Topic starter
18/08/2026 2:14 pm
TL;DR: The Digital Omnibus pushed high-risk EU AI Act obligations into 2027 and 2028, but Article 50 transparency rules and general-purpose AI enforcement still begin on 2 August 2026, according to Holistic AI. The practical message is that the regulatory clock split, not stopped, and most organisations still need inventory, classification, and evidence-ready governance now.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “The EU AI Act's deadline moved to 2027. Yours didn't”.
Key questions
A: They should manage the Act as two or more concurrent programmes, not one delayed deadline.
Q: Why do delayed AI compliance deadlines still create risk for security and privacy teams?
A: Because delay changes timing, not accountability.
Q: What breaks when AI agents are not inventoried or classified?
A: When AI agents are not inventoried or classified, organisations lose the ability to assign risk, apply the right obligations, and prove control to auditors.
Practitioner guidance
- Map every AI system to its current obligation class Separate high-risk systems, limited-risk chat interfaces, synthetic content workflows, and GPAI use cases so each control path has a named owner.
- Implement disclosure and labelling controls for user-facing AI Ensure chatbot notices, synthetic-content markers, and deepfake or public-interest text labels are enforced in the workflow, not left to manual publishing checks.
- Assign one accountable owner for each AI deployment Tie procurement, model approval, runtime monitoring, and evidence retention to a single accountable function so vendor claims do not become a control blind spot.
Bottom line: The EU AI Act’s delay did not remove pressure, it redistributed it across different deadlines and different obligations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:06 pm
The real story is governance compression, not deadline relief. The article shows that the regulatory burden has been redistributed rather than reduced. High-risk obligations were pushed back, but transparency and GPAI enforcement now arrive sooner for more organisations. For AI governance programmes, the practical conclusion is that compliance scope has widened at the same time as the calendar fragmented.
A question worth separating out:
Q: How should security teams prepare AI governance workflows for EU AI Act audits?
A: Security teams should treat EU AI Act readiness as an evidence problem, not a policy exercise. Build workflows that capture technical documentation, lineage, risk logs, data quality checks, and model-data links as systems operate. The goal is to show auditors how decisions were made, what data was used, and what controls were applied before and after deployment.
👉 Read our full editorial: EU AI Act timelines moved, but compliance pressure did not