A correction, because accuracy is the product here: in May 2026, the Council and Parliament reached provisional agreement on the Digital Omnibus package, and it changed the EU AI Act's back-half timeline. If your compliance planning — or your reading of our earlier posts — was anchored on August 2, 2026 as the high-risk obligations deadline, here is what's actually true now.
What Changed
- Annex III high-risk obligations (the ones agent pipelines care about most: Article 73 serious-incident reporting, Article 12/19 record-keeping, Article 14/26 human oversight, Article 10 data governance) are deferred to December 2, 2027. Annex I embedded systems move to August 2028.
- August 2, 2026 still matters — it's the start of Commission enforcement powers, including fines, for general-purpose AI providers. GPAI transparency duties and the governance regime go from "on the books" to "enforced" in four weeks.
- Nothing was removed. The Omnibus moved dates. The obligations, the reporting templates, the 15-day and 2-day Article 73 clocks — all unchanged, just later.
We've updated our EU AI Act readiness page to reflect the corrected timeline.
Why "17 Months of Runway" Is Not "17 Months of Waiting"
The deferral creates a familiar trap. Compliance work that was urgent last month now looks deferrable — and evidence infrastructure is exactly the kind of work that cannot be retrofitted.
Article 12 record-keeping obligations cover events over the system's lifetime. An audit trail that starts in November 2027 documents a system that ran undocumented for years. A serious-incident report under Article 73 draws on invocation records, approval decisions, and liveness receipts from before the incident — records that either exist because your pipeline generated them all along, or don't. The regulator's first question in 2028 will be about your pipeline's behavior in 2026.
That's the case for building the evidence trail during the runway:
- Audit trails ($0.001/call) — hash-chained from today, so lifetime coverage means lifetime.
- Approval gates ($0.002/call) — human oversight that produces decision records, not org-chart assertions.
- Data classification ($0.002/call) and residency attestation ($0.002/call) — Article 10 data governance evidence, per invocation.
- Incident claim packaging ($0.004/call) — the Article 73 report format, exercised before the clock is real.
At roughly $2/day for a full evidence stack, the cost of starting now is noise. The cost of starting in October 2027 is every month of history you don't have.
The GPAI Angle
If you build on general-purpose models — and every agent pipeline does — August 2 is when your upstream becomes enforceable. Expect model providers to push new documentation and usage-transparency requirements downstream in their terms as the fine regime activates. Pipelines that already log which model processed what, where, with whose approval will absorb that paperwork trivially. Pipelines that don't will discover their provider's compliance is now their intake form.
The deadline moved. The direction didn't. Build the trail while it's cheap.