage in sales conversations long before the deadline. European buyers are already asking AI suppliers how they will comply.
Not legal advice, but a practical nudge
This briefing is a summary, not legal advice, and the detail of how standards and guidance develop will matter. Take specialist legal advice on classification. But do not wait for perfect clarity before starting the engineering work. Good documentation, logging, evaluation and human oversight are worth having whatever the final rules say.
If you want help building an AI inventory or turning compliance requirements into engineering work, our Consulting and AI & Data teams can help. Start with a conversation about an AI Opportunity Assessment, or read our guide to evaluating AI systems before they go live.
Frequently asked questions
When do EU AI Act high-risk rules apply after the Digital Omnibus?
High-risk systems in Annex III apply from 2 December 2027. Those under Annex I and Article 6(1) apply from 2 August 2028. Certain public authority systems have until 2 August 2030.
Does the EU AI Act apply to UK companies?
Yes, where UK companies place AI systems on the EU market or where their AI systems' outputs are used in the EU.
What is the EU Digital Omnibus on AI?
It is an EU legislative package that amends the AI Act, delaying high-risk deadlines and introducing changes including new prohibitions, relief for small mid-caps and reduced overlap with sector laws.