I wrote about the EU AI Act in February and August last year. A lot has happened since, and I see a dangerous misunderstanding spreading, so let me check where we are.<\/p>\n
In June the EU adopted an amendment to the AI Act, the so called digital omnibus on AI. It postponed the requirements for high risk AI systems. Standalone high risk systems now have until the 2nd of December 2027, and AI embedded in regulated products, like medical devices and machinery, until the 2nd of August 2028.<\/p>\n
The misunderstanding is that the AI Act was postponed. It wasn\u00b4t.<\/p>\n
The 2nd of August 2026 remained the general application date, and enforcement started then. The transparency obligations apply: people must be told when they interact with AI, and deepfakes and AI generated content must be labelled. The prohibitions have applied since February 2025, and the omnibus even added a new one, against AI generated sexual deepfakes and child sexual abuse material. The rules for general purpose AI models apply. And the fines are unchanged: up to 35 million euro or 7 % of global turnover for the prohibited practices.<\/p>\n
So what should management do? Don\u00b4t pause your AI governance work. Use the extra time for high risk systems to do it properly, not to stop. Make sure the transparency requirements are met now, especially for chatbots and generated content. Keep your AI inventory up to date.<\/p>\n
And watch the compliance trap again. A deadline that moves is still a deadline. Organisations that wait until late 2027 will find that everyone else is waiting too, and that the experts are fully booked.<\/p>\n
The finish line moved. The race didn\u00b4t stop.<\/p>\n","protected":false},"excerpt":{"rendered":"
I wrote about the EU AI Act in February and August last year. A lot has happened since, and I see a dangerous misunderstanding spreading, so let me check where we are. In June the EU adopted an amendment to the AI Act, the so called digital omnibus on AI. It postponed the requirements for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[167,38,79,168],"class_list":["post-1543","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-ai-governance","tag-business","tag-compliance","tag-eu-ai-act"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1543"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1543\/revisions"}],"predecessor-version":[{"id":1552,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1543\/revisions\/1552"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}