EU AI Act Timeline Extended: What Professional Services Firms Need to Know About the December 2027 Deadline

A provisional agreement reached on 7 May 2026 has shifted one of the EU AI Act's most significant compliance deadlines by more than sixteen months. For professional services firms operating in or serving clients within the EU, this is not an invitation to pause — it is an opportunity to get ahead of obligations that will eventually land regardless.

Here is what has changed, what remains fixed, and what your firm should be doing now.

What the Digital Omnibus Agreement Actually Changes

The "Digital Omnibus" package, pending formal adoption at time of writing, defers the application deadline for high-risk AI systems listed under Annex III of the EU AI Act from 2 August 2026 to 2 December 2027. Annex III covers AI systems used in consequential decisions affecting people — hiring and recruitment tools, credit scoring, biometric identification, and access to essential services. These are precisely the kinds of systems that accountancy practices, HR consultancies, legal firms, and marketing agencies are increasingly deploying or procuring.

For high-risk AI embedded in regulated products — medical devices, machinery, and similar hardware covered by Annex I — the transition period extends further, to 2 August 2028.

This is a material change. Many firms had been working towards the August 2026 deadline. The extension provides breathing room, but it does not alter the substance of what will be required.

What Has Not Changed

It is worth being equally clear about what remains in force.

Prohibited AI practices have applied since 2 February 2025. These include AI systems that use subliminal techniques to distort behaviour, exploit the vulnerabilities of specific groups, infer emotions in employment or educational settings, or build facial recognition databases through untargeted scraping. The Digital Omnibus added a further prohibition: AI systems used to generate child sexual abuse material or non-consensual sexual or intimate content.

These prohibitions carry the highest penalties under the Act and are not subject to any timeline extension. If your firm uses, procures, or advises on AI systems that touch any of these categories, that exposure is live now.

Rules for General-Purpose AI (GPAI) models and their associated governance provisions have also been in force since 2 August 2025. If your firm deploys or builds on GPAI — which, in practice, means most firms using large language model-based tools — obligations around transparency, technical documentation, and copyright compliance already apply.

AI literacy obligations for staff also became applicable on 2 February 2025. This is frequently overlooked, but regulators are paying attention to it.

The Compliance Requirements That Await You at December 2027

When the Annex III deadline arrives, providers of high-risk AI systems must demonstrate conformity through a formal assessment process. This involves evidence of adequate risk assessment and mitigation, use of high-quality datasets, activity logging, detailed technical documentation, and meaningful human oversight mechanisms. These are not box-ticking exercises — they require structured governance processes, clear accountability, and documented decisions.

Deployers of high-risk AI systems face an additional obligation: conducting a Fundamental Rights Impact Assessment (FRIA) before deployment. The European Commission was expected to publish a template for this in 2025, but firms should not wait for official guidance before scoping what such an assessment would require for their specific use cases.

For professional services firms, the practical question is: do you know which of your AI tools fall into these categories? Many firms do not yet have a complete inventory of the AI systems they use, let alone an assessment of which tier of the Act applies to each.

GDPR Enforcement Is Running in Parallel — and Accelerating

The EU AI Act does not exist in isolation. GDPR enforcement involving AI continues at pace, with over €1.2 billion in fines issued in 2025 alone and cumulative penalties exceeding €7.1 billion since 2018.

Two recent court developments are worth noting. The Court of Rome annulled a €15 million fine against OpenAI in March 2026 — the only final GDPR enforcement action related to a generative AI product at launch — underscoring how legally contested this terrain remains. Separately, the Luxembourg Administrative Court annulled a €746 million Amazon fine on procedural grounds in the same month, though the underlying violations were upheld. These annulments do not signal that regulators are retreating. They reflect the procedural complexity of enforcement, not a softening of intent.

Firms should also note that AI processing, consent user experience design, and vendor management are currently identified as the three fastest-growing triggers for GDPR fines. If your firm is using AI tools that process personal data — and almost all of them do — vendor due diligence and lawful basis documentation are immediate priorities, not future ones.

The International Dimension

For firms operating outside the EU, the Act's reach is broader than many assume. It applies to providers placing AI systems on the EU market and to deployers using AI systems whose outputs are intended for EU users — regardless of where those firms are based. An HR consultancy in Toronto using an AI screening tool with EU candidates, or a marketing agency in Dubai running AI-generated campaigns targeting European consumers, may fall within scope.

Regulatory convergence is also a factor. The EU AI Act is influencing emerging frameworks in the UK, Canada, and the Asia-Pacific region. Firms that build compliance infrastructure now — governance frameworks, vendor assessment processes, documentation standards — are building assets that will reduce cost and friction as further jurisdictions introduce their own requirements.

What Your Firm Should Be Doing Now

The December 2027 deadline is not distant. Conformity assessments, FRIA processes, technical documentation, and governance structures all take time to develop properly. Firms that begin this work in 2026 will be in a materially better position than those that treat the extension as permission to wait.

A practical starting point involves three things: auditing your current AI tool inventory against the Act's risk categories; reviewing your GDPR compliance posture specifically in relation to AI data processing; and assessing your vendor contracts for AI-related provisions around transparency, liability, and data use.

None of this is straightforward, and the regulatory environment will continue to evolve — the Like Company v Google case currently before the Court of Justice of the EU, which concerns whether generative AI can reproduce editorial content without authorisation, may reshape the copyright dimensions of AI compliance further.

Speak to Ops Intel

Ops Intel helps professional services firms navigate AI compliance with clarity. Whether you need to understand where you stand under the EU AI Act, strengthen your GDPR position in relation to AI processing, or build a compliance framework that works across multiple jurisdictions, our team provides the practical guidance you need.

Contact Ops Intel to arrange a compliance review. The extended deadline is an opportunity — use it.