The AI Act delay to 2027 changes nothing about the urgency of governing your data
The European Parliament voted to delay high-risk AI obligations to December 2027. What actually changes for French SMBs and mid-sized companies, and what does not.
On June 16, 2026, the European Parliament voted to delay the heaviest obligations of the AI Act, those covering high-risk systems under Annex III (recruitment, credit, biometrics, education), from August 2, 2026 to December 2, 2027. The news travelled fast among the business owners I work with, and the reaction was the same every time: "we have an extra year and a half, we can ease off."
That is exactly the wrong conclusion. During a recent engagement, a business owner asked me whether we could pause the data mapping work we had just started. His reading of the delay was understandable, but wrong on substance.
What changes with this vote: the deadline for full technical documentation, formalized risk management systems, and structured human oversight of high-risk AI. What does not change: certain prohibited practices, in force since February 2025. Obligations for general-purpose models, in force since August 2025. And above all, GDPR, which never had a moratorium and applies to any personal data processed by an AI system, AI Act or not.
The CNIL restates this in its 2026 guidance: any AI system processing personal data needs a clearly identified legal basis, and a data protection impact assessment is mandatory for high-risk uses in HR, healthcare, or customer scoring. That requirement has not moved and will not move because of the Digital Omnibus.
The real risk is not short-term regulatory exposure, it is organizational. An SMB that discovers in 2027, under pressure, that it runs eight uncatalogued AI tools, three of which process sensitive HR data, ends up in the same rush it would have faced under the original timeline. The delay does not remove the work, it just moves the date when its absence becomes visible.
This is precisely what the first two steps of my approach address: the inventory, to map every real AI usage across the company, declared or not, then the roadmap, to build a realistic compliance plan instead of a last-minute scramble. Companies that treat this extra time as preparation time gain a structural head start over those that treat it as a reprieve.
The AI Act delay changes a date. It changes nothing about the need to know what your teams actually do with AI, or about the GDPR obligation that has always applied. The companies that understand this are already moving forward, while those waiting for 2027 will pick up the work two years behind instead of one year ahead. A 5-day diagnostic shows you exactly where you stand.
Frequently asked questions
Does the AI Act delay mean companies can pause every AI compliance project?
No. Only the formal Annex III obligations for high-risk systems (recruitment, credit scoring, biometrics) are delayed, pending final adoption by the Council. GDPR already applies in full today to any personal data processed by an AI system.
Which AI obligations still apply despite the delay?
Certain prohibited practices have been in force since February 2025, general-purpose model obligations since August 2025, and GDPR has never stopped applying. A data protection impact assessment remains mandatory for high-risk AI uses in HR, healthcare, or customer scoring.
Is this delay final?
No. The European Parliament voted this delay on June 16, 2026 as part of the Digital Omnibus package, but it still requires formal adoption by the Council of the European Union to take effect.
How should an SMB use this extra time?
To structure AI governance without calendar pressure: mapping actual AI usage, including shadow AI, classifying data by sensitivity level, and documenting processing activities. That is exactly what the first two steps of a structured approach cover: the usage inventory and the roadmap.