The High-Risk Deadline Just Moved to December 2027. Here's What Still Applied From August 2026.

If you're building anything with LLMs, whether internal tools, customer-facing features, or AI agents, the headline is this: the AI Act's heaviest obligations are no longer imminent, and the ones that actually govern your data flows never had a deadline in the first place.

The Digital Omnibus on AI deferred the substantive high-risk requirements — conformity assessments, risk management systems, data governance, logging, human oversight — from 2 August 2026 to 2 December 2027 for standalone Annex III systems, and to August 2028 for high-risk AI embedded in regulated products such as medical devices and machinery.

Two things did not move, and they are the two that matter for most engineering teams.

What Still Applied From August 2026

The Article 50 transparency duties landed on 2 August 2026 as planned. The Act's general application was not deferred; only the high-risk obligations were. If your system interacts with people, they need to know they're talking to an AI. If it generates synthetic content, that content needs to be identifiable as such. These duties apply to every chatbot and every piece of AI-generated output, not just to high-risk systems, and they are enforceable now, with maximum fines of €35M or 7% of global turnover.

Everything already in force also stayed in force: prohibited practices since February 2025, GPAI model provider obligations since August 2025. The deferral touched none of it.

Why the GDPR Obligations Never Moved

This is the part that matters most for anyone sending customer data to an LLM API, and it is the part the deferral changed least: GDPR never had a deadline to defer.

GDPR already requires data minimisation (Article 5), appropriate technical safeguards including pseudonymisation (Article 32), and Data Processing Agreements with any third party handling personal data (Article 28). These obligations apply to every company processing EU citizen data, regardless of how the AI Act classifies your system, and they applied throughout the deferral debate exactly as they did before it. The AI Act runs alongside GDPR; it does not replace it.

The practical upshot is unchanged: don't send personal data to AI systems unless you have a clear legal basis and appropriate safeguards.

For most companies using third-party LLM APIs, the simplest safeguard is: strip the personal data before it gets there.

What This Looks Like in Practice

Your customer support AI summarises tickets. Each ticket contains a customer's name, email, and sometimes their address. Today, all of that goes to OpenAI or Anthropic.

Under existing GDPR obligations, if you're sending personal data to a third-party LLM provider, you need to either:

1. Have a valid legal basis for sending that personal data to a third-party AI provider
2. Have a DPA with the AI provider that specifically covers this processing
3. Demonstrate data minimisation: only send what's necessary for the AI to do its job

The LLM doesn't need the customer's name to summarise their complaint. It doesn't need their email to suggest a reply. It doesn't need their address at all.

Stripping PII before the LLM call is the simplest way to address data minimisation, and it significantly reduces the complexity of the DPA and legal basis questions because no personal data reaches the third party.

A Simple Pipeline Change

import requests

def strip_pii(text):
    response = requests.post(
        "https://api.comply-tech.co.uk/api/v1/anonymise",
        headers={"X-Api-Key": "your-api-key", "Content-Type": "application/json"},
        json={
            "content": text,
            "contentType": "text",
            "strategy": "Redact",
            "frameworks": ["GDPR"]
        }
    )
    return response.json()["anonymisedContent"]

# Before: send raw ticket to LLM
# After: send clean ticket to LLM
clean_ticket = strip_pii(raw_ticket)
summary = openai.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": clean_ticket}]
)

One extra API call. Sub-100ms latency. The LLM gets the same context without the personal data.

Why a Deferral Doesn't Change the Work

It would be easy to read "deferred to December 2027" as "not my problem until 2027." That reading only holds if the AI Act was the thing creating your obligation. For most teams putting customer data through an LLM, it wasn't. The GDPR exposure existed before the Omnibus and survived it intact.

Compliance deadlines also don't work the way engineers think they do. The enforcement date is when regulators can start fining you; auditors, enterprise clients, and compliance teams start asking questions long before that, and they are asking now. If you're in B2B SaaS selling to European customers, AI-specific data handling questions are already appearing in security questionnaires. Having an answer that says "we strip PII before it reaches any LLM API" is significantly better than "we're working on it" — and it is an answer that doesn't expire in December 2027.

A deferral is not a cancellation, either. If your AI use touches employment, credit, education, or essential services, the high-risk obligations are still coming, and they are still the most operationally demanding part of the Act. The extra 16 months are worth using rather than forgetting.

Try It Now

curl -X POST https://api.comply-tech.co.uk/api/v1/anonymise \
  -H "X-Api-Key: demo-key-complytech" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "Customer Sarah Mitchell (sarah@gmail.com) says her order #4821 hasnt arrived at 14 Beechwood Ave, Manchester M20 3FJ",
    "contentType": "text",
    "strategy": "Redact",
    "frameworks": ["GDPR"]
  }'

Free demo key, no signup. See what gets caught and what comes through clean.