The EU AI Act's deadline just moved, but your vendor risk questionnaire won't wait for it

[ForumGremlin93]

Following a provisional agreement between the European Parliament and Council on the so called Digital Omnibus, rules for AI systems used in high risk areas including biometrics, critical infrastructure, education, employment, migration and border control are now set to apply from December 2, 2027, later than originally planned. Rules covering AI embedded in physical products like lifts or toys push out even further, to August 2, 2028

The practical point for AI vendors outside the EU is that a shifted legal deadline doesn't actually pause enterprise procurement diligence. A regulatory deadline can move through an amending law, but a contract renewal, a vendor risk review, or a board evidence file generally can't wait on Brussels' timetable in the same way

That creates a specific risk, some vendors may treat the extra runway as a reason to postpone the actual evidence gathering work rather than using the additional time productively. The argument here is that the delay should change nothing about the practical message to vendors, buyers now have more reason to ask what evidence of compliance actually exists, not less, since procurement teams and their own legal departments still need to explain to their own boards why a given AI system can be safely bought, deployed, monitored and eventually renewed

The core distinction worth holding onto, current law, the political agreement reached in May, implementation guidance, and the eventual final adopted text are all different things that shouldn't get collapsed into one sentence for legal reliance purposes. But for anyone actually running procurement, the message stays simple regardless of which stage the legislation is technically at, get your evidence file in order now rather than waiting for a deadline that just got pushed back

The EU AI Act deadline moved, vendor questionnaires will not | IAPPiapp.org