- Regulation (EU) 2026/1744 extends the primary compliance deadline for Annex III high-risk AI systems to December 2, 2027.
- The eight Annex III categories retain unchanged obligations for risk management, data governance, and human oversight.
- Transparency obligations under Article 50, requiring disclosure of AI interactions, took effect August 2, 2026, and were not deferred.
The EU formally extended the compliance window for standalone high-risk AI systems under Annex III of the AI Act by 16 months, to December 2, 2027. The shift does not touch transparency obligations under Article 50, which require disclosure of AI interactions and took effect August 2, 2026.
What Counts as High-Risk
The AI Act uses a four-tier risk structure: unacceptable, high, limited, and minimal or no risk. An AI system lands in the high-risk tier one of two ways. It qualifies automatically if it is a safety component in a regulated product, or if it is itself a product covered by EU harmonisation legislation in Annex I, such as medical devices or vehicles, and requires third-party conformity assessment. Alternatively, it qualifies if it falls within one of the eight use-case categories listed in Annex III, unless it demonstrably poses no significant risk to health, safety or fundamental rights. The Act’s four-tier risk structure has also become a template that other jurisdictions are studying closely.
The Eight Annex III Categories
The eight high-risk use cases in Annex III span biometric identification and categorisation, including emotion recognition systems, with a narrow carve-out for single-purpose identity verification. Critical infrastructure covers AI used as a safety component in managing road traffic, digital infrastructure or essential utility supply. Education and vocational training AI, where systems determine admission or assess learning outcomes, falls in the same tier, as does employment and worker management AI covering recruitment, promotion, termination and performance monitoring.
The remaining four categories are access to essential private and public services (creditworthiness evaluation, life and health insurance pricing, and emergency dispatch); law enforcement applications such as individual risk scoring, predictive policing and evidence authentication; migration, asylum and border control, including visa eligibility assessment and travel document verification; and AI assisting judicial authorities in interpreting facts or law.
Deadlines and What Still Applies Now
Regulation (EU) 2026/1744, approved by the Council of the European Union on June 29, 2026, sets December 2, 2027 as the new compliance date for Annex III high-risk systems. For high-risk AI embedded in regulated Annex I products, the deadline extends further, to August 2, 2028. Transparency obligations under Article 50, however, were not deferred. Those rules, requiring providers to disclose when users are interacting with an AI system, applied from August 2, 2026.
Providers of high-risk AI systems are required to establish and maintain a risk management system across the full lifecycle of the system. That means documented data governance covering training, validation and testing datasets, technical documentation sufficient to demonstrate compliance, and logging mechanisms that record events relevant to risk identification.
Conformity Assessment and Market Entry
No high-risk AI system may be placed on the EU market without first completing a conformity assessment, obtaining an EU declaration of conformity, affixing the CE marking, and registering in the EU’s high-risk AI database. For Annex III systems, the standard route is a procedure based on internal controls. For systems covered by Annex I harmonisation legislation, the assessment typically involves a notified body, a designated third-party assessor. The path to market entry for high-risk AI providers thus turns on which annex governs the system, not only on the use case.
The Compliance Gap to Close
The 16-month extension changes the schedule, not the scope. Providers and deployers still need to build human oversight into their systems, meet accuracy and cybersecurity requirements, monitor operation against documented instructions, and retain automatically generated logs. Deployers carry their own obligations independently of what providers supply. Building that operational infrastructure, connecting AI systems to the required data pipelines, documentation, logging and incident response processes, takes time regardless of when the deadline falls. December 2, 2027 is closer than it looks for teams starting from scratch.
