AI Act 2027: high-risk rules from 2 December 2027 and what was delayed

The 2027 deadlines

And two deadlines that follow:

Annex III covers, among other areas, biometrics, critical infrastructure, education and vocational training, employment and workers’ management, and access to essential private and public services. For an ordinary company points 4 and 5 matter most: recruitment and selection, decisions on terms of work, monitoring and evaluating employee performance, creditworthiness of natural persons, and risk assessment and pricing in life and health insurance.

What the amendment delayed

Annex I Section A concerns AI in products covered by the Union harmonisation legislation listed in that section. For products under Section B, Article 2(2) applies only Article 6(1), Article 60a and Articles 102 to 112. Under Article 111(2), the regulation applies to operators of legacy high-risk systems, those placed on the market or put into service before the date of application of Chapter III, only if from that date their design changes significantly; recital 39 of the amendment looks to when the first unit of that type and model was placed on the market. Legacy generators are those placed on the market before 2 August 2026; under Article 111(4) they take the necessary steps to comply with Article 50(2), machine-readable marking of outputs, by 2 December 2026. The amendment did not change the deadline for general-purpose AI models placed on the market before 2 August 2025; it remains 2 August 2027, and providers take the necessary steps to comply by then (Article 111(3)).

What was not delayed

Since 2 August 2025 the rules for providers of general-purpose AI models in Chapter V and the penalties in Chapter XII have applied, except Article 101. The new prohibitions cover non-consensual intimate deepfakes and child sexual abuse material; for systems and for their use they are conditional under Article 5(1a) and (1b). They are not a delay; the amendment added them to Article 5 with their own date of application. A company that reads the delay as a reason to leave the AI Act until the end of 2027 overlooks obligations that already apply.

Checklist for a company that deploys AI

Already applies

• Measures to support the AI literacy of staff and other persons using AI on your behalf. Article 4(1), as worded since 27 July 2026, does not require you to guarantee a specific level of AI literacy of any individual (Art. 4).
• A check that no tool is used for a prohibited practice (Art. 5).
• Informing people exposed to an emotion recognition or biometric categorisation system, if you use one (Art. 50(3)).
• Disclosing that a deep fake was artificially generated or manipulated, and the same for text published to inform the public on matters of public interest, unless the text underwent human review or editorial control with editorial responsibility (Art. 50(4)).

From 2 December 2027, if the provider intends the system for an Annex III use

• Check your inventory of AI tools against Annex III, especially points 4 and 5.
• Check whether you become the provider: if you put your name or trademark on a high-risk system already on the market or in service (without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated), substantially modify it, or modify the intended purpose of an AI system, including a general-purpose AI system, which was not high-risk so that it becomes high-risk, you take on the provider obligations under Article 16 (Art. 25(1)).
• For systems placed on the market or put into service before 2 December 2027, check Article 111(2): the regulation applies to operators of such systems only if their design changes significantly, while for systems intended for use by public authorities providers and deployers take the necessary steps to comply by 2 August 2030.
• Obtain the instructions for use from the supplier and take measures to use the system in line with them (Art. 26(1)).
• Assign human oversight to people with the necessary competence, training and authority (Art. 26(2)).
• Where you control the input data, ensure it is relevant and sufficiently representative (Art. 26(4)).
• Monitor operation on the basis of the instructions. If you have reason to consider that use in accordance with the instructions may present a risk within the meaning of Article 79(1), inform the provider or distributor and the relevant market surveillance authority without undue delay and suspend use of the system. For a serious incident, inform immediately first the provider, then the importer or distributor and the relevant market surveillance authorities (Art. 26(5)).
• Keep the automatically generated logs under your control for at least six months (Art. 26(6)).
• As an employer, inform workers’ representatives and the affected workers before deployment (Art. 26(7)).
• If the system makes or assists decisions about people, inform them that they are subject to its use (Art. 26(11)).
• Prepare a fundamental rights impact assessment if you are a body governed by public law, a private entity providing public services, or you use a system for creditworthiness or for life and health insurance (Art. 27(1)).
• Use the provider’s information for your data protection impact assessment under Article 35 GDPR (Art. 26(9)).

Checklist for providers

Already applies

• Measures to support the AI literacy of staff and other persons dealing with the operation and use of AI systems on your behalf; Article 4(1) does not require you to guarantee a specific level of AI literacy of any individual (Art. 4).
• A check that no system you place on the market or put into service falls under a prohibited practice (Art. 5).
• Systems intended to interact directly with people inform them that they are interacting with AI, unless this is obvious (Art. 50(1)).
• Audio, image, video and text generators mark outputs in a machine-readable format. Systems placed on the market before 2 August 2026 have until 2 December 2026 (Art. 50(2), Art. 111(4)).

From 2 December 2027 for Annex III systems

• Classification under Article 6. If you consider that an Annex III system is not high-risk, document the assessment before placing it on the market or putting it into service and meet the registration obligation under Article 49(2) (Art. 6(3) and (4)).
• The Section 2 requirements: risk management system, data and data governance, technical documentation, record-keeping, transparency and information to deployers, human oversight, accuracy, robustness and cybersecurity (Art. 9 to 15).
• Quality management system, documentation keeping and automatically generated logs (Art. 16(c) to (e)).
• Conformity assessment under Article 43, EU declaration of conformity under Article 47, CE marking under Article 48 and registration under Article 49(1), except for point 2 of Annex III (Art. 16(f) to (i)).

From 2 August 2028 for Annex I Section A systems

• Conformity assessment following the procedure required under the relevant Union harmonisation legislation; the Section 2 requirements are part of that assessment and the quality management system under Article 17 is assessed as well (Art. 43(3)).
• Provider obligations under Article 16, including the quality management system, documentation keeping and automatically generated logs (Art. 16(c) to (e)).

The full deadline timeline from 2025 is in AI Act deadlines 2025 to 2030, and the wider picture in the EU AI Act guide.

Sources and limits

This answer is based on Regulation (EU) 2026/1744 published in the Official Journal on 24 July 2026, the consolidated text of Regulation (EU) 2024/1689 of 27 July 2026 and, for the original deadlines, its text published on 12 July 2024, verified on EUR-Lex on 31 October 2026. The consolidated text has no legal effect of its own; only the texts published in the Official Journal are binding. The checklists are an editorial aid by CIAD, not a complete list of obligations or a legal opinion.