The EU AI Act Delay Is Not a Pause: What IT Project Managers Should Do Now

When the news broke, many teams breathed out. The EU AI Act delay pushes the main high-risk rules back by more than a year, so the pressure seems gone. Somewhere, a calendar was quietly relieved. However, that reading is only half right. The delay is real, but it covers only part of the law. Other duties already apply, and the deadline that remains will arrive faster than most project plans expect, as deadlines tend to do.

For IT project managers, this matters now. AI features are entering roadmaps in every department, and each one may fall under the Act. In this article, we look at what the EU AI Act delay changes, what it does not change, and how to use the extra time without losing it. Spoiler: extra time has a real talent for disappearing.

01 – What the EU AI Act delay actually changes

The change comes from the Digital Omnibus on AI, formally Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and entered into force three days later, on 27 July. According to a research note from the Cloud Security Alliance, it is the result of a proposal from November 2025, a political agreement in May 2026, and final votes in June. From proposal to Official Journal took about eight months, which is practically a sprint by legislative standards.

The three-day entry into force is worth a moment of admiration. The usual wait is twenty days, but this time the matter was urgent. It turns out that the legislative process can move quickly when the calendar is the problem. In practice, two deadlines moved:

• Standalone high-risk systems (Annex III), such as AI for hiring, education, credit scoring or critical infrastructure, now apply from 2 December 2027 instead of 2 August 2026.
• AI embedded in regulated products (Annex I), such as medical devices or toys, now apply from 2 August 2028.

Same law, two new calendar entries. In addition, member states must set up national regulatory sandboxes by 2 August 2027. The law also softens the duty on AI literacy. Organisations now have to take “measures supporting” it, rather than reach a defined level of staff competence. Few duties sound as confident as one that promises to try. Still, it is not an exemption. Companies that already train their staff should simply keep going, because the measures still have to exist and be documented.

02 – What still applies today

The Omnibus is a partial deferral, which is the regulatory way of saying “later, but not everything”. As the law firm Brabners summarises, the risk-based framework, the rules for general-purpose AI models and the penalty regime stay in place. Several obligations are already live:

• Prohibited practices have applied since February 2025.
• Duties for general-purpose AI models have applied since August 2025.
• Transparency rules apply since 2 August 2026. Users must know when they talk to an AI system, and AI-generated content such as deepfakes must be labelled.
• New prohibitions on non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.

There is one more date close by. Systems that generate content and were already on the market before August 2026 get a grace period for machine-readable marking. It ends on 2 December 2026, which is only a few weeks away. In calendar terms, that is the polite word for “almost now”. If your company runs a chatbot or a content generator, check this item first.

The stakes remain high. According to the CSA note, breaches of the prohibited practices can cost up to 35 million euros or 7 percent of global annual turnover. Most other violations can reach 15 million euros or 3 percent. A delay does not lower these figures, and nobody has announced a discount for early procrastination. As always, this article is a project view, not legal advice, so involve your legal team for classification.

A delay moves the deadline. It does not move the work, and the work has never once taken the hint.

03 – Why a delay is a risk for your project plan

Thirteen months sound generous. Every project manager knows how that sentence ends. High-risk requirements are not a final checkbox. They cover risk management, data governance, technical documentation, logging, human oversight and testing. All of this has to be built into the system, not added on top. As a result, a team that waits until late 2027 will try to retrofit evidence for a system that was never designed to produce it.

This is the same pattern we described in our article on why governance in AI projects must start earlier than in classic IT. Late governance is expensive governance. Every design decision that ignores the rules today becomes a change request tomorrow, usually with an urgent label and no budget.

Suppliers add another layer. Many AI features arrive through vendors, not through your own development. If a vendor cannot show how its system meets the rules, you carry the risk in your project. Contracts signed now without clear terms on documentation, updates and liability may be hard to fix later.

Consider a simple case. A company buys an AI screening tool for recruiting in early 2027. Employment is one of the Annex III use cases, so the tool is a likely high-risk system. If the contract says nothing about documentation, the company must later ask the vendor for evidence that may not exist. If the requirement sits in the contract from day one, however, the vendor delivers it as part of onboarding. The difference costs a few lines in a contract now, but it can cost months later.

Finally, there is the planning problem. Regulatory dates drive resources. Compliance work competes with feature work, and it usually loses until a date gets close. As a result, the work piles up in the last quarter, exactly when the team is busiest. A visible plan avoids this squeeze.

04 – A practical plan for the extra time

You do not need a large programme. Instead, you need a short list of steps with owners and dates. No task force, no kickoff with forty people, no logo. The following plan works for most mid-sized organisations:

1. Build an AI inventory. List every AI system in use or in planning, including vendor tools, embedded features and pilots. Add the business owner and the purpose.
2. Classify each system. Mark whether it is prohibited, high-risk, subject to transparency rules, or low-risk. Legal counsel should confirm the high-risk calls.
3. Fix the near-term items. Check transparency labels and the marking grace period that ends on 2 December 2026.
4. Review supplier contracts. Ask for documentation, change notices and evidence of conformity. Put these points into every new purchase.
5. Add compliance to the definition of done. For any system that may be high-risk, require logging, documentation and a human oversight concept before release.
6. Train people in proportion. Keep AI literacy measures simple and documented, aimed at the roles that use or approve AI.

Name one accountable person for each system. Shared ownership usually means that nobody owns the topic, and that is how deadlines get missed. Review the inventory every quarter, because new tools appear faster than most governance cycles. Each step is small, but together they turn a vague worry into a plan. Moreover, they create the evidence trail that auditors and customers will ask for later.

05 – Where AI can help, and where it cannot

There is a certain irony in using AI to prepare for AI regulation, but it works. AI tools can speed up the first steps. For example, a language model can scan contract folders, ticket systems and software lists to find mentions of AI features. It can also draft a first classification for each system and flag missing information. If you want a starting point for tools, see our overview of AI tools every IT project manager should use.

Still, the final call stays with people. Whether a system counts as high-risk is a legal and organisational judgement. A model does not know your context, and it can be confidently wrong, a trait it shares with many steering committees. So treat its output as a draft for review, never as a decision.

06 – Use the delay, do not wait for it

The EU AI Act delay gives organisations time, but only if they treat it as time. Teams that start now will spread the work over several quarters and learn what the rules mean for their products. In contrast, teams that wait will meet the same rules under pressure, with less budget and fewer options. The rules will not change because the plan is late.

Make the topic visible in your normal reporting. A single line on AI compliance status in the project report keeps it on the agenda, and it prevents the drift we described in why IT project status reports drift from reality.

So start small. In the next 30 days, create a one-page inventory of your AI systems, name an owner for each, and check the 2 December 2026 date. That single page is the first step, and it will make every later decision easier. The calendar, at least, will be grateful.