Topic starter
10/07/2026 4:16 pm
TL;DR: The EU AI Act amendments push key high-risk AI deadlines to 2027 and 2028, while preserving the regulation’s risk-based obligations and adding new prohibited practices plus updated transparency timelines, according to OneTrust. The extra time reduces implementation pressure, but it does not reduce the need for inventories, documentation, ownership, and operational oversight.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “The EU AI Act's New Timeline Gives Organizations More Time, Here's How to Use It”.
By the numbers:
- Standalone high-risk AI systems under Annex III will now become subject to the AI Act on December 2, 2027, instead of August 2, 2026.
- High-risk AI systems embedded within regulated products move from August 2, 2027, to August 2, 2028.
- Transparency obligations for AI-generated content remain a priority, with providers expected to implement transparency measures by December 2, 2026.
Key questions
Q: How should governance teams use the extra EU AI Act runway?
A: Use it to turn AI governance into an operating process, not a deadline-driven project.
Q: What breaks when AI inventories and ownership are missing?
A: Without inventories and named ownership, organizations cannot classify systems consistently, track changes in use, or prove who approved a high-risk decision.
Q: Why do delayed compliance dates still create governance pressure?
A: Because the regulation’s underlying obligations have not changed.
Practitioner guidance
- Build a living AI inventory Track every AI system, intended purpose, owner, vendor dependency, data flow, and likely regulatory classification in one governed register.
- Embed governance into existing workflows Wire AI review steps into procurement, privacy impact assessments, product approvals, and risk sign-off so governance happens where decisions occur.
- Assign accountable owners for each use case Give each system a named business owner and a governance owner so classification, monitoring, and evidence collection do not drift across teams.
Bottom line: The revised EU AI Act timetable changes when some obligations bite, but it does not change what organizations must prove about high-risk AI governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 4:18 pm
The amended timeline changes delivery pressure, not governance intent. The EU AI Act still expects organizations to prove risk management, documentation, human oversight, and accountability for high-risk AI systems. Delaying deadlines without building operational controls simply extends the period before failure becomes visible. Practitioners should treat the new dates as a chance to harden programme mechanics, not as permission to pause them.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should privacy and risk teams do first with AI governance changes?
A: They should build a current inventory of AI systems, classify each use case, and connect every system to a business owner and evidence source. That gives the programme a control baseline that can absorb future legal and technical changes.
👉 Read our full editorial: EU AI Act amendments extend deadlines, but governance demands stay