Law delaying EU’s ‘high-risk’ AI rules finalised

The rules on high-risk AI systems, contained in the EU AI Act, were due to come into effect on 2 August 2026. However, the AI Omnibus – which is awaiting formal publication in the Official Journal of the EU after the European Parliament and Council of Ministers finalised the text – provides for this implementation date to be pushed back.

Under the impending new law, the rules applicable to stand-alone high-risk AI systems will apply from 2 December 2027, while the rules regarding high-risk AI systems embedded in products will apply from 2 August 2028.

The ‘high-risk’ AI regime is one of the most significant features of the EU AI Act with cross-sector relevance. Broadly, it imposes obligations on providers, deployers, importers and distributors of high-risk AI systems around matters such as risk management, data quality, transparency, human oversight and accuracy, as well as registration, quality management, monitoring, record-keeping, and incident reporting. Pinsent Masons has developed a guide to help businesses understand what constitutes a ‘high-risk’ AI system.

The AI Omnibus package provides for a series of other changes too. For example, there are regulatory exemptions for small mid-cap companies (SMCs) and overlapping requirements for AI embedded in regulated products have been removed, which reflects long‑standing industry concerns about duplicative compliance burdens. AI practices regarding the generation of non-consensual sexual and intimate content or child sexual abuse material will also be prohibited.

A deadline that providers of generative AI models had to ensure that the output from those systems is labelled as artificially generated, such as through watermarking, has also been extended. The new deadline, which is applicable to providers whose gen-AI models are released before 2 August 2026, will be 2 December 2026.