Your AI compliance deadline just moved. Should the board believe it?

The headline your board saw

On May 7, the Council and the Parliament reached a provisional agreement to simplify the EU AI Act. The part that made it into board decks: the high-risk rules under Annex III, the ones covering AI in hiring, credit, education, and essential services, would move from August 2, 2026 to December 2, 2027. Sixteen extra months. Euronews ran it on May 21 under a headline about the EU softening its toughest law, and by the next board meeting half the room had quietly decided the pressure was off.

I want to gently push back on that, because the people who decided to relax read the headline and not the footnote.

What it actually means

A provisional political agreement is not a law. It is a strong hint. The text still has to be formally adopted by both the Parliament and the Council, then published in the Official Journal, and that vote is not expected until June or July. Until it happens, the original August 2, 2026 date stays on the books. So for roughly the next two months, the binding deadline and the expected deadline disagree with each other, and the board is being asked to plan against both at once.

Here is the asymmetry that should decide the call. Keep preparing and the delay passes, and a company has bought sixteen months of breathing room at the cost of a little early effort. Stop preparing and the vote stalls over the summer, and that same company is sixty days from a deadline it walked away from, on rules that carry fines up to 35 million euros or 7% of global turnover at the top end, and 15 million euros or 3% for high-risk breaches. Those outcomes are not the same size.

And the underlying work never paused. On May 19 the Commission published its draft guidelines on how to classify a high-risk system in the first place, with a consultation open until June 23. That document decides whether a given system is even in scope, which is the question that comes before every other compliance question.

The deeper issue is that most companies could not meet either date today, because they have not done the first step. They do not know what AI they are running.

Three questions your board will ask

“Are we still on the hook for August?” Technically, today, yes. The honest framing is that the legal deadline has not moved, only the political expectation around it. Plan for August and adjust if and when the vote lands. That sequence is cheap; the reverse is not.

“Do we even know what counts as high-risk for us?” This is the better question, and the same readiness report found 78% of organizations have taken no meaningful compliance steps and 74% have no designated internal owner for it. The May 19 draft guidance is the map for answering it. Teams that read it before June 23 can shape it through the consultation. Teams that read it after only get to comply with whatever it becomes.

“What about the United States?” More fragmented, not less. Colorado signed SB 26-189 on May 14, replacing its own landmark AI law before the original ever took effect, with the new version landing in 2027. The federal executive order from December is trying to preempt state rules, and the states have said plainly they intend to keep enforcing. There is no single American deadline to wait for, which means the EU inventory work doubles as the foundation for everything stateside too.

The 60-second brief

If a director has one minute, this is the whole thing. The EU did not move the deadline, it proposed to, and the proposal is not law until a summer vote. We keep our AI inventory and our high-risk classification work on the August timeline. We treat December 2027 as likely relief, not as permission to stop. The expensive mistake here is not over-preparing by a few weeks. It is standing the whole effort down on a political hint and getting caught flat if the vote slips.

A provisional agreement is not a law. It is a strong hint, and you cannot file a strong hint with a regulator.

What to watch

Three dates, in order: the consultation closes June 23, the formal vote is expected across June and July, and August 2 sits right behind them as the date that still binds until the others resolve. Enforcement is not hypothetical while everyone waits, either. Foreign Policy Journal reported that EU member states had already issued roughly 50 fines totaling around 250 million euros by the first quarter, mostly against large model providers.

The calmest seat in the room is the prepared one. A board that can show an AI inventory, a named owner, and a high-risk classification it can defend is ready for August, ready for December 2027, and ready for the question either way the vote goes. That readiness is the same work no matter which date wins, which is exactly why there is no good reason to wait and find out.