EU AI Act for Developers: Every Deadline and What Applies Now

TL;DR

The EU AI Act doesn’t have one deadline. It has six, spread from 2025 to 2028, and the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) moved only some of them. Already in force: the Article 5 prohibitions (February 2025), obligations for general-purpose AI models (August 2025) and the Commission’s power to fine GPAI providers (August 2026), and the Article 50 transparency duties for chatbots, generated content and deepfakes (2 August 2026). Next up: machine-readable marking for generators that were on the market before August, plus new bans on nudifier apps and AI-generated child sexual abuse material, both on 2 December 2026. High-risk use cases such as hiring, HR, credit and biometrics (Annex III) moved to 2 December 2027, and AI embedded in regulated products (Annex I) to 2 August 2028. Which date is yours depends on what you build. And the job market the Act is inflating, AI governance, hasn’t slowed down.

How the timeline changed

For most of 2026, if you worked anywhere near AI hiring tools in Europe, 2 August was the date on the whiteboard. That was when Annex III high-risk systems, the bucket that covers CV screeners, candidate ranking, performance scoring, anything that decides who gets a job or keeps one, had to ship with conformity assessments, bias-testing logs, human-oversight controls, and a registration in an EU database.

Then, three weeks out, the goalposts moved. The Digital Omnibus, a “simplification” package the Commission floated late in 2025, cleared its final hurdles fast: the European Parliament endorsed it on 16 June 2026, the Council gave the final green light on 29 June, and the text was signed on 8 July 2026. It was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July and entered into force on 27 July. The headline change: Annex III high-risk obligations deferred sixteen months, to 2 December 2027.

European engineers tend to read this stuff half as regulation, half as a weather report for the local job market, and the deferral is more irritating than it looks. Small teams had already started documenting data lineage for tools that were, generously, “candidate spreadsheet with a ranking button.” A sixteen-month reprieve sounds like breathing room, but it really just scatters three deadlines across three different years and dares you to track which one applies to your code. Most of the confusion traces back to getting that mapping wrong.

Every deadline, and where it stands

The most common mistake I still see is people reading “AI Act delayed” and mentally filing the whole thing under 2027. But the timeline is staggered. The obligations that arrive first, the ones with the shortest runway, didn’t move at all.

Read that table twice if you ship anything with a language model in it. If your product talks to users, generates images or text, or clones a voice, the Article 50 transparency obligations have applied since 2 August 2026. There was no sixteen-month cushion for a chatbot that forgets to tell people it’s a chatbot. The one concession: a generator already on the market before that date has until 2 December 2026 to add machine-readable marking to its output. Anything launched after 2 August had to mark from day one. General-purpose model obligations have applied since August 2025, and in August 2026 the Commission’s power to fine GPAI providers switched on, on the original schedule.

The delay is real, but it’s targeted. It bought time for exactly one category: use-based high-risk systems under Annex III. That happens to be the category most European startups touch, because hiring, lending, and scoring are where “let’s add AI” meets “a regulator cares who you rejected.”

The compliance gap, in plain terms

The legal briefs phrase this part carefully, so I’ll say it plainly. Between August 2026 and December 2027, a vendor can sell a hiring-AI system into the EU market with no obligation to prove where its training data came from, no mandatory bias-testing record, and no conformity assessment on file. The high-risk classification didn’t change (recruitment AI is still legally high-risk), but the enforcement of the obligations that make that classification bite is on hold for another sixteen months.

For candidates, that’s a genuine gap: the systems screening your applications in 2026 face less scrutiny than the ones that will screen them in 2028. A different EU law does help applicants now, at least in the countries that have transposed it: under the Pay Transparency Directive, employers there must state the pay or its range before the interview and can’t ask what you earn today. For the developers building those systems, it’s a choice. You can treat the deferral as permission to skip the documentation, or you can treat it as free time to build the paper trail before it’s mandatory. I’d pick the second option, because “we’ll retrofit compliance later” has the same track record as “we’ll add tests later.”

What this means if you build AI for a living

Strip away the acronyms and the developer takeaway is small and concrete.

If you ship a chatbot, generator, or voice clone: the rules already apply. Users must be told they’re interacting with AI, and synthetic media must be machine-readable as synthetic (by 2 December 2026 at the latest if your generator shipped before August). This is mostly a labelling and metadata problem. The Commission’s code of practice on AI-generated content is the reference for how to mark, and it’s cheaper to do now than after a complaint.

If you build image or video generation: check your abuse filters against the two new prohibitions. From 2 December 2026, systems built to produce non-consensual intimate imagery or child sexual abuse material are banned outright, with a narrow safe harbour for general tools that have no such intended purpose and adequate safeguards.

If you build hiring, scoring, or HR tooling: you have until December 2027, but the work didn’t shrink, it shifted. The Act still expects data governance (Article 10), record-keeping and logging (Article 12), human oversight (Article 14), and accuracy and resilience testing (Article 15). The smart move is to build the logging in from day one, because reconstructing a bias-audit trail after eighteen months of production traffic is miserable.

The logging is ordinary. At its simplest, a high-risk screening system needs a durable, queryable record of every automated decision and the group-level outcomes those decisions produce. Something like this is enough to start:

# Minimal record-keeping scaffold for a high-risk hiring model.
# Article 12 asks for automatic logs; Annex IV asks for the bias metrics
# to be documented. This is the boring plumbing that makes both possible.
import json, time
from collections import Counter

def log_decision(candidate_id, group, score, threshold, run_id):
    record = {
        "ts": time.time(),
        "run_id": run_id,
        "candidate_id": candidate_id,
        "group": group,            # a coarse bucket used ONLY for auditing,
        "score": round(score, 4),  # never fed back into the model as a feature
        "shortlisted": score >= threshold,
    }
    with open("decision_log.jsonl", "a") as f:
        f.write(json.dumps(record) + "\n")
    return record

def selection_ratio(path="decision_log.jsonl"):
    picked, total = Counter(), Counter()
    for line in open(path):
        r = json.loads(line)
        total[r["group"]] += 1
        picked[r["group"]] += int(r["shortlisted"])
    rates = {g: picked[g] / total[g] for g in total}
    return rates, min(rates.values()) / max(rates.values())

Run selection_ratio() on a week of logs and you get something like:

{'A': 0.31, 'B': 0.19}  ratio = 0.61

A ratio well under 0.8 is the classic disparate-impact smell test (borrowed from US EEOC practice, not an EU-mandated metric, but regulators everywhere reason in the same direction). If your model shortlists one group at 31% and another at 19%, you want to know that before it’s in a technical-documentation file a Cyprus or Irish supervisory authority can request. None of it is complicated. It’s just the kind of work teams defer until a deadline forces the issue, and the deadline just moved, which is exactly why it’ll slip again.

Other Omnibus changes developers should know

A few smaller amendments change day-to-day compliance work more than the headlines suggest:

• AI literacy (Article 4) got softer. Providers and deployers must take measures to support the development of AI literacy, taking into account their staff’s knowledge and the context the system is used in. There’s no longer a duty to guarantee a “sufficient level” for anyone.
• SMEs and small mid-caps get lighter paperwork. Simplified technical-documentation forms, a proportionate quality-management system, and lower fine caps for small mid-cap companies.
• Sandboxes are coming. Every member state has until 2 August 2027 to run at least one AI regulatory sandbox, and an EU-level sandbox can prioritise SMEs and start-ups. If you’re building an Annex III system, a sandbox is the cheapest way to get a regulator’s read before December 2027.
• Self-assessed non-high-risk systems have simpler registration. If you’ve concluded under Article 6(3) that your Annex III-adjacent system isn’t high-risk, the registration details you file are lighter, but you still need the written assessment.

The job market this heats up: AI governance

This is the part that changes your career math, delay or no delay. The regulation is complicated enough that a whole job function has grown up around interpreting it, and that function is hiring like it’s 2021.

LinkedIn’s 2026 Skills on the Rise report clocked AI governance at +150% year over year and AI ethics at +125%, putting them among the fastest-growing specialisms it tracks. Job-board data tells the same story from a different angle: one analysis of 146 AI-governance postings put the median salary at $158,750, with the middle 80% running from roughly $155,600 to $218,550. AI Governance Specialist roles typically land between $120,000 and $180,000; senior practitioners at large firms clear $200,000.

The European geography is worth knowing if you’re job-hunting from the EU. Brussels has become the enforcement epicentre: it’s where the regulators are, so it’s where the teams that talk to regulators cluster. Amsterdam and Dublin host the European HQs of most US tech firms and dominate credentialed governance hiring, with top-end comp at companies like Meta, Uber, and trading firm IMC reaching €150,000–€200,000+ (Amsterdam’s median AI-governance pay sits nearer €109,000). Paris, Munich, and Stockholm look to be gaining ground.

That last row is the one I’d point a working developer at. You don’t have to abandon engineering to ride this wave. The scarcest profile in the whole market is an engineer who can implement the Act: someone who can wire up the logging above, run a bias audit that survives scrutiny, and explain to a compliance lead why a model’s calibration drifted. Pure-policy governance roles are crowded with career-changers, while engineers who speak both languages stay rare.

For the Cyprus and broader EU reader specifically: this slots neatly next to the salary trends I covered in the Europe developer salary breakdown and the Cyprus-specific numbers. Governance is one of the few 2026 specialisms where the EU is the high-paying region, because the demand concentrates here, where the law lives. That’s a rare inversion of the usual US-pays-more story, and it’s worth exploiting if you’re deciding where to point your next two years.

When a governance pivot makes sense

Careful: not everyone should make that jump. Weigh it like this.

Pivot if you already work near regulated data (fintech, healthtech, HR-tech), you like the “make the system defensible” side of engineering more than the “ship the feature” side, and you’re in or near an EU hub. The AIGP certification from the IAPP is the credential recruiters currently pattern-match on, and it’s a weekend-plus-a-month of study rather than a degree.

Don’t pivot if you’re chasing the salary number alone. The delay to December 2027 is a reminder that regulatory timelines slip, and a role whose entire justification is one deadline can get repriced when that deadline moves. The durable version of this bet is the engineer who understands governance. The fragile version is the governance hire who used to code, whose value leaks away every time a deadline slips. One rides out timeline changes; the other gets repriced by them, the same way the broader software job market keeps getting upended by shifts nobody scheduled.

If you’re earlier in your career and weighing whether any of this specialization pays off, it connects to a question I dug into recently: whether the degree-and-specialize path still holds up when the ground keeps moving. Governance is a decent answer to that question, precisely because it’s boring, mandatory, and hard to automate, and that kind of work tends to hold its value.

FAQ

Is the EU AI Act delayed?

Partly. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) postponed the high-risk obligations for Annex III use-based systems, including hiring and HR AI, from 2 August 2026 to 2 December 2027, and Annex I product-embedded systems to 2 August 2028. General-purpose AI rules and the Article 50 transparency obligations were not delayed and have applied since August 2025 and 2 August 2026 respectively.

When do the EU AI Act’s high-risk rules for hiring AI apply?

2 December 2027 for use-based (Annex III) high-risk systems such as recruitment, candidate scoring, and performance evaluation tools. Product-embedded (Annex I) high-risk systems have until 2 August 2028.

What AI systems count as high-risk under the EU AI Act?

Annex III lists use cases including employment (recruitment, selection, promotion, termination, task allocation, performance monitoring), credit scoring, biometrics, education, and access to core public services. Using AI in any of these contexts makes the system high-risk regardless of how simple the model is.

What parts of the EU AI Act already apply?

The Article 5 prohibitions (since February 2025), general-purpose AI model obligations (since August 2025, with Commission enforcement powers since August 2026), and the Article 50 transparency duties (since 2 August 2026): disclosing that users are interacting with AI, and labelling AI-generated or manipulated content, including deepfakes, as synthetic. Generators already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking.

What changes on 2 December 2026?

Two things. The machine-readable marking grace period for pre-August generators ends, and the Omnibus’s new prohibitions start to apply: AI systems designed to generate non-consensual intimate imagery (so-called nudifier apps) or child sexual abuse material are banned.

What are the penalties for breaking the EU AI Act?

Up to €35 million or 7% of global annual turnover for the most serious breaches (prohibited practices), whichever is higher. Other high-risk obligation failures carry lower ceilings (up to €15 million or 3% of turnover).

Sources

• Digital Omnibus on AI — EU Artificial Intelligence Act explorer: adopted amendments, new prohibitions and dates
• Lewis Silkin — The Digital Omnibus on AI enters into force: OJ publication (24 July 2026) and entry into force (27 July 2026)
• A Practical Guide to Article 50 — EU Artificial Intelligence Act: transparency duties for chatbots, generated content and deepfakes
• Code of Practice on Transparency of AI-generated Content — European Commission: how to mark and label synthetic output
• Latham & Watkins — AI Act Update: EU Resolves to Change Rules and Extend Deadlines — legislative status and signing timeline
• Gibson Dunn — EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines — Annex III vs Annex I deferral detail
• Ogletree — EU Nears Approval of Agreement to Delay Rules for AI Use in Employment Decisions — employment-AI specifics
• EU Artificial Intelligence Act — official text and implementation timeline — obligation dates and Annex definitions
• Techjack Solutions — AI Governance Salary Data (2026) — US salary ranges and role breakdown
• VerifyWise — AI Governance Salary Report 2026 — European hub compensation (Amsterdam, Dublin) and EU-vs-US gap

Bottom line

The delay is a gift with a catch. Sixteen extra months on hiring-AI compliance is genuinely useful if you build that category, and irrelevant if you ship chatbots or generators, whose clocks ran out on 2 August 2026, with a last marking deadline on 2 December 2026. The trap is treating “AI Act delayed” as one fact instead of six deadlines in a trench coat. Track the one that matches your code, build the logging before it’s mandatory, and if the governance job boom tempts you, become the engineer who can implement the rules rather than the person who can only quote them. Deadlines move; the skills you build to meet them don’t.