EU AI Act deferral: what US companies still owe in 2026, and how to use the extra time

August 2, 2026 was supposed to be the day the EU AI Act's high-risk obligations became binding. Eleven days before that date, the Digital Omnibus on AI moved most of those obligations out by sixteen months or more, while leaving several duties exactly where they were. For US companies with EU users, the practical question is not "did we get a reprieve" but "which clocks are still running, and what should we build while the others are paused." This post is general guidance, not legal advice; confirm your specific position with counsel.

What the Digital Omnibus changed

Regulation (EU) 2026/1744, the "Digital Omnibus on AI", was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. It defers the compliance dates for high-risk AI systems in two tracks:

• Standalone high-risk systems (Annex III) — for example, systems used in employment, credit, education, or essential services — move from August 2, 2026 to December 2, 2027.
• AI embedded in products already covered by EU product-safety law (Annex I) — machinery, medical devices, and similar — move to August 2, 2028.

The deferred obligations are the ones most teams were scrambling on: the provider requirements in Articles 9 to 17 (risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy and robustness) and the deployer requirements in Article 26.

What did not move

Three parts of the regime still apply from August 2, 2026 or are already in force:

• Article 50 transparency and AI-content-labeling duties. If a person is interacting with an AI system, or content is AI-generated or manipulated, the disclosure and labeling obligations apply on the original schedule.
• General-Purpose AI (GPAI) provider obligations, in force since August 2025.
• Article 5 prohibited practices, in force since February 2025. These do not have a grace period, and they are the provisions with the least room for interpretation.

If your product is a chatbot, a voice agent, a content generator, or anything that produces synthetic media for EU users, the deferral changes very little about what you must do this year.

Who is in scope

The AI Act applies based on where the output is used, not where the company is incorporated. US companies serving EU users or markets are in scope. That includes SaaS products with EU customers, agencies building AI features for EU clients, and internal tools used by EU-based employees. The Omnibus did not narrow that reach; it only changed timing for the high-risk categories.

A useful framing for engineering leaders: treat "EU user" as a data-residency-style attribute of a request, and make sure you can answer, per system, whether any EU user can reach it.

What to do this quarter

The deferral is time to do the work properly rather than time to do nothing. A short checklist:

• Inventory every AI system in production or pilot, including vendor-supplied models and embedded features. Record who owns it, who uses it, and whether EU users can touch it.
• Classify each system against Article 5 (prohibited), Annex III (standalone high-risk), Annex I (product-embedded), and Article 50 (transparency). Write the reasoning down, not just the label.
• Ship transparency and labeling now. Disclose AI interaction where required and label generated content. This is due, and it is usually cheap.
• Start the documentation set for anything likely to be high-risk: intended purpose, training and evaluation data description, known limitations, performance metrics, and change history. Documentation written after the fact is always worse.
• Design human oversight into the workflow: who can stop the system, who reviews consequential outputs, and how an override is recorded.
• Turn on logging that captures inputs, outputs, model version, and the decision path for every consequential action, with retention that matches how long you may need to reconstruct an event.
• Assign an owner for each system with a named review date, so the December 2027 and August 2028 dates do not arrive as surprises.

Why governance belongs in the architecture

Most compliance failures we see are not about missing policy. They are about systems that were never built to answer basic questions: what did the model see, what did it produce, which version was running, and who approved the result. Retrofitting those answers onto a system that streams outputs straight into a customer channel is expensive and usually incomplete.

The alternative is to make governance a property of the architecture:

• Every consequential action passes through an approval gate where a person can accept, edit, or reject before it leaves the business.
• Every task, decision, and tool call writes to a structured audit trail that a non-engineer can read.
• Spend and scope are constrained by hard ceilings so a misbehaving agent stops rather than escalates.
• Human oversight is a default path, not an emergency procedure.

Built this way, Article 14-style human oversight and Article 12-style record-keeping are not separate projects. They fall out of the system's normal operation, and the same controls also happen to make the system easier to debug and cheaper to run.

How XISLABS approaches this

XISLABS designs, builds, and operates AI systems, with 74+ projects across 7 countries, and we treat approvability as a design constraint rather than a launch-week checklist. Our practice is to baseline the current process, instrument the system, evaluate before launch, keep a human in the loop by design, and operate the system after it ships.

• For scoping and classification work, our AI consulting and strategy engagements produce the inventory and reasoning that later documentation depends on.
• For customer-facing systems that fall under Article 50, our AI chatbot development and AI voice agents work builds disclosure and logging into the conversation layer from the first version.
• For autonomous workflows, our AI agent development and AI workflow automation services use approval queues, budget caps, and audit trails as standard components.
• For teams adding models to existing products, AI integration services cover the version pinning, evaluation, and record-keeping that high-risk documentation will eventually require.

Our product My Cloud Company is the worked example: a managed team of AI agents where anything that leaves the business waits in an approval queue, spend stops automatically at a monthly cap, and every task, decision, and tool call is in the audit trail. If you want to talk through where your systems land under the new dates, contact us.

Sources

• Gibson Dunn — EU AI Act Omnibus agreement: postponed high-risk deadlines and other key changes
• Travers Smith — EU agrees to delay key AI Act compliance deadlines
• Holland & Knight — US companies face EU AI Act's possible August 2026 compliance deadline
• Cloud Security Alliance — Research note: EU AI Act high-risk deadline and the Omnibus