EU AI Act High-Risk Deadlines Moved: What UK Boards Do Now

The EU AI Act is not an internal EU matter. Its extraterritorial reach works exactly like GDPR. If your AI system affects people in the European Union, you are in scope. Full stop. It does not matter that you are registered in Birmingham, Edinburgh, or Cardiff. If you sell to EU customers, employ staff in Germany, or use recruitment software that screens EU applicants, the Act applies to your organisation.

The prohibition tier has already been live since February 2025. That covers AI systems that manipulate people without their knowledge, exploit vulnerable groups, or enable real-time biometric surveillance in public spaces. If you were using any of those, you are already in breach. High-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Article 50 transparency duties remain on their separate timetable.

Fines depend on the breach. The highest tier applies to prohibited practices.

The Act designates eight categories of high-risk AI in Annex III. These include AI used in recruitment and employment decisions, systems that affect access to education, tools used in credit scoring and insurance, AI deployed in critical infrastructure, and systems involved in law enforcement. If your business uses AI for any of these purposes, even if the AI is embedded inside a SaaS product you bought rather than built, your obligations are real.

That last point catches a lot of organisations out. If your HR platform uses an algorithm to rank job applicants, that is a high-risk AI system. You do not get to say it is the software vendor's problem. As a deployer, you carry responsibility for how that system operates in your context. You need to be able to demonstrate that you understand what it does, who it affects, and how you oversee it.

The European Commission was supposed to publish guidance by February 2026 to help operators of high-risk systems understand their obligations under Article 6. It missed that deadline. That is not a reason to wait. The legal text already tells you what is required. Waiting for guidance that is already late is not a compliance strategy.

For organisations with high-risk AI systems, the requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. You must complete conformity assessments demonstrating the system meets the Act's standards. You must produce and maintain technical documentation. If relevant, your system needs CE marking and registration in the EU database for high-risk AI. You must implement a risk management system, data governance controls, human oversight mechanisms, and logging capabilities that allow post-market monitoring.

Article 50 transparency duties were not deferred with the high-risk obligations and apply from 2 August 2026. If your users are interacting with an AI, you must tell them. Synthetic content, including AI-generated text, images, and audio, must carry machine-readable labels. Emotion recognition systems and biometric categorisation tools require explicit disclosure at the point of use.

None of this is optional. None of it is a best-practice recommendation. It is a legal requirement with enforcement consequences.

The honest picture is not encouraging. Most organisations with EU exposure fall into one of three positions. The first group has not started. They are aware of the EU AI Act in the same way they are aware of their pension obligations: they know it exists, they intend to deal with it, and they have not. The second group has completed an AI inventory, identified what tools they use, and then stopped. Knowing what you have is the first step. It is not compliance. The third group is actively building frameworks but has not finished.

The later high-risk deadlines give organisations more time, not a reason to delay. An AI inventory that covers embedded AI in existing SaaS tools, not just tools procured specifically as AI, can take weeks to complete properly. Risk classification requires legal and technical input. Documentation and oversight protocols take time to design and implement. The clock is not paused while you wait for a convenient quarter to prioritise this.

Start with a complete AI inventory. This means every tool in use across your organisation, including the AI features inside Salesforce, Microsoft 365, HubSpot, and any other platform that has quietly added AI capabilities. The inventory must cover both tools you built and tools you bought. Document what each system does, what data it processes, and who it affects.

Once you have the inventory, classify each system against the Act's risk tiers. Most business tools will not qualify as high-risk. But you need to confirm that, not assume it. For anything that touches employment decisions, customer access decisions, or safety-critical processes, get a proper legal assessment.

For high-risk systems, assign ownership. Someone in your organisation must be accountable for each system's compliance posture. That person needs to understand the technical documentation requirements, the human oversight obligations, and the process for logging incidents. If they do not exist yet, find them before the deadline does it for you.

Start the inventory this week. Classify each system and establish whether Annex III or Annex I applies. Set a documented plan for conformity assessments, technical documentation and human oversight ahead of 2 December 2027 or 2 August 2028 as appropriate. Check Article 50 transparency duties separately because their timetable was not deferred.