Guillaume Lebedel · · 6 min 
EU AI Act Deadline Moved to 2027. Agent Access Didn't.
Table of Contents
Most AI Act programmes inside IT and finance teams were built around one date: 2 August 2026. That date is five days away, and the high-risk work everyone was racing toward is no longer due on it.
On 29 June 2026 the Council of the European Union gave final approval to the Digital Omnibus on AI. Stand-alone high-risk systems listed in Annex III now have until 2 December 2027 rather than 2 August 2026. High-risk systems embedded in regulated products under Annex I moved from 2 August 2027 to 2 August 2028. The European Parliament had backed the text on 16 June by 423 votes to 57, with 174 abstentions.
Sixteen extra months on the heaviest file. Very little else changed.
What the EU AI Act deadline shift actually covers
| Obligation | Old date | New date |
|---|---|---|
| High-risk, stand-alone (Annex III) | 2 August 2026 | 2 December 2027 |
| High-risk, embedded in regulated products (Annex I) | 2 August 2027 | 2 August 2028 |
| Article 50 transparency | 2 August 2026 | Unchanged |
| Article 4 AI literacy | In force since 2 February 2025 | Unchanged |
Article 50 transparency duties stayed where they were. From 2 August 2026 you still have to tell people when they are interacting with an AI system, and mark generated audio, image, video and text so a machine can detect it. Generative systems already on the market get until 2 December 2026 for the machine-readable marking. Article 4, the AI literacy duty, has applied since 2 February 2025 and the Omnibus did not touch it.
Two readings of the change are worth having open side by side: the AI Act Blog on which obligations were postponed and which were not, and Gibson Dunn’s note on the postponed high-risk deadlines and the rest of the Omnibus package.
So something is still due next week. It is narrower than the classification, risk-management and record-keeping work most teams scoped for 2 August, which is why several of those programmes have gone quiet in the past month.
AI agent access controls did not move with the deadline
The deferral changes when a regulator can ask you for a file. It changes nothing about what your agents can already do inside your systems of record.
IBM’s Cost of a Data Breach 2025 looked at 600 breached organisations between March 2024 and February 2025. Thirteen percent of them reported a breach of an AI model or application, and 97% of that group reported having no AI access controls in place. Not weak controls. None.
The surrounding numbers point the same way. 63% of breached organisations either had no AI governance policy or were still writing one, and of those that did have a policy, only 34% ran regular audits for unsanctioned AI.
None of those gaps close because a deadline moved. The Cloud Security Alliance found that more than half of organisations still have no systematic inventory of their AI systems, which is the part that hurts most: a deployer obligation you cannot start late. Whatever you have to file in December 2027 gets assembled from evidence you either captured along the way or did not.
How an agent write ends up with no audit trail
The incidents IT leads report are rarely breaches. They are single writes into a system of record that nobody can trace back to a person. The shape is consistent:
- A functional lead builds an agent in a low-code tool the company already pays for, so no new vendor review is triggered and IT never sees it.
- The agent needs to do something useful, so it gets credentials. Usually a service account, usually scoped far wider than the one task.
- It acts. The write succeeds. The log, where there is one, records that a service account did it.
Nothing in that sequence is a security failure in the usual sense. Every step was somebody being reasonable. The result is an action in your HRIS or CRM with no attributable actor behind it, which is exactly the thing an Annex III file has to be able to reconstruct. The same failure mode showed up when an agent ran for two weeks on a human contributor’s credentials in the Fedora project: the model was fine, the identity was borrowed.
The usual answer is an approval step. That works until the volume rises. Approval prompts degrade as attention degrades, and an agent doing forty routine updates a day trains its reviewer to click yes.
What to build before the AI Act high-risk deadline in December 2027
Three pieces of work carry over regardless of what the final Annex III timetable looks like.
Inventory. A list of every agent that can write to a system of record, who owns it, and which credential it uses. Most teams discover more entries than they expected, and the low-code ones are the hard part because they never appeared in procurement.
Per-action credentials. A service account that can read the whole employee table because one agent needed a start date is the same problem as a shared admin password, just harder to spot. Scope belongs at the action, not the connection.
Action-level logs. The evidence a high-risk file is built from is per-action: what was read, what was written, to which system, under whose authority. An agent audit trail is a different artefact from model evaluation results, and it is the part of AI Act compliance that lives at the action layer.
That last piece is why we built StackOne where we did. Our platform works at the action layer rather than the model layer: an agent asks for a specific action, gets a credential scoped to that action, and the call lands in an audit trail you can query afterwards. The behaviour is the same across all 450+ connectors, so the record does not depend on which HRIS or CRM sits underneath. None of that makes you compliant on its own. It means the evidence exists when someone asks for it.
Common questions about the new dates
When is the EU AI Act high-risk deadline now? 2 December 2027 for stand-alone systems in Annex III, and 2 August 2028 for high-risk systems embedded in products regulated under Annex I.
Does anything still fall due on 2 August 2026? Yes. Article 50 transparency obligations were not postponed, so disclosure and machine-readable marking of generated content still start then, with a grace period to 2 December 2026 for generative systems already on the market.
Does the deferral change what we should log? No. Deployer evidence is captured while agents run, not assembled retrospectively, so per-action records of what an agent read and wrote are worth the same in December 2027 as they were in August 2026.
Where to start before December 2027
If you own AI risk for a 200 to 10,000 person company, the useful move this week is not a new gap analysis against a 2027 date. It is opening the inventory question: which agents can write to a system of record today, and for each one, can you name the human accountable for the write?
If the answer is uncomfortable for more than a couple of them, our integration engineers can walk through how scoping and logging work at the action layer on a live system. Bring your messiest service account.