The biggest change is a delay to obligations for high-risk AI systems. Standalone high-risk systems covered by Annex III, including those used in areas such as employment, education, credit scoring, and law enforcement, will now be subject to the rules from 2 December 2027 instead of 2 August 2026. High-risk AI embedded in regulated products, such as medical devices, will have until 2 August 2028 to comply. Watermarking requirements for some AI systems are also postponed until December 2026.
Other amendments include banning AI-powered so-called “nudifier” applications from December 2026, narrowing the definition of AI safety components, allowing limited use of special category data for bias detection under strict safeguards, extending simplified compliance measures to certain mid-sized companies, and reducing duplication where sector-specific legislation already provides equivalent protection.
The direction of the AI Act remains unchanged, even with the new timeline. Organisations should treat the delay as additional preparation time – this is not a reduction in regulatory expectations. Businesses developing and deploying AI must continue mapping AI systems, strengthening governance frameworks, documenting risk management processes, and monitoring guidance and technical standards. Existing obligations for the Act remain in force, making continued compliance efforts essential.
The Act’s extraterritorial scope means these requirements extend beyond Europe. Organisations in the UK, US, and APAC should remain vigilant as they may still fall within scope if they place AI systems on the EU market or produce outputs affecting EU citizens.
For deeper insights about the EU AI Act and its implications for data and AI leaders, become a DataIQ client to gain access to all the learnings on our exclusive Hub.
