The planning gap is still open.
A political agreement within the EU’s Digital Omnibus package proposes extending the Annex III compliance deadline to December 2, 2027 for standalone high-risk AI systems, and to August 2, 2028 for Annex II embedded product systems. That agreement has not been published in the Official Journal of the European Union. Until it is, the extension does not exist as law.
The EU AI Act Service Desk, an official European Commission resource, states the operative timeline plainly: August 2, 2026 is the date “the majority of rules of the AI Act come into force and enforcement starts” and “Rules for high-risk AI systems in Annex III enter into application.” That date has not changed.
What the proposed extension actually says
Multiple independent legal analyses confirm the proposed extension dates. For Annex III standalone high-risk systems, AI used in employment screening, credit scoring, biometric categorization, critical infrastructure management, and similar high-stakes applications, the proposed backstop is December 2, 2027. For Annex II systems, meaning AI embedded in regulated products like medical devices or industrial machinery, the proposed extension runs to August 2, 2028.
Those dates come from a preliminary political agreement. Political agreement is not law. The EU legislative process requires formal text, a vote, and Official Journal publication before any amendment to the AI Act’s compliance timeline takes legal effect.
The compliance trap
Here’s where organizations run into trouble. The proposed extension has been widely covered. Some teams have used the coverage as a reason to deprioritize August 2026 compliance work. Legal advisors in the EU regulatory space have generally recommended the opposite: continue planning for August 2, 2026 as the operative deadline until Official Journal publication formally enacts the extension. That recommendation reflects basic regulatory practice, you comply with the law that exists, not the law that’s been agreed in principle.
The asymmetry matters. If an organization pauses compliance work and the Official Journal publishes the extension before August 2, the worst outcome is wasted preparation. If an organization pauses and the OJ publication is delayed, or the agreement’s scope is modified before final text, the organization is exposed on the current deadline with no runway to recover.
What to watch
The trigger event is straightforward: Official Journal publication. Watch the EUR-Lex publication feed at EUR-Lex for any Digital Omnibus entries. When the extension publishes there, and only then, the proposed dates become binding.
Until that publication, compliance teams should treat the Annex III status update table below as the operative planning reference.
| Deadline | Type | Status | Applies To |
|---|---|---|---|
| August 2, 2026 | Compliance enforcement begins | Binding law | Annex III standalone high-risk AI systems |
| December 2, 2027 | Proposed extension | Proposed, pending OJ publication | Annex III standalone high-risk AI systems |
| August 2, 2028 | Proposed extension | Proposed, pending OJ publication | Annex II embedded product systems |
TJS synthesis
This brief adds one new fact to the story that’s been running since late April: as of April 28, no Official Journal publication has occurred. That’s not dramatic, but for compliance teams that have been watching the extension news and wondering whether to re-scope their August timelines, the answer remains no. The question worth sitting with is this: if your organization is relying on the extension to arrive before August 2, what’s your contingency plan if it doesn’t?
What triggers the extension? The proposed extension takes legal effect only upon publication in the EU’s Official Journal. Until that publication, August 2, 2026 is the sole operative compliance deadline under the EU AI Act. Political agreement, however widely reported, is not a legal substitute for Official Journal entry.