--- title: The EU Wasn't Ready... Are you? description: The EU delayed its high-risk AI rules to December 2027 because standards weren't ready. Here's why it matters and what to do with the extra time. image: https://info.itdtech.com/hubfs/itDBlog-EUWasntReadyAreYou.jpg --- [![](https://info.itdtech.com/hs-fs/hubfs/itDLogo-NoTag-Colored.png?width=586&height=361&name=itDLogo-NoTag-Colored.png)](https://www.itdtech.com/) - [itD Community](https://community.italentdigital.com/?_gl=1*kkwto8*_ga*MjEzOTA5MjcwNi4xNzUzNzE5OTk2*_ga_KWF906CXZF*czE3NjUzODI4NDYkbzE0MyRnMSR0MTc2NTM4NDUyMyRqNTQkbDAkaDA.*_ga_MKS6MY25V1*czE3NjUzODI4NDYkbzE0MyRnMSR0MTc2NTM4NDUyMyRqNTQkbDAkaDA.) - [Contact Us](https://itdtech.com/contact-us) - [What We Do](https://itdtech.com/what-we-do) - - [Enable Next-Generation Experiences](https://itdtech.com/customer-experience-consulting) - [Transform Technology Operations](https://itdtech.com/technology-operations-consulting) - [Convert Data To Advantage](https://itdtech.com/business-intelligence-consulting) - [Unlock the Potential of AI](https://itdtech.com/ai-consulting) - [Deliver Advanced DevOps & Software](https://itdtech.com/devops-consulting) - [Capabilities](https://itdtech.com/capabilities) - [Enterprise Community](https://itdtech.com/online-community-management) - [Enterprise Search & Personalization](https://itdtech.com/ai-powered-enterprise-search) - [BI, Data & Analytics](https://itdtech.com/data-analytics-consulting) - [Software & Cloud Engineering](https://itdtech.com/cloud-engineering) - [PMO](https://itdtech.com/project-management-consulting) - [Managed Services](https://itdtech.com/managed-services) - [Change Management](https://itdtech.com/change-management-consulting) - [Quality Assurance](https://itdtech.com/quality-assurance-consulting) - [Digital Accessibility](https://itdtech.com/digital-accessibility-services) - [itD Labs](https://itdtech.com/itd-labs) - [About](https://itdtech.com/itd-labs) - [SmartConX](https://itdtech.com/smartconx-enterprise-ipaas) - [Chama](https://itdtech.com/change-management-software) - [Fastr.ai](https://itdtech.com/talent-acquisition-software) - [Partner Solutions](https://itdtech.com/partner-solutions) - [Khoros](https://itdtech.com/khoros-consulting) - [Coveo](https://itdtech.com/coveo-partner) - [Microsoft Fabric](https://itdtech.com/microsoft-fabric-partner) - [Google Cloud Platform](https://itdtech.com/google-cloud-platform) - [Who We Are](https://itdtech.com/who-we-are) - [Culture & values](https://itdtech.com/cultures-values) - [Our leadership](https://itdtech.com/leadership) - [Our clients](https://itdtech.com/our-clients) - [About us](https://itdtech.com/who-we-are) - [Giving back](https://itdtech.com/giving-back) - [GLAM](https://itdtech.com/girls-leadership-academy-meetup-glam) - [Awards](https://itdtech.com/awards) - [News & Thinking](https://itdtech.com/news-and-insights) - [News](https://itdtech.com/latest-news) - [Blog](https://info.itdtech.com/blog) - [Case Studies](https://itdtech.com/success-stories) - [Careers](https://itdtech.com/careers) - [Work With Us](https://itdtech.com/careers/work-with-us) - [Open Positions](https://italent.jobs.fastr.ai/jobs) GO - [Services](https://www.italentdigital.com/our-services) - [Solutions](https://www.italentdigital.com/our-services) - [Data transformation & business intelligence](https://www.italentdigital.com/data-transformation-and-business-intelligence) - [Change management](https://www.italentdigital.com/change-management) - [Enterprise community](https://www.italentdigital.com/enterprise-community) - [Enterprise search & personalization](https://www.italentdigital.com/enterprise-search-and-personalization) - [Capabilities](https://www.italentdigital.com/capabilities) - [IT DevOps](https://www.italentdigital.com/devops) - [Software & cloud engineering](https://www.italentdigital.com/software-cloud-engineering) - [Machine learning & AI](https://www.italentdigital.com/machine-learning-ai) - [Project management/PMO](https://www.italentdigital.com/project-management) - [Data management & analytics](https://www.italentdigital.com/data-management-analytics) - [Digital accessibility](https://www.italentdigital.com/digital-accessibility) - [Managed services](https://www.italentdigital.com/managed-services) - [SaaS](https://www.italentdigital.com/saas-applications) - [SmartConX](https://www.italentdigital.com/smartconx) - [Chama](http://www.chamacloud.com/) - [MojoHire](http://www.mojohire.ai/) - [Partners](https://www.italentdigital.com/partner-solutions) - [Khoros](https://www.italentdigital.com/khoros) - [Coveo](https://www.italentdigital.com/coveo) - [Microsoft](https://www.italentdigital.com/microsoft) - [Lingotek](https://www.italentdigital.com/lingotek) - [Oracle Eloqua](https://www.italentdigital.com/oracle-eloqua) - [News & insights](https://www.italentdigital.com/news-and-insights) - [Blog](https://www.blog.italentdigital.com/) - [Success stories](https://www.italentdigital.com/success-stories) - [Latest news](https://www.italentdigital.com/latest-news) - [Who we are](https://www.italentdigital.com/who-we-are) - [Culture & values](https://www.italentdigital.com/cultures-values) - [Our leadership](https://www.italentdigital.com/leadership) - [Our clients](https://www.italentdigital.com/our-clients) - [Our story](https://www.italentdigital.com/who-we-are/our-story) - [Giving back](https://www.italentdigital.com/giving-back) - [GLAM](https://www.italentdigital.com/girls-leadership-academy-meetup-glam) - [Awards](https://www.italentdigital.com/awards) - [Careers](https://www.italentdigital.com/careers) - [Work With Us](https://www.italentdigital.com/careers) - [Open Positions](https://italent.jobs.mojohire.ai/jobs) - [Locations](https://www.italentdigital.com/locations) ![](https://info.itdtech.com/hubfs/itDBlog-EUWasntReadyAreYou.jpg) # The EU Wasn't Ready... Are you? Published by [itD](https://info.itdtech.com/blog/author/itd) on Oct 28, 2026, 12:36:54 PM ![itD Blog cover for a blog post about the EU AI Act delay](https://info.itdtech.com/hs-fs/hubfs/itDBlog-EUWasntReadyAreYou.jpg?width=760&height=399&name=itDBlog-EUWasntReadyAreYou.jpg) #### The EU delayed its high-risk AI rules to December 2027 because standards weren't ready. Here's why it matters and what to do with the extra time. ### **Why did the EU delay the AI Act's high-risk rules?** The EU didn't change its mind about the rules. The delay happened because the system needed to enforce them wasn't ready. To show compliance, companies are meant to follow detailed technical standards that turn the Act's requirements into concrete steps. Those standards are being written by the [European standards bodies CEN and CENELEC](https://www.dqsglobal.com/en/about/newsroom/eu-ai-act-parliament-council-align-on-postponing-high-risk-ai-obligations), which missed their 2025 target and now expect to deliver them in late 2026 at the earliest. Several member states were also behind on appointing the national authorities and assessment bodies that oversee compliance. Without the standards, companies would have had legal obligations with no clear way to prove they'd met them. So the EU's [Digital Omnibus on AI](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-omnibus-vii-deadline-delay-20260/), in force since July 27, 2026, moved the date. ### **Is the AI Act delay just a deadline extension?** Three things make this different from a simple extension. The requirements didn't change. Risk management, data governance, technical documentation, logging, human oversight, and controls for accuracy and security are all still required. Only the timing moved. The new date is fixed. It applies whether or not the standards are finished on time. If they slip again, the deadline doesn't slip with them. The window is tighter than it looks. If the standards arrive in late 2026, companies will have about a year to put them into practice before December 2027. Organizations that use the months before then to lay the groundwork will spend that year refining. Those that wait will spend it scrambling. The delay gave the EU time to finish its side of the work. It's an opening for businesses to do the same. ### **What changed, and what's already in effect?** The Omnibus, formally Regulation (EU) 2026/1744, changed two dates: - Stand-alone high-risk AI systems listed in Annex III of the Act now have until December 2, 2027. Annex III covers uses such as biometrics, critical infrastructure, employment, education, access to essential public and private services, law enforcement, migration, and the administration of justice. - High-risk AI embedded in products already covered by EU product safety law (Annex I) now has until August 2, 2028. For most enterprises, the first date is the one that matters. If AI screens job applicants, assesses creditworthiness, supports certain life and health insurance decisions, or determines who gets access to a service, it likely falls under Annex III. Other parts of the Act are already in effect: - The bans on prohibited AI practices and the AI literacy duty have applied since February 2025. - Obligations for providers of general-purpose AI models have applied since August 2025. - Most of the transparency obligations in Article 50, such as telling people they're interacting with a chatbot and labeling deepfakes, have applied since August 2, 2026. A company with an EU-facing chatbot or generative AI feature may already have obligations today. Legal counsel should confirm which provisions apply to which systems. ### **Does the EU AI Act apply to US companies?** The AI Act can apply to companies that place AI systems on the EU market, or whose AI outputs are used in the EU, wherever the company is based. A US employer screening candidates for roles in Germany, or a lender scoring applicants in France, could be in scope. Most large enterprises would also rather run one AI governance program than one per jurisdiction. Because the EU's requirements are among the most detailed anywhere, building to them tends to cover much of what other frameworks ask for, including the NIST AI Risk Management Framework many US organizations already use. ### **What should companies do with the extra time?** Much of the work doesn't depend on the standards at all and can start now. *Where to begin:* 1. **Inventory your AI use.** Include AI features inside vendor products and tools teams adopted on their own. You can't classify what you haven't found. 2. **Sort it by risk.** Identify which use cases could fall under Annex III and which already carry transparency duties. 3. **Assign owners.** Every high-risk use case needs a named business owner who is accountable for how it's used. 4. **Prepare the people.** Governance holds only when the people using these systems know what's expected of them, which is also the point of the AI literacy duty already in force. *Build toward, then finalize once the standards land:* 1. **Map controls against the requirements.** Compare what's in place today with what the Act expects, such as documentation, oversight, logging, and testing, and close the gaps you can already see. 2. **Build evidence as you go.** Regulators and auditors will ask for proof. A program that produces records during normal operation is far easier to defend than one assembled the month before a deadline. Start with a handful of the highest-impact use cases rather than everything at once. The method you build on those carries over to the rest. ### Frequently Asked Questions: ##### **When is the new EU AI Act deadline for high-risk AI?** > Stand-alone high-risk AI systems listed in Annex III have until December 2, 2027. High-risk AI built into products covered by EU product safety law (Annex I) has until August 2, 2028. Both dates were set by the Digital Omnibus on AI, in force since July 27, 2026. **Why was the EU AI Act delayed?** > The technical standards companies use to show compliance weren't finished, and several member states were behind on appointing the authorities and assessment bodies that oversee it. The rules themselves did not change. **Did the AI Act's requirements change?** > No. Risk management, data governance, technical documentation, logging, human oversight, and controls for accuracy and security are all still required. Only the timing moved. **Is any part of the EU AI Act already in effect?** > Yes. Bans on prohibited AI practices and the AI literacy duty have applied since February 2025, obligations for general-purpose AI model providers since August 2025, and most transparency obligations since August 2, 2026. **What should companies do before December 2027?** > Start with work that doesn't depend on the standards: inventory your AI use, sort it by risk, assign accountable owners, and train the people using these systems. Then map controls and build evidence, and finalize both once the standards are published. ### **How itD helps** itD works on both sides of the gap between AI policy and day-to-day practice. On the governance side, we help organizations inventory their AI use, tier it by risk, map controls to frameworks like the EU AI Act and the NIST AI RMF, and set up the reporting that leaders and auditors expect. On the delivery side, our data, security, and change management teams make sure those controls work inside the systems and workflows people actually use. The result is a program that's documented and audit-ready, and that people follow. **The EU used its extra time to get ready. Use yours the same way.** [Book a free strategy session](https://itdtech.com/contact-us) to talk through your AI governance roadmap, or take our [5-minute AI readiness assessment](https://itdtech.com/itd-ai-readiness-assessment) to find out where you stand. *This post is for general information and isn't legal advice.* **You may also like** - [How to implement lightweight governance in fast-moving organizations](https://info.itdtech.com/blog/how-to-implement-lightweight-governance-in-fast-moving-organizations): how to build guardrails and compliance checks into delivery so teams can move fast and stay compliant. - [Why AI initiatives fail (and it isn't the technology)](https://info.itdtech.com/blog/why-ai-initiatives-fail-and-it-isnt-the-technology): the people and process gaps that stall AI programs after launch. - [Fueling your AI: Why clean data is just the beginning](https://info.itdtech.com/blog/fueling-your-ai-why-clean-data-is-just-the-beginning): why AI needs a governed, scalable data foundation, not just a cleanup. Tags: [AI](https://info.itdtech.com/blog/tag/ai), [cybersecurity](https://info.itdtech.com/blog/tag/cybersecurity), [secure & governed AI](https://info.itdtech.com/blog/tag/secure-governed-ai), [compliance](https://info.itdtech.com/blog/tag/compliance) [Back to Blog](https://info.itdtech.com/blog) - [Tweet](https://twitter.com/share) ## Related Articles ## [Exciting new and upcoming Microsoft Fabric updates](https://info.itdtech.com/blog/new-and-upcoming-microsoft-fabric-updates) As the Head of iTalent Digital’s BI, Data & Analytics consulting practice, I had the privilege of... [Read More](https://info.itdtech.com/blog/new-and-upcoming-microsoft-fabric-updates) ## [Navigating the AI Revolution: the evolving role of project managers](https://info.itdtech.com/blog/navigating-the-ai-revolution-the-evolving-role-of-project-managers) Project management is currently at a significant juncture, marked by a striking paradox. While... [Read More](https://info.itdtech.com/blog/navigating-the-ai-revolution-the-evolving-role-of-project-managers) ## [How a privacy compliance operations organization achieved operational excellence](https://info.itdtech.com/blog/how-a-privacy-compliance-operations-organization-achieved-operational-excellence) Robust privacy compliance is a strategic asset for companies subject to stringent privacy laws and... [Read More](https://info.itdtech.com/blog/how-a-privacy-compliance-operations-organization-achieved-operational-excellence) ## Let's do the impossible together [![itD\_logo\_white](https://info.itdtech.com/hs-fs/hubfs/itD_logo_white.png?width=293&height=181&name=itD_logo_white.png "itD_logo_white")](https://www.italentdigital.com/) [![Contact Us](https://no-cache.hubspot.com/cta/default/20215820/a756e6f8-e904-4e63-a1da-00f1ad3913e1.png)](https://cta-redirect.hubspot.com/cta/redirect/20215820/a756e6f8-e904-4e63-a1da-00f1ad3913e1) ###### Headquarters itD 300 Orchard City Drive Ste 136 Campbell, CA 95008 [+1 408.496.6200](tel:4084966200) - Company - [All locations](https://itdtech.com/locations) - [Careers](https://itdtech.com/careers) - [Our clients](https://itdtech.com/our-clients) - [Awards](https://itdtech.com/awards) - [Giving back](https://itdtech.com/giving-back) - Resources - [Latest news](https://itdtech.com/latest-news) - [Blog](https://info.itdtech.com/blog) - [Success stories](https://itdtech.com/success-stories) - [Core offerings](https://itdtech.com/wp-content/uploads/2025/08/itD_Overview_Flyer.pdf) ###### Legal © Copyright 2026 itD. All rights reserved. [Sitemap](https://www.italentdigital.com/sitemap) [Privacy policy](https://www.italentdigital.com/privacy-policy) ![standards\_1](https://info.itdtech.com/hubfs/standards_1.png) ![standards\_2](https://info.itdtech.com/hubfs/standards_2.png) ![standards\_3](https://info.itdtech.com/hubfs/standards_3.png) ![standards\_4](https://info.itdtech.com/hubfs/standards_4.png) ![standards\_5](https://info.itdtech.com/hubfs/standards_5.png) ![standards\_6](https://info.itdtech.com/hubfs/standards_6.png) ![GLAM](https://info.itdtech.com/hs-fs/hubfs/raw_assets/public/I_Talent_Digital_November2022/images/glam.gif?width=200&name=glam.gif "GLAM") ### Girls Leadership Academy Meetup ##### Founded by itD's CEO, Renée La Londe [![View Website](https://no-cache.hubspot.com/cta/default/20215820/ce1052c4-41dd-401c-87d0-67e2d82665b6.png)](https://cta-redirect.hubspot.com/cta/redirect/20215820/ce1052c4-41dd-401c-87d0-67e2d82665b6) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "itD", "url" : "https://info.itdtech.com/blog/author/itd" }, "dateModified" : "2026-10-28T22:51:55.891Z", "datePublished" : "2026-10-28T19:36:54.000Z", "headline" : "The EU Wasn't Ready... Are you?", "image" : [ "https://info.itdtech.com/hubfs/itDBlog-EUWasntReadyAreYou.jpg" ], "mainEntityOfPage" : { "@id" : "https://info.itdtech.com/blog/the-eu-wasnt-ready-are-you", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://info.itdtech.com/hubfs/itDLogo-NoTag-Colored.png" }, "name" : "itD" } } ```