EU AI Act pushed back 16 months: 5 things that change for companies
The European Parliament and Council reached a deal on May 7 to delay the rollout of high-risk AI rules, with the new deadline set for December 2027.
Is August 2026 still the real deadline for companies to comply with the EU’s new AI rules? Partly yes, partly no.
The European Parliament and the Council of Ministers reached a preliminary deal on May 7 to push back significant parts of the AI Act. The result: the deadline for high-risk systems shifts from August 2026 to December 2027.
The change is not final until parliamentary and council procedures confirm the text. The expectation is that this happens before August, when the current rules would otherwise kick in.
1. High-risk systems get 16 extra months
The biggest change. High-risk AI systems (systems used in decisions about hiring, lending, education and biometric identification) had been due to comply by August 2, 2026. The deadline now moves to December 2027.
The reason, according to Parliament and Council, is that smaller firms did not have the resources to comply in time.
Large technology companies have already poured significant resources into compliance. For them, the delay is savings, not a missed opportunity.
2. Chatbot rules still take effect in August 2026
While the main rollout has slipped, transparency obligations for chatbots and other AI systems that talk to users still take effect on August 2, 2026.
A company using an AI chatbot has to clearly indicate that the user is talking to a machine, not a person. In practice: if you visit an EU online store and start a chat with “support,” from August that “support” has to tell you it is AI or display a clear visual cue.
The rule applies to every company doing business in the EU, regardless of where the company is headquartered.
3. AI-generated content labeling pushed to December 2026
The obligation to clearly label AI-generated text, images and video has been pushed only four months, to December 2, 2026.
The rule applies to public-facing content:
- Social media posts
- Marketing materials
- Public documents
A private user writing emails with ChatGPT is not affected. A marketing agency producing AI-generated ads has to label every piece. The technical requirement is that labeling has to be visible “in real time,” not hidden in small print at the bottom.
4. Less overlap with other EU regulations
Another major part of the deal is removing rules that overlapped with GDPR, the Digital Services Act and other existing directives.
Companies complained about having three parallel obligations for the same action. That meant filing the same information three times.
The duty is now unified. One filing satisfies multiple regulatory frameworks. This helps smaller firms in particular, since they did not have legal teams to track every change.
5. Fewer obligations for small and mid-sized firms
The threshold for the strictest obligations has also moved:
- Old version: companies with more than 50 employees
- New version: companies with over 250 employees or over 50 million euros in annual revenue
That means significantly more startups and mid-sized firms now sit below the strict tier. They still owe the general transparency duties.
What this means for companies in Serbia
Serbia is not in the EU, but the AI Act has extraterritorial reach. Any Serbian company selling software, services or content into the EU has to comply.
In practice, every Serbian startup with European customers should already be working on its own compliance plan.
Domestic AI regulation has not been adopted yet. The Ministry of Information released a draft bill for public consultation in late 2025, but it has not entered formal procedure since. The expectation is that Serbia waits for the final EU AI Act text before passing its own law, to keep them compatible.
Why the delay got mixed reactions in Brussels
Civil society and academia are protesting, arguing the delay signals that business priorities outweigh citizen protection. Industry is welcoming the move, with the argument that real-world compliance capacity was overestimated.
Realistically, the deal is a political compromise. The high-risk rules are not being scrapped, just deferred. Anyone building AI in 2027 and 2028 will still have to clear the same bar. Just later.
Would 16 extra months be enough for your company to align with the AI rules?
