The EU blinked on AI. Use the extra 16 months to build, not wait

On 1 August I wrote that the EU AI Act's enforcement deadline was a redesign brief. What I missed: five days earlier, Brussels had moved it. The Digital Omnibus on AI, in force since 27 July 2026¹, pushed the rules for high-risk systems out by 16 months. Plenty of teams read that as permission to stop. I read it as the most useful gift a regulator has given AI builders this year: time to design the oversight in, instead of bolting it on in a panic.

What did the Digital Omnibus change in the EU AI Act?

The headline is the calendar. Rules for standalone high-risk systems, the ones used in hiring, education, credit scoring, health and life insurance pricing, access to public benefits and emergency triage, now apply from 2 December 2027 instead of 2 August 2026. AI built into products that already have EU safety rules, such as medical devices, moves to 2 August 2028¹.

It took one of the fastest passages Brussels has managed. Parliament adopted the deal on 16 June by 423² votes to 57, the Council approved it on 29 June, and it was published in the Official Journal on 24 July. The Omnibus also eased paperwork for small and mid-sized companies and added one new ban, on AI that generates non-consensual intimate images or child abuse material².

What did not move

Three things stayed exactly where they were, and they are the ones that bite first.

The bans have applied since February 2025: manipulation that causes harm, exploiting people's age, disability or money worries, social scoring, and reading emotions at work or in school. Breaking them can cost up to €35M or 7% of global turnover.

The transparency rules started on 2 August 2026. People must be told when they are talking to an AI, and AI-generated content must be marked. Systems that were already on the market before that date have until 2 December 2026¹ to add machine-readable marking. That is six weeks away.

And the reach did not change. The Act follows the user, not the headquarters. A team in Dhaka or Detroit whose product reaches people in the EU is in scope, wherever its servers sit.

Why the delay helps builders, not laggards

Compliance done in a hurry is a legal patch: a disclosure page, a policy, a checkbox. Compliance done with time is architecture: a log of every decision, a named person who can override the system, a way for people to appeal. The first fails the moment a regulator asks how a decision was made. The second is just a well-run product.

I have seen that difference in money. At Praava Health, the fix for a broken referral model was not a policy memo. We rebuilt referral and pricing around transparent economics, and lab margins moved from about 30% to 50%. Building the honest version into the operating model was cheaper than defending the old one. The AI Act rewards the same instinct, and 16 extra months is enough to do it properly.

What I would build before 2 December 2027

If I ran an AI product that might be high-risk, here is the order I would work in:

• Triage every use case now. Know which of your systems are banned, high-risk, transparency-only or minimal. My free AI use-case risk triage does a first pass in ten questions.
• Ship the transparency rules first. They are already in force, and the marking deadline is 2 December 2026. Tell people when they are talking to an AI, and label what it makes.
• Log decisions from day one. Input, output, model version and time, for every decision that matters to a person. You cannot add a history you never recorded.
• Name a human owner. One person who answers for each system and can stop it.
• Build the appeal path. A plain way for someone to question a result and reach a person. Colorado will require one for consequential decisions from 1 January 2027 anyway³.

This is not theory for me. Ask Shafaat, the AI assistant on this site, tells visitors it is an AI, keeps an anonymous log of every question and answer, and has an off switch that hands people to a guided advisor. It is a small system, and it still needed all three.

The short version

• The Digital Omnibus, in force since 27 July 2026, moved high-risk AI rules to 2 December 2027, and to 2 August 2028 for AI inside regulated products.
• The bans and their €35M or 7% fines have applied since February 2025 and did not move.
• Transparency rules started on 2 August 2026, with until 2 December 2026 to mark AI content from systems already on the market.
• The Act still follows the user, so teams in Bangladesh or the US serving people in the EU are in scope.
• Use the 16 months to build logging, a human owner and an appeal path into the product, not to wait.

If a regulator asked tomorrow how your AI made one specific decision, could you show them, step by step?

Md Shafaat Ali Choyon (MPH, CHES®, MBA, MCIM) is a growth, marketing and public-health strategist who builds and runs AI in production, with 17 years across telecom, fintech, e-commerce, consumer tech and healthcare in the US and Bangladesh. See the essays or the portfolio.