The EU AI Act’s high-risk rules were due to apply from August 2, 2026. They don’t yet. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved them back by more than a year. If your organization uses AI to make decisions about people, the rules will still apply to you, whether or not you realize you’re in scope. What you’ve gained is time to prepare properly.
What changed, and when the rules apply
The EU AI Act sorts artificial-intelligence systems by risk. The heaviest obligations fall on the applications with the greatest influence over people’s lives. Under the original timetable, those obligations would have applied from August 2, 2026, the Act’s general date of application.
Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026, and entered into force on July 27. It sets new dates for the high-risk requirements:
- December 2, 2027 for stand-alone high-risk systems listed in Annex III, such as those used in hiring, education, and credit scoring.
- August 2, 2028 for AI built into products covered by the EU product safety legislation in Annex I, such as medical devices and machinery.
The high-risk category is not abstract. It covers systems most large organizations already run:
- Hiring and HR: screening candidates, ranking applicants, evaluating employees.
- Education: scoring and assessment that affect a person’s access or progression.
- Credit scoring: deciding who gets access to finance, and on what terms.
- Insurance: risk pricing and eligibility for life and health coverage.
- Critical infrastructure: systems that keep essential services running safely.
Here is the uncomfortable part: many companies already operate systems like these without knowing they fall within the Act’s scope. The model was bought as a feature, embedded in a vendor’s product, or built quietly by an internal team. Nobody filed it under “high-risk AI.” The regulation does not care how it arrived.
The trap: treating it as paperwork
It is easy to read all of this as one more administrative burden: a compliance file to assemble, a box to tick, a cost to absorb and forget. A deadline that moved back by more than a year makes that reading even more tempting. It looks like permission to wait.
But documentation was never the goal. The goal is artificial intelligence you can actually rely on: sovereign, secure, and resilient. Systems whose decisions you can explain, whose data you control, and whose behavior holds up under scrutiny. Companies that treat the Act as a formality miss that point entirely. They produce the paperwork and remain exactly as exposed as before.
What the rules are really asking for
Strip away the legal language and the high-risk requirements describe something a serious operator would want regardless of any regulation: know what your models do, control the data they run on, and be able to stand behind the decisions they make.
That is difficult when your AI is a black box rented from someone else, with the model, the data, and the compute all outside your control. It becomes tractable when the system is yours: an architecture where data stays inside your boundary, models are chosen and adapted deliberately, and governance is built in rather than bolted on afterward. Compliance stops being a document you chase and becomes a property of how the system was built.
This is the same conviction behind everything we build at Cortex Labs: own your intelligence. AI is far easier to trust, and far easier to defend to a regulator, when you control the data, the models, and the infrastructure they run on.
What the extra time is for
The new dates can look distant. In practice, the work fills the time. You first have to find the AI you already run, including the models built into vendors’ products. Then you decide which systems are in scope and build logging, human oversight, and documentation into them, instead of writing them up afterward. That is architecture work, and it doesn’t happen in a quarter.
Organizations that wait until late 2027 will do the same work in a hurry, at the same time as everyone else. The ones that start now can build it properly, once.
You are not navigating this alone
Rules on paper still have to become workable practice. That is where industry alliances matter. Bodies such as AURII connect business, research, and the state to translate the regulation into something organizations can actually apply, and to represent their members’ interests before national and European institutions as the framework evolves. Turning the Act from text into practice is a shared effort, not a burden each company carries alone.
Where to start
If artificial intelligence is already making decisions about people inside your organization, now is the moment to find out where you stand. Not after an audit, and not in the last months before the deadline.
The first questions are simple: Which of our systems fall into the high-risk category? Whose data do they run on, and where does it live? Could we explain their decisions if we were asked to tomorrow? If those answers are not clear, the gap is not a paperwork gap. It is an architecture gap, and the new dates give you time to close it properly. That is a far better problem to discover now than to be told about later.