Since 27 July 2026 the EU AI Act’s high-risk obligations for Annex III systems apply from 2 December 2027 instead of 2 August 2026, and Annex I product-embedded systems from 2 August 2028. Transparency obligations under Article 50 were not delayed and have applied since 2 August 2026; general-purpose model obligations have applied since August 2025. If your plan was built around August 2026, here is how to re-plan it.
First, re-check which tier you are in
The delay changed dates, not scope. Employment screening, credit scoring, education, biometrics and essential services are still Annex III; a chatbot is still Article 50; a model you train and supply to others is still Chapter V. Run the applicability checker per system, including AI features inside SaaS tools you deploy, and record the result. The record is what a customer questionnaire or a market surveillance authority will ask for first.
Then build the documentation skeleton while it is cheap
A high-risk provider needs a risk management system (Article 9), data governance (10), technical documentation per Annex IV (11), logging (12), instructions for deployers (13), human oversight (14), accuracy and robustness (15) and a quality management system (17). The expensive part is not writing these; it is reconstructing them for a system that has been in production for two years with no records. The AI system register produces the per-system record and the Annex IV outline now, so the engineering work fills in headings rather than starting from a blank page.
Use ISO 42001 as the management system
Article 17 asks for a quality management system; ISO/IEC 42001 is the certifiable one that maps onto it, and its impact assessment (Clause 6.1.4) is close to what Article 27 asks deployers for. Starting the Statement of Applicability and the risk register in the first quarter leaves time for the internal audit and management review before the deadline, with an external certificate as the by-product.
What to do by year end anyway
Article 50 is already in force: interaction disclosures in every assistant, machine-readable marking on generated content (grace period for pre-August systems ends 2 December 2026), deepfake labelling. AI literacy under Article 4 has applied since February 2025 and is the easiest finding to avoid: a training record per role. Neither waits for 2027.