The EU AI Act compliance decision that cannot wait for December 2027

The headline the board saw: high-risk deadlines moved to December 2027

I went looking for fresh EU AI Act news this week and found something more useful than news: silence. Between June 7 and June 10 there was no formal adoption vote, no Official Journal publication, no new enforcement action. The last real headline was the May 7 provisional agreement on the Digital Omnibus, the amendment package that pushes the high-risk rules out past next year. The Council’s own press release laid out the new dates the same day.

Most boards read that headline as relief. The compliance program got sixteen extra months, the budget conversation got easier, and the topic slid down the agenda. That reading is roughly half right. The half that is wrong has a deadline thirteen days from now.

What the deferral moved, and what EU AI Act compliance still requires this summer

The deferral is real. Covington’s Global Policy Watch summarized it on June 2: the Annex III high-risk obligations, the ones covering hiring tools, credit scoring, biometrics, education, and critical infrastructure, are

The same analysis notes the package still needs formal sign-off, with “final approval anticipated in June and publication expected in July.” Until it lands in the Official Journal, August 2 technically remains the law, a gap I wrote about in late May. Assume the dates hold anyway. Three things still did not move.

First, transparency. Tech Jacks Solutions’ AI brief pointed out on June 3, the day the Article 50 consultation closed, that the transparency obligation for newly deployed AI systems was not among the deferred items. Chatbot disclosure and synthetic-content labeling for new systems still arrive August 2, 2026.

Second, registration. Covington again, verbatim: “The obligation to register high-risk AI systems in the EU database remains in place.”

Third, and this is the one I would put on a board agenda: classification. On May 19 the Commission published draft guidelines on what counts as high-risk under Article 6, and opened a consultation that closes June 23 at 22:00 Brussels time.

A 167-page draft is the Commission’s way of saying “it depends” at scale. And the thing it depends on should get attention now, not in 2027. Lewis Silkin’s read of the draft is the load-bearing detail: classification turns on intended purpose, and intended purpose is read from instructions for use, promotional and sales materials, public statements, and technical documentation. Decisions made well before deployment. In other words, the marketing site is compliance evidence.

Three questions a Series C board will ask about high-risk classification

Are any of our systems plausibly high-risk under the draft? For most B2B AI companies the honest answer is “one or two, maybe.” Anything touching hiring, credit, access to education or essential services, or biometric identification sits in Annex III territory. “Maybe” is not a comfortable answer in a board pack, but it is exactly the ambiguity the consultation exists to resolve.

Should we file feedback by June 23? If the draft’s practical examples leave a product category ambiguous, yes. The Tech Jacks analysis from May 29 framed the stakes plainly: organizations that participate have had a hand in writing the guidance, and those that do not have accepted someone else’s definition of what their AI systems are. Only responses through the Commission’s online questionnaire count toward the final summary report. A focused two-page submission is enough. Enterprise procurement teams will eventually ask how classification was determined, and “we reviewed the draft and filed our interpretation” is a much stronger answer than “we waited for the final version.”

What does getting it wrong cost? It cuts both ways. Calling a high-risk system minimal-risk invites enforcement exposure and customer-trust damage in 2027, when the registration database makes the claim public. Calling a minimal-risk system high-risk buys an unnecessary compliance program at exactly the stage where every engineer-month is contested. The classification call is a real capital-allocation decision, which is why it belongs with the board and not only with outside counsel.

The 60-second brief for the next board call

The high-risk deadlines moved to December 2027 and the move is credible. We are not standing down, because the question that decides whether those obligations apply to us at all is being answered now. The Commission’s classification guidance consultation closes June 23. We have mapped the draft against our products, we are filing feedback where our category is ambiguous, and our documentation and marketing now describe intended purpose in language we are prepared to defend. Transparency duties for newly deployed systems still begin August 2. Registration stays. The deferral bought us time to build. It did not buy us permission to look away.

The Omnibus moved the deadline for complying. It did not move the deadline for deciding what your systems are.

What to watch between now and December 2

Parliament’s final vote on the Omnibus, expected by early July, then publication in the Official Journal with entry into force three days later. The final classification guidelines, which will follow the June 23 close and set the frame every Annex III program gets designed around. And the December 2 activation of the new prohibitions and legacy labeling rules.

Here is what I keep coming back to. Quiet regulatory weeks feel like permission to think about something else, but they are usually when the durable positions get taken. The companies that will walk into 2027 calm are not the ones with the biggest compliance budgets. They are the ones who decided, on the record and in their own words, what their systems are for. That decision is open for thirteen more days, and it costs two pages.