For two years, 2 August 2026 was the date every EU AI Act programme in financial services was built around: the day stand-alone Annex III high-risk obligations, covering credit scoring and insurance pricing among other use cases, were due to apply. The Digital Omnibus changed that. Under the agreed amendments, the Annex III application date moves to 2 December 2027, and Annex I high-risk AI embedded in regulated products moves to 2 August 2028.
The arithmetic is a 16-month reprieve for Annex III and a 12-month reprieve for Annex I. The substance is unchanged: the Omnibus moved dates, not obligations. Every requirement a credit scoring system was going to face in August 2026, it will face in December 2027, in materially the same form.
That combination, more time and same destination, is easy to handle badly. The two predictable failure modes are treating the delay as a compliance holiday and disbanding the programme, or ignoring it and burning budget on a certification sprint no regulator is waiting for. The right response is more precise: pause the final compliance milestone, keep everything underneath it moving.
What applies right now, delay or no delay
The postponement is narrower than the headlines suggest, and several parts of the Act are live today:
- The GPAI regime. The rules for general-purpose AI models run on their own track and are untouched by the Annex III delay. If your tooling is built on a general-purpose model, that regime is your current reality.
- The prohibitions. Banned practices stay banned. Nothing in the Omnibus suspends them.
- AI literacy. The obligation to ensure a sufficient level of AI literacy among staff working with AI systems continues to apply, and it is the cheapest obligation to be caught ignoring.
- Article 50 transparency. These obligations have applied since 2 August 2026. Systems that interact with people or generate content carry disclosure duties now, not in 2027.
A firm that reads “high-risk delayed” as “AI Act delayed” is exposed on all four fronts while feeling compliant.
The new dates, mapped to financial use cases
The classification exercise now determines your deadline, which makes it worth doing precisely. Stand-alone Annex III systems, the category that captures credit scoring and insurance pricing and risk assessment, apply from 2 December 2027. High-risk AI embedded in regulated products under Annex I applies from 2 August 2028. GPAI-based systems and transparency-covered systems are governed on the earlier, already-live tracks.
This mapping is not trivial, and it is the piece of work that should not wait. Every model and use case in the estate needs a defensible classification: Annex III, Annex I, GPAI-based, transparency-only, or out of scope. Firms that skip this step end up with a portfolio-level guess and discover in mid-2027 that a system they treated as out of scope is a stand-alone Annex III deployment with eighteen months of missing documentation behind it.
Keep building the parts with operational value
The way to spend the reprieve well is to keep funding the workstreams whose value does not depend on the statutory date:
- Inventory and classification, as above, because everything else keys off it.
- Governance and accountability. Risk ownership, approval workflows, model change control, human oversight design, and escalation paths. These take longest to make real because they are organisational, not technical.
- Data governance and documentation. Lineage, quality controls, feature governance, technical documentation, model cards, and logging. Documentation written retroactively in 2027 will be worse and more expensive than documentation accumulated as models change.
- Validation and testing. Bias and fairness testing, resilience testing, explainability support, and performance monitoring, with priority on underwriting, credit decisioning, and insurance pricing models where the eventual obligations bite hardest.
- Vendor and third-party management. Procurement clauses, audit rights, and evidence requirements for AI vendors, especially where an external scoring engine or embedded decision tool will sit inside your future Annex III scope. Contract cycles are slow; December 2027 is closer than it looks from a procurement calendar.
What can genuinely be paced more slowly: the last-mile conformity-readiness sprint for Annex III systems, and certification-style readiness spend aimed purely at the old go-live date. Product-embedded Annex I programmes can align to 2028. The test for deferring anything is whether it exists only to hit the statutory date; if it also hardens the control environment, it stays on the current plan.
Running the programme to the new clock
Operationally, the reprieve changes the shape of the programme more than its content. Move the formal compliance checkpoint for Annex III systems to Q3–Q4 2027, working back from 2 December, and treat the intervening period as accumulation time: controls running on live models, documentation maturing through real change cycles, test evidence building quarter by quarter. A programme that runs for eighteen months produces a better evidence base than one assembled in a sprint, and at lower peak cost.
Two cautions belong in the plan. First, keep an eye on the legislative record itself: the Omnibus dates come from an agreement that still has formal steps to complete, so anchor your milestone documents to the current text and re-verify before committing external attestation spend. Second, hold the budget. The most common way firms waste a regulatory delay is by reallocating the team in month one and rehiring in a panic a year later, paying twice for context that walked out the door. The obligations did not move. Only the deadline did, and deadlines have a way of arriving.
FAQ
Our credit scoring programme was nearly ready for August 2026. Is that work wasted?
No, it is banked. The obligations were postponed, not changed, so an inventory, documentation set, and testing regime built for August 2026 is the same one you will need for December 2027. The sensible move is to shift from build mode to run mode: keep the controls operating on live models, let the documentation mature through a few change cycles, and schedule a lighter re-verification sprint in 2027 instead of dismantling and rebuilding.
Does the postponement affect our GPAI-based tools and chatbots?
No. The delay concerns Annex III high-risk obligations. The GPAI regime continues on its own track, the prohibitions remain in force, the AI literacy obligation still applies, and Article 50 transparency duties have applied since 2 August 2026. A customer-facing assistant built on a general-purpose model is governed by those provisions today, regardless of what happens to your high-risk timeline.
How should we plan given the timeline could move again?
Anchor the programme to the obligations rather than the date. Inventory, governance, data lineage, testing, and vendor controls pay for themselves operationally whatever the statute says, so they proceed on internal timelines. Only the formal conformity checkpoint is date-dependent, and you should manage it as a scheduling variable: hold it as a planned sprint with a defined lead time, and re-anchor it if the legislative process shifts the application date again in either direction.