An extension has been agreed. The deadline hasn’t moved yet. That gap matters enormously for every organization currently planning against the EU AI Act’s Annex III high-risk AI compliance requirements.
What the law says today
Under EU law, regulations take effect when published in the Official Journal. A preliminary political agreement, even one reflecting consensus between the European Parliament and the Council, doesn’t change binding law until it clears that final step. The European Parliament’s Legislative Train Schedule records December 2, 2027 as the proposed new deadline for stand-alone high-risk AI systems (Annex III), and August 2, 2028 for high-risk AI systems embedded in regulated products (Annex II). Those dates reflect a legislative position. They’re not enacted.
August 2, 2026 is still the deadline.
What makes this moment unusual
No formal Commission statement has been identified that clarifies the operative legal status of the August 2, 2026 deadline during this gap period. That absence is meaningful. Organizations waiting for official guidance before deciding how to proceed may be waiting for something that doesn’t arrive until Official Journal publication, which is the moment the legal status actually changes.
Two independent law firm analyses, from A&O Shearman and Plesner, reach the same conclusion: organizations should continue planning against the August 2, 2026 deadline. Not because an extension is unlikely to happen, but because it hasn’t happened yet.
Annex III vs. Annex II: two different proposed timelines
The preliminary agreement distinguishes between two categories of high-risk AI system. Annex III covers stand-alone systems deployed in areas including critical infrastructure, education, employment, law enforcement, and border management. The proposed extension for these systems runs to December 2, 2027, sixteen months beyond the current deadline. Annex II covers high-risk AI embedded in regulated products (medical devices, machinery, vehicles). The proposed extension for these systems runs to August 2, 2028.
Both proposed dates are confirmed by the EP Legislative Train as the current legislative position. Neither is enacted law.
What to watch
The trigger is Official Journal publication. When the extension agreement is formally published there, the new deadlines become operative, and compliance timelines shift accordingly. Until that happens, organizations have three broad options: continue the full August 2026 compliance sprint (eliminates legal risk regardless of extension outcome), adopt a phased posture prioritizing highest-risk systems first (hedges the sprint cost while maintaining partial coverage), or wait for OJ publication before accelerating (accepts legal exposure during the gap). Each posture carries different risk profiles.
TJS synthesis
The compliance limbo created by a preliminary agreement that isn’t yet law is the real story here, not the extension dates themselves. The proposed timeline represents meaningful relief for organizations that need it. But “proposed” and “enacted” are legally distinct categories, and the gap between them requires active planning decisions. Organizations that treat December 2, 2027 as the current deadline are operating on a legal assumption that hasn’t been validated. Those that continue against August 2, 2026 are accepting a harder near-term lift in exchange for certainty. Both choices are defensible. Drifting without a deliberate posture is not.