The AI Act's High-Risk Deadline Moved to 2027. Your Transparency Deadline Didn't.
Brussels handed AI teams a gift this year, and I keep watching product teams unwrap the wrong box. The Digital Omnibus — now enacted, not a proposal — moved the EU AI Act's high-risk obligations from August 2026 to 2 December 2027 for standalone systems and 2 August 2028 for AI embedded in regulated products. The industry heard «the AI Act is delayed» and relaxed. But the transparency obligations of Article 50 were never delayed. They apply from 2 August 2026 — twelve days after this post goes up — and they cover the most ordinary AI features in production: the chatbot, the generated image, the synthetic voice.
I read Regulation (EU) 2024/1689 the way I read an API changelog: what breaks my roadmap, and when. I'm an engineer, not a lawyer, and this is a builder's map rather than legal advice. We've already covered the deployer's side for hiring teams in our EU AI Act series; this post is for the other seat — the team shipping AI features inside its own product.
Most of your features aren't high-risk. Classify before you panic.
The Act is a pyramid. At the top, prohibited practices — social scoring, exploiting vulnerabilities, emotion recognition in the workplace — banned since 2 February 2025. Below that, high-risk: systems in Annex III domains like employment decisions, credit scoring, education assessment and access to essential services, plus AI embedded in already-regulated products (Annex I). Then a transparency tier, and at the base, minimal-risk systems the Act barely touches.
Run an honest inventory and most SaaS AI features — summarization, search, drafting, classification of your own operational data — land in the bottom two tiers. The classification exercise takes a focused afternoon per feature, and it's the highest-leverage compliance work you can do, because everything downstream depends on the answer. When we built a legislation-aware legal engine for a legaltech client, the classification memo was two pages and it settled a dozen later arguments — with the client's counsel, with their enterprise buyers, and internally every time someone proposed pointing the model at a spicier use case. The failure mode I actually see isn't teams misclassifying; it's teams never classifying, carrying a vague dread that scales worse than any obligation.
The nuance that deserves your attention: high-risk status follows the use, not the model. A summarization feature is minimal-risk; the same summarizer ranking loan applicants is Annex III territory. If your roadmap points a benign feature at an Annex III domain, the classification changes under you — and that's a product decision someone should make deliberately, with the December 2027 date in view.
Wrapping someone else's model can still make you the provider
The Act's roles don't care about your architecture diagram. Put your name on an AI system and place it on the EU market — even if it's a thin layer over a frontier model API — and you are the provider of that system, with the obligations that attach to its risk class. The GPAI model obligations that took effect on 2 August 2025 bind the model's maker upstream; they don't absorb your duties downstream. And Article 25 has a trap worth knowing: substantially modify a high-risk system, or rebrand one, and provider obligations transfer to you.
For most product teams this resolves simply: you're the provider of a limited- or minimal-risk system, and your concrete obligations are the transparency duties below. But «we just call an API» has never been a legal position, and the teams that write down which role they hold per feature spend an hour on it once, instead of re-litigating it in every enterprise procurement call.
One date inside the GPAI regime matters to builders too: model providers who signed the Commission's Code of Practice have their grace period expiring on 2 August 2026 — the same day your transparency duties start. Expect your upstream providers' documentation, usage policies and provenance tooling to shift around that date, and pin your integration to what they publish rather than to a blog post's summary of it. Their compliance posture is an input to yours; treat model documentation like you treat a dependency's changelog.
August 2026 is a UX and metadata deadline, not a legal one
Article 50 translates into three pieces of engineering work, all live from 2 August 2026:
- Disclosure of interaction. People must be able to tell they're talking to a machine. If your chatbot could plausibly pass as a human agent, it needs to say otherwise — a design task, and a small one if you do it on purpose.
- Machine-readable marking of synthetic content. AI-generated audio, images, video and text intended for the public need marking in a machine-readable format — provenance metadata of the C2PA family is where the ecosystem is converging. Systems placed on the market before 2 August 2026 get a grace period on marking until 2 December 2026; new ones don't.
- Deepfake and category disclosure. Deployers of deepfakes, emotion recognition or biometric categorization must disclose them to the people affected.
None of this is exotic. It's the kind of work a team ships in a sprint or two when it's on the roadmap, and re-ships badly under a procurement deadline when it isn't. The text-marking case deserves one concrete note: for images and audio, provenance metadata has an emerging standard to lean on; for generated text published to inform the public, the technical options are thinner and the Act acknowledges as much — which makes your logging the fallback. If you can reconstruct which outputs were machine-generated, when, and by which model version, you can answer the question even where a watermark can't survive a copy-paste. Build the reconstruction first; it's useful for debugging on Tuesday and for regulators whenever they ask.
There's also one obligation already in force that costs almost nothing: AI literacy (Article 4, live since February 2025) asks providers and deployers to ensure staff operating AI systems understand them. For an engineering org this is an onboarding module and a couple of internal sessions — the same ones your team probably wants anyway.
The delay is real — and it isn't a holiday
I'll concede the counter-argument its full weight: December 2027 is far away, the harmonized standards for high-risk systems are still being written (that's largely why the date moved), and enforcement capacity varies wildly between member states. Some of the Act's edges are unsettled — where «substantial modification» begins, what marking formats will satisfy which authority. Anyone selling you certainty on those points is selling.
But here's what the delay doesn't change: if any feature on your roadmap plausibly lands in Annex III, the expensive part of compliance is architectural — logging that can reconstruct a decision, human-oversight hooks that aren't decorative, data governance you can describe with a straight face. Those cost little when designed in and a rewrite when bolted on. Sixteen extra months is exactly the window in which designing them in is still cheap.
What I'd do this quarter if I owned an AI product roadmap
- Inventory every AI-shaped feature, with an owner. Shadow features count — the enrichment script marketing runs is on the market too.
- Classify each one against the pyramid, in writing, one paragraph each. Note which could drift toward Annex III with one product decision.
- Ship the Article 50 work now: disclosure UX for anything conversational, provenance metadata for anything generative. It's due in weeks, and it's small.
- Keep model and eval records — which model version ran when, evaluated how. You'll want this for the five questions any auditor or enterprise buyer eventually asks.
- Decide your role per feature — provider or deployer — and file it where sales can find it before the next procurement questionnaire arrives.
The teams that navigated GDPR best in 2018 weren't the ones with the biggest legal budgets; they were the ones whose engineers read the regulation once and mapped it onto systems they already understood. The AI Act rewards the same move. The high-risk deadline moved. The habit of reading the rules yourself shouldn't.
If you're building AI features under EU rules and want engineers who have shipped under this kind of scrutiny, talk to a CTO.
