EU AI Act deadlines shifted, but audit duties didn’t vanish. What to document now, what waits until December 2027, and how to build records regulators accept.
The most consequential thing about the EU AI Act’s new timeline is how many executives read it wrong. On June 29, 2026, the Council gave its final green light to the Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since July 27 — and the headline every board took home was “AI Act delayed.” The sentence almost nobody read: the obligations that matter most were never delayed at all.
The Omnibus deferred exactly one chapter of the law. Everything else — the prohibited-practice bans, the general-purpose AI model obligations, the transparency duties — is already enforceable, right now, against companies that assumed they had another year. If your compliance plan is organized around December 2, 2027, you have already missed live deadlines. And a regulator will not accept “we thought it was delayed” as a record.
Start with the bans. Since February 2, 2025, Article 5’s prohibited practices have been illegal across the EU — social scoring, real-time remote biometric identification in public spaces, emotion recognition in workplaces and schools, manipulative and exploitative systems. Violations carry the Act’s maximum penalty: up to €35 million or 7% of worldwide annual turnover, whichever is higher. Documenting that none of your systems fall into these categories is not optional paperwork; it is your first line of defense. A short, dated screening memo — which systems were reviewed, by whom, against which prohibition — costs an afternoon and answers the regulator’s first question.
Next, the model layer. Since August 2, 2025, providers of general-purpose AI models have carried binding obligations under Articles 53 and 55: maintain technical documentation describing training approach and architecture, publish a summary of training data, operate a copyright-compliance policy, and — for non-EU providers — appoint an EU representative. Models trained on more than 10²⁵ FLOPs of compute are presumed to carry systemic risk and face five more duties, including adversarial testing before major releases, serious-incident reporting to the AI Office without undue delay, and energy-consumption reporting. If your company fine-tunes or redistributes a foundation model, you may be a provider and not know it.
Then, the transparency layer — the deadline most companies walked straight past. Since August 2, 2026, Article 50 has been enforceable: providers must disclose when users are interacting with an AI system at the latest at first interaction (Art. 50(1)); providers of generative AI must mark synthetic output in machine-readable form (Art. 50(2)); deployers of emotion-recognition or biometric-categorization systems must notify affected individuals (Art. 50(3)); and deployers must label deepfakes and AI-generated public-interest text (Art. 50(4). The Commission adopted its enforcement guidelines on July 20, 2026. Breaches can draw fines of up to €15 million or 3% of global turnover — with one important moderation: under Article 99(6), SMEs and startups face the lower of the two figures, so a company with €2 million in annual turnover faces a maximum of €60,000, not €15 million. Still enough to ruin a quarter.
One narrow exception proves the rule. The Digital Omnibus granted a four-month grace period — until December 2, 2026 — but only for the Article 50(2) machine-readable marking duty, and only for systems already on the market before August 2, 2026. Everything else under Article 50 got no extension. At the AI Board’s September 17 plenary, enforcement coordination was confirmed and no further relief was granted.
And beneath it all, Article 4’s AI-literacy duty has applied since February 2025 to every provider and deployer of any AI system — not just high-risk. Training records are themselves an audit-trail item.
The deferral is precise, and precision is the point. Standalone high-risk systems under Annex III — hiring tools, credit scoring, education, law enforcement, critical infrastructure — now face their obligations on December 2, 2027, not August 2, 2026. High-risk AI embedded in regulated products under Annex I — medical devices, machinery, radio equipment — moves to August 2, 2028. Those obligations are heavy: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), automatic event logging (Art. 12), human oversight (Art. 14), accuracy and cybersecurity (Art. 15), and a quality management system (Art. 17), plus conformity assessment.
The stated reason was sequencing, not mercy. The harmonized standards that tell companies what “compliant” actually means did not exist. That is changing: in July 2026, CEN-CENELEC published EN 18286:2026, the first harmonized standard tied to the Act’s high-risk requirements, covering the Article 17 quality-management obligation. It is one standard of a full suite still in progress — the risk-management and bias standards are not finished — but the standardisation clock is now the real compliance clock. Companies that wait for every standard to publish before starting documentation will discover that documentation is the standard’s input, not its output.
Two more dates belong on the calendar. Two new Article 5 prohibitions — AI systems generating non-consensual intimate imagery and child sexual abuse material — apply from December 2, 2026. And the Omnibus reinstated the duty to register AI systems in the EU database even where providers consider them exempt from high-risk classification.
A defensible file for 2026–2027 has six sections, and the first four are due now.
First, a system inventory with classification: every AI system in the company, each mapped to a regulatory category — prohibited, high-risk Annex III, high-risk Annex I, GPAI, or transparency-only — with the reasoning recorded. Research by appliedAI on 106 enterprise AI systems found 18% clearly high-risk, 42% low-risk, and 40% requiring case-by-case classification. If you have not classified, you are in the 40%.
Second, prohibited-practice screening: the dated memo described above.
Third, GPAI evidence: technical documentation, training-data summaries, copyright policy, and — for systemic-risk models — red-team reports and incident logs. Downstream companies should demand this documentation from their model suppliers now; a gap in your vendor’s file becomes a gap in yours.
Fourth, transparency evidence: disclosure copy and placement for every chatbot and AI agent (the notice belongs in the chat window, not the terms and conditions), watermarking implementation status against the December 2, 2026 grace deadline, deepfake-labelling procedures, and AI-literacy training records.
Fifth, high-risk readiness: begin the Article 11 technical documentation and Article 12 logging design now, so December 2027 is an assessment, not a build.
Sixth, registration: track which systems belong in the EU database and file as the portal matures.
The delay moved the exam date. It did not cancel the exam — and the parts of the test already administered are the ones most companies skipped. The firms that will pass are the ones treating 2026 as a documentation year, not a waiting year.
The company that defines how AI audit trails get built will own the vocabulary of this entire regulatory era. Aiaudittrail.com is available for acquisition by that company — inquiries to info@primedomaincapital.com.
escrow.com secure transfer · info@primedomaincapital.com