The EU AI Act high-risk deadline moved to December 2027

The EU AI Act's obligations for high-risk AI systems were due to apply from 2 August 2026. They now apply from 2 December 2027.

The change came through the Digital Omnibus on AI, which was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the original deadline. It moved the Annex III standalone high-risk categories, which include recruitment, education, credit scoring and insurance pricing, out by sixteen months. AI embedded in products already covered by EU product safety law moved from 2 August 2027 to 2 August 2028.

The European Commission's own page now states that the rules for high-risk use cases in certain sensitive areas apply from 2 December 2027.

One detail matters commercially: the deferral is unconditional. It is not tied to harmonised standards being ready or to any other trigger, so it will not snap back early.

The deferral covers the high-risk regime. It does not cover everything, and three sets of obligations are already live and enforceable.

Penalties have applied since 2 August 2025. Breaching a prohibited practice carries up to 35 million euro or 7% of worldwide turnover. High-risk non-compliance carries up to 15 million euro or 3%. Both are the higher of the two figures for an ordinary undertaking and the lower of the two for a small or medium enterprise, under Article 99(6), which is real relief and not immunity.

Article 5 bans placing on the market, putting into service or using AI systems that infer the emotions of a person in the workplace or in an education setting, outside narrow medical and safety exceptions.

This has been in force since February 2025. It is not deferred, and it carries the heaviest penalty tier in the Act.

It is also the one the Workplace Relations Commission has named specifically. The WRC is Ireland's designated market surveillance authority for employment-related AI, and its own page identifies emotion inference about workers and job applicants as within its remit.

If any part of your hiring process runs video interviews through software that scores candidate sentiment, confidence or engagement, that is the provision to look at first. Not in December 2027. Now.

Article 4 requires providers and deployers to take measures that support the development of AI literacy among staff who use AI on their behalf. Regulation (EU) 2026/1744 rewrote it on 27 July 2026 and added that the obligation does not require anybody to guarantee a specific level for any individual.

Before that date the wording was to ensure a sufficient level. It is a duty of effort now rather than a duty of result, and any policy drafted before late July 2026 overstates it. There is still no prescribed course, no certificate and no accreditation to buy.

That makes it cheap to satisfy and easy to neglect. CIPD Ireland's 2026 survey of Irish HR practice found that only 33% of organisations offer AI training and only 44% give staff clear guidance on AI use. On those numbers, most Irish employers have done nothing on a duty that has been live since February 2025.

Annex III lists the standalone high-risk categories. Point 4 covers AI used for recruitment and selection, including targeted job advertising, filtering applications and evaluating candidates, and AI used to make decisions on promotion, termination, task allocation or monitoring performance. Point 5 covers creditworthiness evaluation and risk pricing for life and health insurance.

If that describes something you use, the important question is whether you are a deployer or a provider, because the obligations are very different.

Most businesses buying an off-the-shelf tool are deployers. Article 26 requires a deployer to use the system according to its instructions, assign human oversight to someone competent and supported, keep automatically generated logs for at least six months, monitor operation and report serious incidents, and tell affected people they are subject to the system. Employers must inform workers' representatives and affected workers before putting a high-risk system into service at the workplace.

Two of the heavier duties do not apply to most private businesses. The fundamental rights impact assessment under Article 27 binds public bodies, private entities providing public services, and deployers of credit scoring and life or health insurance systems. Registration in the EU database under Article 26(8) applies to public authority deployers. A private recruitment agency or employer is outside both.

Ireland has taken a distributed approach rather than creating one AI regulator. Existing sectoral regulators supervise AI in their own areas. The designating instrument is S.I. No. 366 of 2025, given under the Minister's seal on 25 July 2025 with notice of its making published in Iris Oifigiúil on 29 July 2025. Read in full it designates the Minister, six market surveillance authorities, the Central Bank and the Data Protection Commission. The Department publishes a working list of fourteen, and four of the bodies on that list do not appear in S.I. No. 366 of 2025. We set out that gap separately rather than guessing at the instrument that closes it.

That means your AI Act regulator depends on what you do. The Workplace Relations Commission covers employment. The Central Bank covers regulated financial services. The Data Protection Commission covers personal data.

The Regulation of Artificial Intelligence Act 2026 established the AI Office of Ireland. The Department confirms it was signed into law by President Connolly on 21 July 2026, and the Oireachtas register records the Bill as enacted. The Office coordinates the designated authorities and acts as the single point of contact for the European Commission, the sectoral regulators and the public. It is new: its first chief executive, Paul Byrne, was announced on 30 July 2026, and it was to be operational by 2 August 2026.

Practically, there is not yet an enforcement pipeline to point at. No Irish enforcement action has been published at the time of writing. Sectoral guidance has started: the WRC has an AI Act page of its own, and it has said its fuller public guidance will follow as the implementation framework matures.

The deferral is not a reason to do nothing, but it is a reason to do the cheap work first and leave the expensive work until it is needed.

Four moves are worth making this year, and none of them requires a consultant to start.

Buying an AI tool makes you a deployer. Building on top of one can make you a provider, with the full weight of Article 16 obligations: risk management, data governance, technical documentation, conformity assessment.

Article 25 sets out when that happens. You become a provider if you put your own name or trademark on a high-risk system already on the market, if you make a substantial modification to it, or if you modify the intended purpose of an AI system so that it becomes high-risk.

The third one is the trap. A general-purpose model is not high-risk. Wire it into a workflow that screens job applications and you have modified its intended purpose into an Annex III use, and the obligations that follow are the developer's, not the buyer's.

This is not hypothetical for Irish SMEs. It is what happens when somebody automates CV sifting with a general assistant because it was quicker than buying a recruitment tool.