The EU AI Act’s high-risk system provisions were supposed to become enforceable on August 2, 2026. They didn’t. The EU’s Digital Omnibus — endorsed by Parliament on June 16, 2026 and approved by the Council on June 29, 2026 — pushed the Annex III high-risk compliance deadline back sixteen months, to December 2, 2027. The regulation, which entered force in August 2024 and has been applying progressively since, now reaches its most commercially significant enforcement milestone at the end of 2027 rather than in the summer of 2026. The companies most affected by the delay are not European — they are the US AI developers whose systems are deployed across European markets, who now have roughly eighteen extra months to close the compliance gap.
The delay does not touch every part of the Act. Article 50’s transparency obligations — disclosing that a user is talking to a chatbot, labelling AI-generated deepfakes — are unaffected and still take effect August 2, 2026 as originally scheduled. So do the general-purpose AI (GPAI) obligations for foundation models above the compute threshold, which have applied since August 2025. Only the Annex III high-risk system requirements moved. Annex I high-risk systems (AI embedded in regulated products like medical devices and machinery) were also pushed back, from August 2027 to August 2, 2028. What has become clearer in the run-up to the delay is the compliance infrastructure the European AI Office is deploying, the per-system cost of non-compliance, and the extent to which US companies have built genuinely compliant systems versus compliance documentation that does not fully reflect their actual product architecture — a gap the extra runway doesn’t close, it just changes when it gets tested.
What the High-Risk Provisions Require
Under the EU AI Act’s Article 9 and accompanying Annex III, AI systems classified as high-risk must comply with requirements across six dimensions before being placed on the EU market or put into service: risk management system, data governance, technical documentation, transparency obligations, human oversight mechanisms, and accuracy and robustness standards. For each dimension, the regulation specifies both what the system must do and what documentation must exist to evidence compliance.
The conformity assessment process — the mechanism by which a high-risk AI system demonstrates compliance before market deployment — requires either self-assessment with documentation (for most Annex III categories) or third-party conformity assessment (for remote biometric identification systems and AI used in critical infrastructure). Notified bodies authorised to conduct third-party assessments are still being accredited across EU member states, and the limited current capacity of accredited assessors has created a bottleneck for systems requiring third-party review.
The fines are structured to be meaningful: up to €30 million or 6% of global annual turnover for prohibited AI system violations, and up to €20 million or 4% of turnover for other infringements. For a company with $10 billion in global annual revenue, a 4% fine is $400 million — a number that focuses compliance attention more effectively than smaller proportional penalties have historically done in EU regulatory contexts.
US Company Exposure: The Enterprise AI Deployment Picture
The US AI companies with the largest EU exposure are not primarily consumer-facing — they are enterprise AI providers whose products are deployed inside European organisations for employment, healthcare, and financial services use cases. OpenAI, Microsoft (through Copilot), Anthropic, and Google (through Workspace AI features) are all deployed at scale in EU enterprises, often by customers who have not yet completed their own Annex III compliance assessments.
The Act’s liability architecture creates a shared responsibility between AI providers (who must ensure their systems meet the technical requirements for high-risk classification) and deployers (who bear obligations for monitoring, maintaining human oversight, and documenting their specific use case). This shared responsibility creates a compliance gap: US AI providers have been shipping technical compliance documentation and risk management frameworks, but EU enterprise deployers are often still in the process of mapping their use cases to the Act’s risk classification categories.
Microsoft has been the most publicly proactive on EU AI Act compliance, publishing its EU AI Act compliance commitments in early 2026 and offering customers pre-completed technical documentation for Copilot deployments in Annex III categories. The company’s argument — that its enterprise customers can rely on Microsoft’s conformity assessment as the provider and focus their own compliance activity on use-case documentation — aligns with the Act’s provider-deployer responsibility split but is being tested as the European AI Office publishes its first guidance on what deployer documentation must contain.
Anthropic’s position is different. Its primary EU enterprise deployments are through AWS Bedrock and Google Cloud Vertex AI (as a foundation model provider rather than an application deployer), which places the conformity assessment obligation on AWS and Google as the deploying platforms rather than on Anthropic as the model developer. This indirect deployment model may prove advantageous in the first enforcement period, as the technical documentation burden falls on the cloud platforms’ larger compliance organisations.
What Didn’t Move: GPAI and Transparency Obligations
The Annex III delay covers high-risk applications specifically. The broader GPAI (general-purpose AI) provisions — which apply to foundation models with training compute above the 10^25 FLOP threshold — have been in effect since August 2025. The open-weight model releases that Meta’s Llama 4 strategy embodies create a compliance question that has not been fully resolved: does the GPAI transparency obligation apply to the model developer (Meta) or to each organisation that deploys the open-weight model?
The European AI Office’s published guidance indicates that open-weight model developers bear reduced obligations compared to closed-model API providers, because the Act’s enforcement mechanisms assume the ability to audit the deploying entity’s model configuration — which is impossible when the weights are publicly available and can be modified arbitrarily by downstream deployers. This interpretation is favourable for open-weight model developers but creates a regulatory gap: the highest-capability open-weight models are arguably less regulated than comparable closed-API models, despite being equally capable.
This gap is not an oversight — it reflects a deliberate policy choice to encourage open-source AI development within the EU. But it creates a compliance asymmetry that enterprise buyers are beginning to notice: a company that deploys a Llama 4-based system for employment screening faces a more complex compliance path than a company using the same functionality through a closed-API provider with pre-completed conformity documentation.
The Compliance Industry Response
The EU AI Act has created a new category of enterprise software: AI compliance management platforms. Companies including Credo AI, Holistic AI, and Fairly AI have raised a combined $340 million in venture funding since the Act’s passage to build platforms that help organisations document their AI system inventory, classify risk levels, generate conformity assessment documentation, and monitor ongoing compliance obligations.
The market opportunity is substantial: every EU organisation with more than 50 employees that uses any form of AI in HR, hiring, or performance management is potentially in scope for Annex III compliance. The total EU enterprise AI software market is estimated at approximately €12 billion annually, with compliance infrastructure representing an emerging 8-12% overlay cost on top of base AI deployment budgets — a line item that enterprise IT buyers are still absorbing.
The compliance platform category is also attracting investment from the AI providers themselves. OpenAI’s enterprise product roadmap includes compliance documentation automation as a 2026 priority — using AI to generate the technical documentation required for AI systems’ own regulatory compliance. The recursive quality of this solution (AI generating compliance documents for AI deployment) is noted with dry humour in EU regulatory circles, but the practical utility is real: documentation that previously required weeks of technical writing can be generated from system architecture descriptions in hours.
Enforcement Priorities After the Delay
The European AI Office’s August 2026 enforcement activity will now focus on the requirements the Omnibus didn’t touch: Article 50 transparency (chatbot disclosure, deepfake labelling) and the GPAI obligations already in force since August 2025. Annex III high-risk enforcement — healthcare AI diagnostics, large-scale employment screening systems, and AI-assisted judicial decision support — moves to the December 2027 window. This reflects the same resource constraint that made the delay necessary in the first place: the AI Office’s enforcement division (staffed at approximately 80 people across technical and legal functions) and the National Market Surveillance Authorities in most member states are not yet equipped to evaluate complex high-risk AI systems at the volume the original timeline required.
For US AI companies, the practical implication is that the extra runway is real but not indefinite. The requirements themselves didn’t change — risk management, data governance, technical documentation, human oversight, and accuracy standards for Annex III systems are unchanged from the original text. Only the compliance deadline moved. Companies that treat December 2027 the way they were treating August 2026 — as a hard deadline to build toward, not a date that might move again — will be in a stronger position when enforcement actually starts.
The companies treating this as a compliance journey rather than a single deadline are in the right frame. The EU AI Act’s enforcement will compound over time regardless of which year it begins. The AI companies that invest in genuine compliance infrastructure now are building a competitive advantage in the EU market that competitors who wait for the next possible delay will struggle to replicate under enforcement pressure.
The Gap Between What the EU AI Act Says and What Gets Enforced
JockoWillink’s principle: the plan meets reality at the moment of execution. The EU AI Act was passed after four years of negotiation and represents the most comprehensive statutory AI governance framework currently in force. The implementation schedule, the risk tier classifications, the conformity assessment requirements for high-risk systems — these are detailed and specific on paper. What happens when an enforcement authority tries to apply them to a production AI system running inside a US company’s EU operations is a different question entirely.
The high-risk classification is the most consequential tier. Systems used in employment, essential services, critical infrastructure, law enforcement, migration, and justice must undergo conformity assessment before deployment, maintain a technical documentation file, implement human oversight mechanisms, and be registered in an EU database. A US company deploying an AI system that touches employment decisions in its EU operations — which covers most large enterprises using AI in HR workflows — is nominally subject to the full high-risk requirement stack.
The enforcement gap is structural. The Act assigns authority to National Market Surveillance Authorities in each EU member state — bodies that, in most countries, do not yet have the technical staff to evaluate a complex AI system’s conformity with the Act’s requirements. Germany’s BNetzA and France’s ANSSI have been building capacity. Most smaller member state authorities have not. A US company operating AI across multiple EU countries faces a fragmented enforcement landscape where the practical risk of enforcement varies by jurisdiction by an order of magnitude.
JockoWillink’s observation is not that the law is unenforceable. It is that enforcement capability and enforcement intent are different things, and the early years of a major regulatory regime are characterised by compliance-by-posture rather than compliance-by-substance. Companies that can demonstrate they took the Act seriously — the documentation, the human oversight logs, the conformity assessments on file — will be treated more leniently in the first enforcement wave than companies that made no visible effort, regardless of whether the underlying systems are materially different. Discipline is visible before outcomes are.
Enterprise deployments at the scale of KPMG’s 276,000-employee Claude rollout are precisely the category of system the Act’s employment-decision tier was written to govern. How KPMG and its peers document those deployments, structure human oversight, and engage with National Authorities in their EU jurisdictions will establish the practical compliance standard the rest of the market follows. The enforcement gap doesn’t eliminate the compliance requirement. It shapes what compliance looks like in practice before the first major enforcement action establishes what it will look like in law.
The companies that will be in the best position when enforcement actions begin are the ones treating the Act as an operational reality now — not a future problem to be managed when it becomes urgent. The Act’s implementation timeline has already moved once, from August 2026 to December 2027, and could move again. The enforcement authority build-out is observable and, by the Omnibus’s own logic, still lagging. There is no excuse for being caught unprepared when enforcement finally arrives. Execution now is cheaper than remediation later.
