EU AI Act new timelines

• The timeline for enforcement has pushed out for both Annex I and Annex III high-risk AI systems:
  • Annex I moves from 2 August 2027 out 12 months to 2 August 2028.  These systems are those that form part of existing products that are governed by legislation such as medical devices.
  • Annex III moves from 2 August 2026 to 2 August 2027. These systems include, at a high level, those used in determining access to employment, education, credit, life and health insurance and essential public services.
• Additional changes to timelines for national Sandboxes, pushed to 2 August 2027, and providers meeting transparency obligations for AI generated content to 2 December 2026.
• Apps that can be used to “nudify” images are also set to be banned – these drew headlines earlier in 2026. 
• Strengthened lawful basis for process special category data in order to detect bias in systems.
• The requirement to register high-risk AI systems has been reintroduced.

What happens next?

The agreement must be approved by Parliament and Council before being submitted for legal and linguistic revisions before it enters law, however, we are unlikely to see any changes made at this point.

What does it mean for businesses?

Ensure that this does not impact on building and embedding AI governance into the organisation. While the enforcement of certain provisions of the AI Act may be delayed, other laws apply – such as the GDPR where systems use personal data. Un-managed AI still presents a real risk to organisations.

To learn more about how Forvis Mazars can assist with your AI journey, please get in touch