How Machine Vision Is Changing the Textile IndustryIn Frankfurt, Germany, a compliance officer circled 2 August 2026 on her wall calendar last year. By May, she had circled a different date (twice). The European Union’s AI Act keeps moving its finish line. For companies trying to keep pace, that habit has become this year’s story.
None of this makes the underlying rules any less real. Some businesses without technical staff on the payroll are paying outside teams that specialize in artificial intelligence and machine learning development to handle both the engineering and the paperwork the Act now demands. Others handle the model building and machine learning engineering work internally and treat the regulation as a design constraint rather than a courtroom threat.
Disclosure: Contributed post.
Reading Past the Delay
Two dates on the original version of the law never budged. Article 5’s ban on manipulative and social-scoring AI became enforceable on 2 February 2025, alongside a duty requiring staff to have basic AI literacy.
General-purpose AI providers, the firms behind the core models, picked up separate duties on 2 August 2025. These tasks covered technical documentation and copyright policy summaries. Furthermore, the energy used to train their models was disclosed. Both dates hold today; a Cloud Security Alliance research note on the law’s rollout describes the latter high-risk delay as deferred, not canceled.
The Act sorts every AI system into one of four buckets. Systems that manipulate people, score citizens for trustworthiness, or scrape faces from the internet for a facial-recognition database sit in the banned tier, full stop.
High-risk systems, those used in hiring, credit decisions, education, and law enforcement, carry the heaviest paperwork: risk management files, proof of human review, and completion of a conformity assessment before the product reaches a customer.
Limited-risk systems, mostly chatbots and deepfake generators, just have to disclose what they are. Everything else (spell-checkers, spam filters, most recommendation engines) sits in the minimal-risk bucket and carries no obligations at all. Most of the compliance argument inside any given company comes down to one question:
Which bucket does this particular tool actually belong in?
Penalties for Violations of AI Laws
Penalties for the most serious violations reach €35 million or 7% of global annual turnover, whichever is higher. Lesser breaches top out at €15 million or 3%.
The date that worried people was 2 August 2026. Then hiring tools, credit-scoring models, and other high-risk systems were set to face conformity assessments, technical files, and human-oversight rules all at once. That date has now moved.
Annex III high-risk obligations shift to 2 December 2027, a 16-month delay. AI embedded in regulated products such as medical devices and lifts gets until 2 August 2028, per a Gibson Dunn client briefing on the finalized Digital Omnibus agreement. Room to breathe. But no room to skip the reading.
What Is the Readiness Gap Nobody’s Bragging About
Just 18% of European employers call themselves prepared for the AI Act, while 20% say they have not started at all. This corresponds to the share that admitted the same a year earlier, according to Littler’s eighth annual employer survey, reported via Businesswire. Preparation barely moved even as the deadline did. Barely at all.
The gap shows up hardest at companies that never built their own machine learning and AI development team. The reason is that they now must audit systems they don’t fully understand. Knowing what to fix requires knowing what exists first. Unfortunately, many firms can’t even produce a basic list of the AI tools already running in procurement, hiring, or customer service.
Firms with existing GDPR habits tend to move faster, since AI Act paperwork borrows the same muscle: knowing where data lives and who is responsible when a system makes a call it shouldn’t have. That head start does not close the gap on its own.
That same Cloud Security Alliance research, cited above, found that more than half of organizations still lack a basic inventory of the AI systems already running inside the business. Sorting tools into the four risk buckets described earlier is hard when no documentation exists on which tools are used.
Where Outside Engineering Teams Earn Their Keep
Ask a compliance lawyer what “human monitoring” means inside a live hiring pipeline and most will pause. The regulation describes intent, not architecture. The actual pipeline (logging, thresholds, override buttons) has to be created by a programmer, not a policy maker. This is where an outside AI and ML development partner earns its fee.
A team built for this work typically walks in already carrying a short checklist of its own, something like this:
- Classify every model against the Annex III categories before writing a line of policy
- Build the technical documentation and dataset lineage records a conformity assessment will ask for
- Design the human-oversight checkpoints inside the actual decision pipeline, not in a slide deck
- Set up monitoring that catches model drift before a regulator does
Expert Companies for Building Pipelines According to Regulations
N-iX, a European engineering firm that has built machine learning systems for healthcare providers and banks, is one example of a company organized around exactly this kind of handoff: read the regulation, then build the pipeline that satisfies it, rather than the other way around. That order matters more than it sounds. A policy written before the system exists tends to describe a system nobody ends up building.
Building this kind of capacity from scratch usually means months of hiring: a machine learning engineer here, a data governance specialist there, someone who can read both regulatory text and a model card.
An existing team that already lives inside AI and machine learning engineering skips most of that runway. Because the risk classification, documentation templates, and monitoring tooling already exist in some form, it mostly needs adapting to a specific product.
None of that comes free, though. A business that outsources the technical work still owns the governance decisions sitting on top of it. A regulator, namely, fines the company that deployed the system, not the contractor that built it.
Final Words on the AI Act Delay
The AI Act did not get easier. It got a longer runway and clearer guidance on which deadlines were negotiable and which were not. Prohibited practices and general-purpose AI duties are already live, regardless of whether a company builds in-house. High-risk obligations now land on 2 December 2027 and 2 August 2028, dates that feel distant until the technical documentation actually needs writing. Most of the runway will get used well. Not all of it will, and the businesses that treat the extra time as a gift rather than a reprieve are the ones the next deadline won’t catch off guard.
Featured photo source: Pexels
© 2013-2026 Nicole Mölders | All rights reserved
