The AI Act High-Risk Deadline Just Moved to December 2027. Here's What Actually Applies Right Now.

If you spent the first half of this year preparing for the EU AI Act's August 2026 high-risk deadline, you can breathe out. Mostly.

On 24 July 2026, the EU published the Digital Omnibus on AI (Regulation 2026/1744). It entered into force on 27 July, six days before the deadline it was written to move. The high-risk obligations that were due to bite on 2 August 2026 have been deferred.

Most of the coverage so far is law-firm dense. Here's the plain-English version of what moved, what didn't, and what it means if you're building with LLMs.

What moved

The substantive high-risk obligations. Conformity assessments, risk management systems, data governance requirements, logging, human oversight. The operationally heavy stuff.

New deadlines:

2 December 2027 for standalone high-risk systems under Annex III (AI used in employment decisions, credit scoring, education, essential services, law enforcement)
August 2028 for high-risk AI embedded in regulated products (medical devices, machinery, and similar)

If you were racing to classify your systems and build a conformity programme, you now have roughly 16 more months.

What did NOT move

Three things, and they matter:

1. The Article 50 transparency duties landed on 2 August 2026 as planned. If your system interacts with people, they need to know they're talking to an AI. If your system generates synthetic content, it needs to be identifiable as such. These duties apply to every chatbot and every piece of AI-generated content, not just high-risk systems. They are enforceable now, with maximum fines of €35M or 7% of global turnover.

2. Everything already in force stayed in force. Prohibited practices have been enforceable since February 2025. GPAI model provider obligations since August 2025. The deferral touched none of it.

3. GDPR. This is the one that matters most for anyone sending customer data to LLM APIs, and it never had a deadline to defer. Data minimisation (Article 5), appropriate safeguards including pseudonymisation (Article 32), and Data Processing Agreements with third parties handling personal data (Article 28) have applied this whole time and continue to apply. The AI Act runs alongside GDPR; it does not replace it.

What this means in practice

Here's the honest read.

If your compliance team was treating August 2026 as the moment your LLM pipeline needed to be in order, the pressure has eased on the AI Act side. Nobody is going to fine you in September for missing a high-risk conformity assessment that is no longer due until December 2027.

But the question that actually applies to most teams building with LLMs was never an AI Act question. It was, and remains, a GDPR question: what personal data are you sending to OpenAI, Anthropic, or Google, and can you justify it?

If your support tickets, chat logs, or customer records flow into a third-party LLM with names, emails, and addresses intact, the deferral changed nothing about your position. The LLM does not need a customer's name to summarise their complaint. Sending it anyway is hard to square with data minimisation, deferral or no deferral.

The deadline that moved was never the reason to fix this. The reason to fix it is that the obligation already exists, the fix is small, and the exposure compounds quietly with every API call.

The 15-minute version of getting this right

Strip the personal data before it reaches the LLM. One API call in front of your existing pipeline:

curl -X POST https://api.comply-tech.co.uk/api/v1/anonymise \
  -H "X-Api-Key: demo-key-complytech" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "Customer Sarah Mitchell (sarah.m@gmail.com) says her order #4821 has not arrived at 14 Beechwood Ave, Manchester M20 3FJ",
    "contentType": "text",
    "strategy": "Redact",
    "frameworks": ["GDPR"]
  }'

The LLM gets the same context. The personal data stays inside your infrastructure. Nothing is stored on our side after the response.

Free demo key, no signup. See what gets caught before you commit to anything.

One caveat worth stating plainly

A deferral is not a cancellation. December 2027 will arrive, and the high-risk obligations that were postponed are still the most operationally demanding part of the Act. If your AI use touches employment, credit, education, or essential services, the sensible move is to use the extra time, not to spend it forgetting the problem exists.

And if you take one thing from this post: the compliance question in your LLM pipeline today is a GDPR question. It was before the Omnibus, and it still is.