EU AI Act's Annex III deadline just moved to Dec 2027 - here's what actually changed (and what didn't)

Saw a lot of confusion floating around about this, so figured I'd share a clean breakdown.

The EU AI Act's high-risk AI obligations under Annex III (hiring tools, credit scoring, biometric ID, education access, law enforcement systems) were originally due August 2, 2026. That date has now moved to December 2, 2027, a 16 month extension, confirmed under Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), which entered into force July 27, 2026.

A few things worth knowing if this affects your work:

• This delay does NOT apply to everything. Article 50 (transparency rules, like disclosing AI-generated content and chatbot interactions) is still active since August 2026, unchanged.
• Annex I systems (AI embedded in already-regulated products, like medical devices) got a separate extension, now due August 2028.
• The classification system, penalties, and core structure of the Act are untouched. Only the compliance timeline for these two categories moved.
• Provider vs deployer obligations still apply differently depending on your role, that part didn't get simplified either.

Went down a bit of a rabbit hole cross-checking this across a few legal sources since there's some outdated info still circulating from before the Omnibus was finalized. Wrote up the full breakdown with the timeline and what businesses should actually do with the extra runway here if useful: https://annexops.com/eu-ai-act-annex-iii-deadline-2027/