The EU just gave you more time for high-risk AI. Don't waste it

#What happened

The EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, is now in force, and it changes the AI Act's calendar. As summarised by Orrick and other firms:

• High-risk systems listed in Annex III (hiring, credit scoring, education and similar uses) now have until 2 December 2027, instead of 2 August 2026.
• High-risk AI embedded in regulated products (Annex I) moves to 2 August 2028.
• The transparency duties of Article 50, such as telling people they're talking to an AI, still apply from 2 August 2026. Systems already on the market before that date get until 2 December 2026 for the marking of AI-generated content.
• The SME simplifications (lighter technical documentation, proportionate quality management, priority access to sandboxes, lower penalty caps) are extended to a new "small mid-cap" category: companies with fewer than 750 employees and up to €150 million in turnover.

#Why it matters for startups and SMEs

The delay is good news, but it's a delay, not a cancellation. The requirements are the same; only the dates moved. Two traps I see coming:

1. "We have until 2027" becomes "we'll think about it in 2027". If your product scores people, screens CVs or decides on credit, the hard part isn't the paperwork. It's the data lineage, the logging and the human oversight that have to be designed into the system. Retrofitting that into a product that has shipped for a year is far more expensive than building it in now.
2. Forgetting what already applies. If you have a chatbot, an AI assistant or anything that generates content for users, transparency is already your problem today, not in 2027.

#What I'd do this quarter

• Make an inventory. List every place your product uses AI and classify each one: prohibited, high-risk, transparency-only or minimal. It's usually a one-afternoon exercise and it changes the conversation.
• Fix the cheap transparency items now. A clear "you're talking to an AI assistant" notice and labelled AI-generated content cost little and are already required.
• If anything is high-risk, design for it in the next roadmap. Logging of inputs and decisions, a human override, and documentation of your training and evaluation data. Treat it as architecture, not compliance.
• Check whether you qualify as an SME or small mid-cap. The simplified regime is real money saved.

The extra time is useful only if you spend it building the system you'll need anyway.

This is a CTO's reading of public summaries, not legal advice. For your specific case, talk to a lawyer who works on the AI Act.