EU AI ACT · 9 MIN READ

EU AI Act: High-Risk AI Requirements Are Moving Closer.

For organisations that develop or deploy potentially high-risk AI, the practical challenge is turning regulatory requirements into inventories, controls, evidence and accountable operating processes.

INTAI Research · Published 14 July 2026

Read the Update

A Longer Runway, Not a Lower Bar

Following the EU’s May 2026 Digital Omnibus agreement, obligations for Annex III high-risk AI systems, the use-based category spanning areas including employment decisions, access to essential services, credit scoring and law enforcement, now apply from 2 December 2027 rather than the originally scheduled 2 August 2026, a sixteen-month deferral. Annex I high-risk systems, embedded in already-regulated products such as medical devices and lifts, now have until 2 August 2028.

The substance of what a high-risk system must demonstrate has not changed, and the deferral does not reduce the scope of what will eventually be required. It simply extends the amount of time organisations have to build it properly, which makes the practical question less “how do we meet an August 2026 deadline” and more “how do we use the additional runway to build genuinely durable evidence, rather than a rushed compliance exercise.”

What a High-Risk System Actually Needs to Show

The requirements attaching to high-risk AI systems are demanding precisely because they are meant to produce evidence, not merely intention. A provider of a high-risk system needs a documented risk management system covering the system’s full lifecycle, technical documentation sufficient for a regulator to understand how the system works and was tested, data governance controls over the training, validation and testing data used, and logging capability that allows the system’s outputs to be traced after the fact.

Deployers, organisations that use a high-risk system built by someone else, which is the position most enterprises will actually be in, carry a distinct but related set of obligations: using the system in accordance with its instructions, ensuring genuinely competent and empowered human oversight rather than a nominal reviewer, and monitoring the system’s operation for the kind of drift or malfunction that would require it to be taken out of service. Conformity assessment, either self-assessed or, for some categories, requiring a third-party notified body, and registration in the EU’s public high-risk AI database round out the core obligations.

Central Insight

The organisations best positioned for the 2027 and 2028 deadlines are not the ones waiting for the deadline to approach before starting. They are the ones treating the deferral as an opportunity to build the underlying inventory, risk classification and evidence-generation capability now, so that by the time the obligations bind, compliance is a matter of demonstrating an established practice rather than assembling one under time pressure.

The Practical Starting Point

For most organisations, the realistic first step is not a full conformity assessment programme. It is an honest classification exercise: which of the AI systems currently in use, or in the pipeline, would plausibly fall under Annex III or Annex I, given how they are actually used rather than how they were originally marketed.

From there, the priority is building the specific evidence categories a regulator or auditor will eventually ask for, a defined risk management process, technical documentation maintained as the system evolves rather than written once at launch, and human oversight that can be demonstrated to have genuine authority, information and time to intervene, not simply a named reviewer whose role exists on paper. The deferral has bought time. It has not changed what “ready” will eventually need to look like.