EU AI Act Delayed to December 2027: What UK Businesses Actually Need to Do

The EU has pushed back the deadline for its strictest AI rules. Obligations for high-risk AI systems, originally due to apply from 2 August 2026, will now apply from 2 December 2027. The change came in the Digital Omnibus on AI, which the Council of the EU formally adopted on 29 June 2026. The final act was signed on 8 July and enters into force three days after it appears in the EU’s Official Journal, expected later this month.

If you run a UK software business selling into the EU and the headlines persuaded you the AI Act could wait until next year, this guide is for you, because the delay covers less than the headlines suggest. Most of the AI Act still starts applying on 2 August 2026, a few weeks away. The delayed parts are the ones most SMEs were least likely to be caught by. Several parts that do apply to ordinary software products arrive on schedule.

We build software with AI features for SMEs. Most of the coverage of this change so far is written by law firms for other lawyers, so here is the plain-English version. It isn’t legal advice; for decisions that matter, talk to a lawyer.

Contents

• Does the EU AI Act apply to UK companies?
• EU AI Act timeline: what applies when
• What is not delayed: your August 2026 checklist
• Provider or deployer? The question that decides your workload
• Is your feature high-risk?
• How to use the 16 months
• Meanwhile in the UK
• Final thoughts

Does the EU AI Act apply to UK companies?

The Act reaches beyond the EU’s borders by design. Article 2 applies it to providers placing AI systems on the EU market “irrespective of whether those providers are established or located within the Union or in a third country”, and to providers and deployers based in third countries “where the output produced by the AI system is used in the Union”.

For a UK firm the practical tests look like this. Can EU customers sign up to your SaaS product? Do staff at an EU client use your AI feature as part of their work? The same goes for content or decisions your system produces that end up being used inside the EU. Any of those puts you in scope, with no EU office, subsidiary or server required. Brexit changed nothing here; the Act treats the UK like any other third country.

If you’re used to thinking in GDPR terms, note that the bar sits lower. GDPR asks whether you target or monitor people in the EU. The AI Act asks whether your system’s output is used there, and law firms advising on the extraterritorial reach (William Fry has a practical guide, and Edwin Coe has covered the UK angle directly) generally read that as the broader test.

EU AI Act timeline: what applies when

Two details worth knowing about the new dates. The Commission originally proposed making the delay conditional on the readiness of technical standards; that mechanism was dropped in negotiations, so the dates above are fixed in the legislation. And the package extends the Act’s existing SME exemptions to small mid-cap companies, the change most directly aimed at smaller businesses.

What is not delayed: your August 2026 checklist

This is the section that matters if your product already has AI in it. The European Parliament’s own press release puts it plainly: “Most of the provisions of the AI Act will start to apply on 2 August 2026.”

From that date, if your product includes a chatbot or assistant that interacts with users, those users must be informed they’re dealing with AI, unless it’s already obvious from context. If your system generates synthetic content, whether text, images, audio or video, the output must be marked as AI-generated in a machine-readable way. There is an exemption where the AI performs an assistive function for standard editing, or where it doesn’t substantially alter the input it was given, and a separate, narrower duty applies to organisations publishing AI-generated text that informs the public on matters of public interest, which falls away once a human takes editorial responsibility.

The content-marking rule carries the one genuinely new grace period: systems already on the market before 2 August 2026 have until 2 December 2026 to comply. Anything you place on the market after 2 August complies from day one, so a feature shipping this autumn gets no extra time.

Two further sets of rules were never delayed because they already apply. AI literacy duties took effect in February 2025 (the omnibus softened the wording, from ensuring literacy to taking measures that support it, but the duty stays). The banned practices, such as social scoring and manipulative systems, have applied since the same date, and the omnibus added a new prohibition on apps that generate non-consensual intimate imagery or child sexual abuse material, applying from 2 December 2026 with fines up to €35 million or 7% of worldwide turnover, whichever is higher.

What’s the exposure if you miss the August transparency deadline? Breaches of those obligations sit in the band of up to €15 million or 3% of worldwide turnover, whichever is higher. In practice, the pressure a small UK firm feels first is more likely to be its enterprise customers’ due-diligence questionnaires, not a knock on the door from Brussels. AI governance questions are already standard in enterprise procurement, and gaps there tend to show up in lost deals well before any fine.

Provider or deployer? The question that decides your workload

The Act assigns duties by role, so this is the first classification to get right. A provider places an AI system on the market under its own name or brand. A deployer uses an AI system under its own authority.

Take a concrete example we’ll come back to. A UK company sells HR software and adds a feature that uses a large language model to summarise candidate interviews, sold under its own brand as part of the product. That company is typically the provider of that AI system. It makes no difference that OpenAI or Anthropic built the underlying model; the SaaS firm put the feature on the market under its own name. The same company rolling out Microsoft Copilot to its own staff is a deployer of Copilot. Most software businesses hold both roles at once, for different systems, and each role carries different duties.

There is reassurance here for anyone worried that touching a foundation model drags them into the obligations written for the model labs. Under the European Commission’s guidelines on general-purpose AI models, you are treated as a provider of the model only where you modify it significantly, and the indicative threshold is a modification using more than one third of the compute that trained the original model. Ordinary fine-tuning gets nowhere near that. The guidelines are the clearest available signal of how the rules will be applied, even though they stop short of binding law, and they leave model-level duties with the model vendor.

Is your feature high-risk?

Stay with the HR example, because it sits close to the line that matters. Annex III of the Act lists the use cases that count as high-risk, and employment is one of them: systems used to place targeted job adverts, filter applications, evaluate candidates, or take decisions on promotion, termination, task allocation and performance monitoring. An applicant-tracking feature that ranks candidates is squarely in scope. Also on the list: evaluating the creditworthiness or credit score of individuals (with an exemption for financial fraud detection), and education uses such as admissions, exam assessment and proctoring.

So is the interview-summary feature high-risk? This is where the Act’s carve-out earns attention. A system performing a narrow procedural or preparatory task can be assessed out of the high-risk category under Article 6(3). A feature that summarises an interview so a human can read it faster is preparatory. A feature that scores the candidate and feeds a shortlist is evaluating them. The omnibus kept registration requirements for self-assessed systems in simplified form, so the assessment needs to be written down and kept, and a regulator can ask to see it.

The useful way to hear this as a founder or CTO: whether your AI feature lands in the high-risk category is substantially a product design decision. The line between “drafts the rejection email for a human to send” and “decides who gets rejected” is a product decision, and you control it.

How to use the 16 months

Here is the sequence we’d suggest, in order of value.

First, take an inventory. List every AI feature in your product and every third-party AI tool used in the business, and record two things against each: your role (provider or deployer) and a first-pass risk classification. For most SMEs this fits on a page and takes an afternoon, and every later decision depends on it.

Second, do the August 2026 work now. Chatbot disclosure and content marking are small, visible engineering tasks. They cost little to implement while a feature is being built and are awkward to retrofit later. Your EU customers can also see that you’ve done them.

Third, if anything in the inventory could fall under Annex III, start the documentation habit early. The high-risk regime runs on technical documentation: training data choices, evaluation results, human oversight design, logging. Teams that record these choices as they build will have most of the 2027 paperwork in hand when it’s needed. Reconstructing it later from old tickets and commit history costs a lot more.

Fourth, watch the harmonised standards. The EU granted this delay because the technical standards firms will use to demonstrate compliance weren’t ready. The first are not expected before late 2026, and the full set now looks more like spring 2027. When they land, following them becomes the cheapest route to compliance, because conformity with a harmonised standard carries a legal presumption of conformity with the Act.

Fifth, expect questions from your customers before you hear from any regulator. Being able to answer an AI governance questionnaire well is a sales asset in 2026, whatever happens in 2027.

On the risk of further change: the new dates are fixed in the legislation, and the earlier idea of a conditional delay was dropped. Compliance firm A-LIGN put the sensible framing well: plan as though the extended deadlines will hold, while preparing as if they might not.

Meanwhile in the UK

There is still no UK AI Act. The 2026 King’s Speech contained no standalone AI bill, though the announced Regulating for Growth Bill would give regulators cross-cutting sandbox powers that cover AI and put the AI Security Institute on a statutory footing. Day to day, AI in the UK is governed by existing regulators at the point of use: the ICO for data protection (its final guidance on automated decision-making is now expected in winter 2026), the FCA in financial services, Ofcom for online safety.

The net effect for a UK software firm is simple to state. If EU customers use your product, the binding AI regulation on your roadmap is European, delay or no delay, and the UK’s lighter-touch approach doesn’t change your build decisions.

Final thoughts

The December 2027 date gives real time to anyone building genuinely high-risk features, and the right response is to spend it deliberately: inventory, classification, the August 2026 items, and a documentation habit if you’re anywhere near the high-risk list. The August 2026 obligations have not moved, and for most ordinary software products they are the rules you’ll actually meet first.

If you’re adding AI features to business software and want them designed with this regulation in mind, that’s the work we do. Our AI development services page covers how we approach it, and our roadmap for adding AI agents to existing business software is a practical companion to this piece.

This article reflects the position on 11 July 2026, while the amending regulation awaits publication in the Official Journal. We’ll update it if the dates or details change.