The EU AI Act timeline has shifted. Your workforce readiness challenge has not.

At a glance

A lot of leaders will see the latest EU AI Act developments and think one thing: relief. 

On 7 May 2026, Parliament and Council negotiators reached a provisional political agreement to delay certain high-risk AI Act obligations. If formally adopted, stand-alone high-risk AI systems would move from August 2026 to 2 December 2027, while high-risk AI systems embedded in regulated products would move to 2 August 2028. Watermarking obligations on AI-generated content would move to 2 December 2026. 

That matters. But it would be a mistake to read this as permission to pause. 

For regulated organisations, the real challenge was never just a technical compliance date. It was always whether the organisation was building the governance, literacy, oversight and evidence needed to deploy AI responsibly at scale. That challenge remains. 

What changed

The most important shift is timing. 

Under the political agreement, the main obligations for stand-alone high-risk AI systems would apply from 2 December 2027. For AI systems embedded in products such as lifts or toys, the date would be 2 August 2028. The application of watermarking obligations on AI-generated content would move to 2 December 2026. 

The package also introduces a ban on AI systems that create child sexual abuse material or depict the intimate parts of an identifiable person, or them engaged in sexually explicit activities, without consent. Companies would have until 2 December 2026 to bring their systems in line. 

The right language here is important. This is a political agreement, not the final legal text in force today. The European Parliament and Council still need to complete formal adoption. That means leaders should neither ignore the change nor present it as a settled, final position without qualification. 

What did not change

Several important obligations are already live. 

AI literacy obligations and the bans on prohibited AI practices have applied since 2 February 2025. Obligations for providers of general-purpose AI models, together with governance requirements, have applied since 2 August 2025. 

The European Commission’s implementation material now reflects the political agreement and shows the revised direction of travel for high-risk AI systems. That does not reduce the importance of getting ready. It simply changes the runway for some obligations.

Why this matters for regulated industries

In financial services, insurance, healthcare and other regulated sectors, AI governance does not sit neatly inside one function. It cuts across technology, compliance, operational resilience, model risk, conduct, procurement, HR and learning. 

So even with more time on some high-risk obligations, the practical questions remain the same: Do you know where AI is being used? Can you separate low-risk experimentation from higher-risk use cases? Do leaders understand where accountability still sits? Can you evidence a proportionate approach to AI literacy and oversight? 

That is why this topic still matters so strongly to three audiences in particular: 

• Technology leaders need a credible inventory of AI use cases, a practical approach to risk classification, and governance that reflects how AI is actually being used across the business.

• CHROs need to treat AI literacy as a workforce governance capability, not a one-off awareness campaign. 
• L&D leaders need role-based learning pathways that reflect exposure, accountability and risk, rather than generic enthusiasm for AI. 
  
  
  

The wrong conclusion to draw

The wrong conclusion is: “We have another year, so we can wait.” 

The better conclusion is: “We have more time to do this properly.” 

What leaders should do in the next 90 days 

1. Create a credible AI inventory 
   Map where AI is already being used, by whom, for what purpose and with what level of risk or business impact. 

2. Separate low-risk from higher-risk use cases 
   Using a general AI tool for internal productivity is not the same as using AI in hiring, underwriting, employee monitoring, credit decisions or customer-facing decision support. 

3. Define role-based AI literacy requirements 
   Boards, senior leaders, managers, technical teams and frontline users do not need the same depth of knowledge. The training response should reflect role, risk and accountability. 

4. Build an evidence trail 
   Document training content, audiences, dates, owners, refresh cycles and governance decisions now, rather than trying to reconstruct them later. 

Closing point  

The EU has not abandoned the AI Act. It has adjusted the implementation timetable for parts of it while keeping the broader risk-based framework and several existing obligations intact. 

So yes, the dates have moved. 

But for regulated organisations, the more important question is unchanged: are your people, processes and governance ready to support responsible AI use in practice? 

Sources and further reading 

• European Commission – AI Act policy page and updated implementation timeline 
• AI Act Service Desk – Timeline for the Implementation of the EU AI Act 
• European Commission – AI Literacy Questions & Answers 
• European Parliament – AI Act: deal on simplification measures, ban on ‘nudifier’ apps 
• Council of the European Union – Council and Parliament agree to simplify and streamline rules