The AI Act timeline has changed.
With the entry into force of the new AI Omnibus, some of the obligations for high-risk AI systems that were originally expected to apply in 2026 have been pushed back to 2027 and 2028.
For many organizations, this comes as a relief.
But it also raises a more important question:
What should companies do with the extra time?
Because delaying a regulatory obligation does not mean delaying the architectural, governance, and data-management decisions that will ultimately be needed to meet it.
In fact, for organizations already integrating AI into real business processes, this may be precisely the right time to take a closer look at how those systems are being built.
What has changed with the AI Omnibus?
The AI Omnibus introduces several changes designed to simplify and facilitate the implementation of the AI Act, including extending the timeline for certain obligations relating to high-risk AI systems. The new framework entered into force on July 27, 2026.
The most relevant change for many organizations concerns the timeline for applying the requirements for high-risk AI systems.
Annex III high-risk systems: December 2027
The obligations applying to systems classified as high-risk under Article 6(2) and Annex III will now apply from December 2, 2027.
This includes certain uses of AI in areas such as biometrics, critical infrastructure, education, employment, migration, and border control.
Annex I high-risk systems: August 2028
For systems classified as high-risk under Article 6(1) and Annex I, the relevant obligations have been pushed back to August 2, 2028.
This category covers AI systems integrated into certain regulated products, such as machinery, toys, and lifts, which are subject to EU harmonization legislation.
Not everything in the AI Act has been delayed
This is an important distinction.
The new timeline does not mean that the AI Act is on hold.
Some requirements are already applicable. The prohibitions on certain AI practices and the AI literacy requirements started applying in February 2025, while governance rules and certain obligations for providers of general-purpose AI (GPAI) models have applied since August 2025.
There are also specific deadlines for certain transparency requirements. For example, providers of certain systems that generate synthetic content and were already on the market before August 2, 2026 must take the necessary measures to comply with certain marking requirements by December 2, 2026.
So simply talking about an “AI Act delay” can be misleading.
The timeline has changed, but regulation is still moving forward.
What does the AI Act delay mean for businesses?
For organizations that were working against tight deadlines, having more time can certainly be positive.
But there is a potential risk: treating that extra time as a reason to wait.
When a regulatory requirement is postponed, it is easy to think:
“We’ll deal with it when it becomes mandatory.”
The problem is that many of the decisions required to comply with the AI Act are not made at the end of a project.
They are made much earlier.
For example:
Where is data being processed?
Who has access to it?
What information leaves the organization?
Can we control how data is used throughout the system’s lifecycle?
Do we have traceability into the system’s decisions and outputs?
How will the system be monitored once it is deployed?
What happens when the model needs to be changed or updated?
Are we dependent on external providers for critical components of our architecture?
These are not simply compliance questions.
They are architecture decisions.
And the more deeply AI becomes embedded in real business processes, the harder and more expensive it can be to change that architecture later.
AI compliance is also an architecture issue
Preparing for the AI Act should not simply mean adding documentation or controls as a regulatory deadline approaches.
For many organizations, the real challenge starts much earlier: designing AI systems in a way that makes it possible to maintain control over data, document how systems operate, and manage risk throughout their lifecycle.
This is particularly important in sectors where AI systems handle sensitive information or play a role in critical processes.
In healthcare, for example, systems may process clinical and highly sensitive personal data.
In banking and financial services, AI may work with financial information and support processes that can have significant consequences for individuals.
In industry, AI can be connected to operational processes, infrastructure, and production systems.
And in the public sector, AI may form part of services that directly affect citizens.
In these environments, data governance cannot be a layer added at the end.
It needs to be part of the design from the start.
What should companies do before 2027?
The new timeline gives organizations something many of them need: Time.
The question is how to use it.
1. Identify your AI use cases
Before talking about compliance, organizations need to understand where AI is already being used or where it is planned to be used.
– What AI systems are currently in production?
– Which projects are under development?
– What use cases are planned over the next 12–24 months?
And, most importantly, what impact could these systems have on data, business processes, and people?
2. Map your data and how it moves
An AI strategy requires more than knowing which data a model uses.
Organizations need to understand where data resides, where it is processed, who can access it, and what information needs to leave the organization.
Mapping these flows can reveal dependencies and risks that are not always visible when looking at the model itself.
3. Review your AI architecture
Architecture decisions can shape many of the choices that come later.
– Do data need to be centralized?
– Does sensitive information need to be moved in order to train a model?
– Where does inference take place?
– How are models updated?
– What happens when multiple organizations are involved in training?
Answering these questions before deployment can help avoid major structural changes later.
4. Build traceability and governance into the system
Being able to demonstrate how an AI system is being used can be just as important as its ability to deliver accurate results.
That is why traceability, documentation, access controls, and monitoring mechanisms should be designed into the system from the beginning.
5. Collaborate without losing control of your data
Across many industries, building better AI systems requires access to data from multiple organizations.
But sharing or centralizing that data is not always an option.
This raises a different strategic question:
How can organizations collaborate to build better AI systems without having to centralize their data?
This is where approaches such as Federated Learning can play an important role.
Federated Learning: training AI without centralizing data
Federated Learning enables machine learning models to be trained across distributed environments, allowing data to remain where it already resides while training takes place locally.
Instead of moving all the data into a central repository, participating environments exchange model updates that can be aggregated to improve the global model.
The principle is simple:
Bring the AI to the data not the data to the AI.
This approach can be particularly relevant in environments where multiple organizations need to collaborate but cannot—or should not—centralize sensitive information.
For example, different hospitals may want to collaborate on developing AI models using clinical data from multiple institutions.
A bank may need to train models using information distributed across different entities or environments.
An industrial organization may want to leverage data from multiple plants without moving all its operational data into a single repository.
In these cases, the question is not simply how to get more data.
It is how to make better use of more data while maintaining control over it.
The AI Act delay can be an opportunity
The new timeline gives organizations more time to prepare.
But that time should not simply be used to wait for the next regulatory deadline.
It can be used to make decisions that will be much harder to change later:
Define an AI architecture that can scale with the organization.
Establish data access and governance policies.
Strengthen traceability.
Identify and classify AI use cases.
Assess the risks associated with each system.
Review how data is processed throughout the AI lifecycle.
Explore ways to collaborate without centralizing sensitive information.
The goal should not simply be to be ready to comply with the AI Act.
It should be to build an AI infrastructure that can continue to operate as regulations, models, and business requirements evolve.
Why start now?
At Sherpa.ai, we work with organizations that need to integrate AI into environments where data cannot be treated as a secondary consideration.
Our approach starts with a simple idea:
Organizations should be able to innovate with AI without losing control over their data.
The delay to certain AI Act obligations creates an opportunity to get this right from the start.
To explore use cases.
To validate architectures.
To establish control mechanisms.
And to understand how AI can be integrated into real business processes without having to choose between innovation and control over data.
Because the goal should not be to reach 2027 or 2028 and only then start solving these challenges.
It should be to reach those dates with systems that were designed from the outset around how the organization intends to use AI over the long term.
So perhaps the question should not be:
“How much time do we have before this becomes mandatory?”
But rather:
“Are we building AI today that we will still be able to use when those obligations come into effect?”
If you are reviewing your AI strategy ahead of 2027 and would like to share how your organization is approaching these challenges, let’s talk.
Frequently Asked Questions About the AI Act
When will the requirements for high-risk AI systems apply?
Under the new timeline, the obligations for systems classified as high-risk under Annex III will apply from December 2, 2027.
For high-risk AI systems integrated into certain regulated products under Annex I, the relevant requirements will apply from August 2, 2028.
Does the new timeline mean companies can wait before preparing?
Not necessarily.
Some AI Act requirements are already applicable. In addition, many of the decisions needed to meet future requirements concern architecture, data management, traceability, and governance.
These are decisions that are often difficult and costly to change once an AI system is deeply embedded in business processes.
What is the AI Omnibus?
The AI Omnibus is an EU legislative package that introduces changes intended to simplify and facilitate the implementation of the AI Act, including changes to the timeline for certain obligations affecting high-risk AI systems.