The Council of the European Union and European Parliament negotiators reached a provisional agreement last week to push back compliance deadlines for high-risk AI systems under the EU AI Act, moving the application date from August 2026 to December 2, 2027 for stand-alone high-risk systems. The affected category includes AI systems used in high-risk areas such as biometrics, law enforcement, border control, migration and asylum processing, education, employment, and critical infrastructure.
A separate deadline applies to AI embedded in regulated products under Annex I, covering sectors such as medical devices, machinery, toys, lifts, and watercraft, which will now apply from August 2, 2028. The deepfake transparency requirement retains a December 2, 2026 deadline. The provisional agreement also adds new prohibitions on AI systems used to generate non-consensual sexually explicit or intimate content and child sexual abuse material.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy at the European Commission, said the agreement is intended to make implementation easier while maintaining safety requirements. The agreement is part of the broader Digital Omnibus package, which is designed to simplify parts of the EU’s digital rulebook and reduce compliance burdens. The package also expands some support measures for small and mid-cap enterprises and adjusts access to regulatory sandboxes.
The provisional agreement follows the European Parliament’s 569-to-45 vote in March 2026 to extend high-risk AI deadlines. The text still requires endorsement by the Council and Parliament, followed by legal and linguistic revision, before formal adoption.
The 16-month extension shifts the compliance timeline for facial recognition systems, AI-assisted border control tools, and biometric identification applications deployed across EU member states. Europol has called for a balanced approach to AI and facial recognition in policing, reflecting ongoing regulatory debate over how law enforcement agencies should be governed under the high-risk framework. The revision accompanies proposed GDPR reforms aimed at reducing compliance burdens on businesses across the single market.
Technical standards remain a central part of the AI Act implementation process. The EU’s consultation on AI Act definitions and prohibited uses, including high-risk biometric categories, addressed definitional questions affecting standardization bodies and compliance tool providers.
Sources: Council of the European Union, European Commission
–
By Ali Nassar-Smith
